Privacy Policy & Protection Guidelines

This Privacy Policy applies to all products, platforms, API endpoints, web interfaces, and mobile applications operated by AMC Ventures Group ("AMC", "we", "us", or "our"). When you create an AMC Account or utilize AMC Single Sign-On (SSO), your data is safeguarded under the protocols defined in this directive.

Our core privacy tenets are built around three non-negotiable principles:

• Data Minimization: We only request and process information strictly necessary to operate your account and deliver services.
• Zero Monetization of Personal Data: We never sell, rent, trade, or monetize your personal details, browsing habits, or credentials.
• User Control & Transparency: You retain full ownership of your data, including the right to export, modify, or permanently delete your account history at any time.

To provide unified identity management and prevent cyber threats, we collect specific categories of data:

A. Account Registration & Profile Data

• Primary Identity: Full Name, Primary Email Address, Date of Birth, and Mobile Phone Number.
• AMC Member ID: Unique alphanumeric identifier (e.g. AMC000104) assigned to your account.
• Recovery Information: Optional recovery email address, emergency contact, and 12-word cryptographic recovery phrase.

B. Authentication & Security Telemetry

• Cryptographic Passkeys & Biometrics: Public key credentials (FIDO2 / WebAuthn standard). Note: Raw biometrics (fingerprints/Face ID) remain on your local hardware device and are never sent to AMC servers.
• Active Session Records: IP address, user-agent hardware metadata, timestamp, location estimate, and session tokens stored in user_sessions.
• Security Audit Logs: Sign-in audit events used for anomaly detection and security monitoring.

AMC processes your information under legal grounds established by international privacy standards:

• Service Execution: Provisioning Single Sign-On across AMC applications, routing web requests, and securing account access.
• Account Security: Verifying credentials, detecting unauthorized session hijacks, preventing password spraying attacks.
• Communication: Transmitting essential security alerts, passkey enrollment confirmations, and transactional receipts.
• System Health: Processing opt-in crash reports and diagnostic performance metrics (only if enabled in Security & Privacy settings).

We maintain multi-layered hardware and software defenses to safeguard your personal identity:

We use essential technical cookies to manage your sign-in state across AMC applications:

• Session Cookies (PHPSESSID): Essential cookie required to keep you signed in as you navigate between pages.
• JWT Tokens (amc_jwt): Secure token supporting multi-app Single Sign-On and session extension.
• Passkey Local State: Client-side localStorage flag storing passkey registration status on your specific browser.

We do NOT use third-party tracking pixels, advertising cookies, or cross-site tracking tools.

We only disclose account information under strict legal necessity:

1. Legal Process & Subpoenas: When mandated by valid law enforcement warrants complying with due process.
2. Protection of Life & System Integrity: In extreme emergencies involving imminent physical danger or catastrophic infrastructural attack.

Regardless of your geographic location, AMC extends unified digital rights to all users:

• Right of Access & Inspection: Review all personal information and login session records directly in your Account Settings.
• Right to Data Portability: Export your security logs and profile metadata as machine-readable JSON files.
• Right to Rectification: Edit your name, phone number, recovery email, and security settings instantly.
• Right to Erasure ("Right to be Forgotten"): Initiate permanent account deletion in account-setting.php, purging your record from primary databases.

We enforce explicit data retention limits:

AMC relies on ISO 27001-certified infrastructure sub-processors to maintain high uptime:

• FlagCDN / IPAPI: Used for optional country detection and IP geolocation (no personal identity sent).
• Cloudflare CDN: DDoS protection and edge SSL TLS encryption.

If you have questions, inquiries, or privacy complaints, please reach out directly to our Data Protection Officer: