Ambral now asks AI-native companies to route production traffic through one endpoint that captures traces and trains models on them. But its privacy policy, updated November 2, 2026, still describes "a cloud-based, AI-powered account management platform" called Cortex, gives no retention periods and says de-identified data may be used to train AI models. The terms are described as "AI for account management and revenue growth" and promise no uptime or support. The first documents a security reviewer opens describe a different product from the one being bought.
First action
List every place the old Cortex wording still appears: privacy policy, terms, page descriptions and trust center.
How to measure it
Call-to-traffic time
- Now
- –
- Target
- -30%
- By
- 90 days
Steps
Inventory the wording
Privacy policy, terms, page metadata and trust center text that still describe Cortex or account management.
CEO (co-founder) 1 day
Write the data-use facts
What each request stores, retention, access, training scope, closed-model limits, deletion and regions, written from how the system actually works.
CTO (co-founder) 2 days
Legal review
Counsel turns the facts into an updated privacy policy and endpoint service terms.
Outside counsel 1 week
Publish
New privacy policy, endpoint terms and a Data Use page, each dated and versioned.
CTO (co-founder) 1 day
Link it
From the homepage footer, the book page, the models page and the trust center.
Member of Technical Staff (New Grad) 2 hours
Send it ahead
Attach the Data Use page to every calendar confirmation.
CEO (co-founder) 1 hour
Log objections
Record each security question per deal and add the answers to the page.
CEO (co-founder) ongoing
Why it works
Publish documents for the product Ambral sells today. Write a Data Use page covering what is stored from each request, how long traces are kept, who at Ambral can see them, that a customer's traffic trains only that customer's own models, and what happens on deletion. Update the privacy policy so it names the endpoint and trace capture. Add service terms with an uptime target and support hours, plus a short subprocessor list. Link all of it from the homepage footer, the book page and the trust center, and send it with every booked call so the champion can forward it to security before the first meeting.
For a buyer, routing production prompts through a new vendor is a data decision before it is a cost decision. When the documents match the product, the main reason a champion can't get approval goes away, and the security review after a good demo gets shorter. Rivals with years of enterprise paperwork set the bar buyers compare against.
Ready to use
ChecklistEndpoint Data Use page
[ ] What each request stores (prompt, output, metadata) [ ] How long traces are kept, and how a customer shortens it [ ] Who at Ambral can see traces, and when [ ] A customer's traffic trains only that customer's models [ ] Closed models: evaluation and inference only [ ] Deletion on request and at contract end [ ] Subprocessors and regions [ ] Uptime target and support hours [ ] Link to the trust center [ ] Version and date
Risks and how to handle them
Promising retention or isolation terms the system can't yet enforce
Publish only what is true today, date the page and update it as features ship.
Existing enterprise customers signed under the old terms
Their Enterprise Agreements stay in force; the new terms cover new sign-ups.
Evidence
- Your websitePrivacy policy (v1.0.4, updated November 2, 2026): describes Ambral as "a cloud-based, AI-powered account management platform", the "Cortex Platform", that helps businesses improve customer relationships through data analysis, automated workflows and predictive insights. It does not describe an inference endpoint or trace capture, gives no fixed retention periods, and says aggregated or de-identified data may be used to train AI models (opt-out by email), while data processed under a customer's Data Processing Addendum is not used for training.Source
- Your websiteTerms of Service (v1.3.0, dated April 20, 2026): the page description reads "AI for account management and revenue growth"; the terms cover "the Site" and services made available through it, with no uptime commitment or SLA ("We have no obligation to provide you with support or maintenance for the Site"); an Enterprise Agreement overrides them.Source
- Your websiteHomepage (www.ambral.com redirects to labs.ambral.com): H1 "Inference that learns from your workloads.", subhead "Lower AI spend without compromising quality.", aimed "For AI-native companies"; "Change one line. Keep everything else." with a code sample that swaps one base URL; four steps, Connect, Evaluate, Optimize and Learn, ending "Accepted outputs, merged changes and closed deals flow back." The only proof is "Backed by Y Combinator": no customer logos, testimonials or case studies, no docs link, no pricing, and no mention of security, data retention or deployment options. Every call to action is "Chat with us".Source