Privacy Policy

1. Our role

For account, billing, and website data, we decide how the information is used (we are the "controller" or "business"). For the photos, messages, and other content our customers bring into their workspaces, including information about their customers, community members, and people shown in their media, we process it on the customer's behalf as their "processor" or "service provider" under our Data Processing Addendum. If your information is in a customer's workspace, please contact that business with requests; we will help them respond.

2. Information we collect

Account and team: name, email, password (stored only as a salted hash), role, workspace membership, and sign-in activity.

Sign-in methods: if you add a passkey, we store its public key, an identifier, a usage counter, the device name you choose, and when it was added and last used; your fingerprint, face, or device PIN never leaves your device and we never receive it. If you turn on two-step codes, we store the shared secret encrypted and your backup codes only in a form that cannot be read back. If you sign in with Google, we receive only your Google account identifier and email address (the openid and email permissions), use them only to sign you in to the Ember account you chose or created, and do not keep Google access tokens. We record sign-in events (time, method, and device type) for security and to prevent abuse. You can remove any sign-in method in Settings, and this data is deleted when your account is deleted.

Workspace content: brand settings, photos, videos, audio, captions, messages, documents, logos, and fonts you upload or send by chat, text message, or email, and the drafts and posts created from them.

Connected sources: when you connect Google Drive, we read only the individual photos you choose with Google Picker, plus any folder you share with us by a link that anyone can view; from Discord and Telegram we receive messages, attachments, and member display names from the servers, channels, or chats you connect; from websites you ask us to watch we fetch public page text and images; and for public Instagram business profiles you name we use Instagram's official Business Discovery API to retrieve the profile description, follower count, and recent public posts.

Connected social and advertising accounts: encrypted access credentials, account identifiers, your posts and their metrics, comments and messages on your accounts (including the names and handles of the people who sent them), ad campaigns, targeting settings, and spend.

Mobile numbers: numbers you add for text approvals or photo intake, the messages exchanged with Ember, and your text-message consent status.

Billing: plan, invoices, and payment status. Card details are collected and stored by Stripe, not by Ember.

Demo bookings, support, and feedback: your name, email, company, appointment time, notes, and messages you send us.

Device and usage: pages and features used, device type, a random visitor identifier stored in your browser, the referring site (reduced to its domain), campaign tags kept for 30 days, IP address (used for security and rate limiting), and diagnostic logs.

3. Photo metadata and location

Photos can contain metadata such as the time and GPS location where they were taken. When a photo includes GPS coordinates, Ember may send those coordinates to OpenStreetMap's Nominatim service to find the place name, so drafts can mention the right location. We store the resulting place name with the photo's content notes. You can remove location data from photos before uploading, or ask us to remove it. We do not sell location data or use it to track individuals.

4. How we use information

We use information to: provide Ember (ingest your sources, generate and edit content, publish what you approve, run the automations and ads you configure, and send notifications); learn your brand's preferences from your approvals, edits, and results so future drafts fit your workspace; process payments; provide support; keep Ember secure, prevent fraud and abuse, and debug problems; comply with law; and understand and improve how the product is used. Where the EU or UK GDPR applies, our legal bases are performance of our contract, our legitimate interests in operating and securing the service, your consent (which you may withdraw), and legal obligations.

5. Artificial intelligence

To create the drafts, edits, image and video analysis, transcripts, and insights you see, Ember sends the necessary content (for example a photo, video frames or audio, captions, and brand notes) to the AI providers listed below. We use their business or API services, and where a provider lets us exclude our data from training its models, we do. We route simpler work to lower-cost or on-device processing where possible.

Learning in Ember stays in your workspace: the preferences Ember learns from your approvals, edits, and results are used only for your workspace and never shape other customers' content. Separately, to keep quality high, Ember keeps anonymous statistics about how its own design templates perform in its automated quality checks across all workspaces (for example, how often a layout passes a legibility check). These statistics never include your photos, text, captions, or approvals, or anything that identifies you or your business, and we may keep them after a workspace is deleted. If we ever offer learning from customer preferences across workspaces, it will be opt-in.

Ember analyzes images to understand what they show (for example, a storefront, a product, or that people are present) and where text can be placed. Ember does not perform facial recognition, does not identify people from their faces, and does not create or store face templates or other biometric identifiers.

6. How we share information

With the platforms you connect, at your direction: when you publish, reply, or advertise, we send the content and settings needed to those platforms.

With our service providers (sub-processors), who process data for us under contracts that limit their use to providing their services: see the list below.

With our billboard partner, when you request billboards: your business name, website, budget, dates, and target area.

For legal reasons: to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, and security of users, the public, or Ember. We review government requests before responding.

In a business transfer: if Ember is involved in a merger, acquisition, financing, or sale of assets, subject to this policy.

With your consent or at your direction.

We do not sell personal information, share it for targeted advertising, or share mobile numbers or text-message consent with third parties or affiliates for their marketing.

7. Service providers

Fly.io: Application hosting and databases (United States).

Vercel: Website and web-app hosting.

Cloudflare (R2): Media and export storage and delivery.

Stripe: Payments, subscriptions and invoices (card data is held by Stripe, not Ember).

Resend: Transactional and notification email.

Twilio: SMS and MMS messages for approvals and photo intake.

Sentry: Error monitoring (technical diagnostics, no account email).

OpenAI: AI text, vision, image, video understanding and audio transcription.

Anthropic: AI text and vision processing when selected for a task, or as a backup when our primary AI provider is unavailable.

Stability AI: AI image generation when enabled.

Typesafe (Jev): AI classification of short text.

Google: Sign-in and connections you authorize (Drive, YouTube, Calendar for demo bookings), web fonts.

OpenStreetMap Nominatim: Turning photo GPS coordinates into place names.

AdQuick: Digital billboard proposals and delivery reporting, when you request billboards.

8. Staff access

Access to customer workspaces is limited to authorized personnel who need it to provide support you request, keep the service secure, investigate abuse, comply with law, or operate and repair the service, and is logged. Customer post previews are excluded from Ember's staff quality feed by default; a workspace owner or admin may separately grant and revoke quality-review access. Google user data is handled under the stricter rules in section 13.

9. Retention

We keep workspace data while your account is active. Media you upload stays in your workspace until you remove it or delete the workspace. Archived and rejected drafts are pruned automatically. Operational logs, inbox items, and engagement records are kept for up to 12 months; product usage analytics for up to 13 months; text-message records for up to 12 months after the conversation; demo booking records for up to 24 months after the appointment. When you delete your workspace, we delete or irreversibly anonymize its data within 30 days, except records we must keep for security, fraud prevention, billing, tax, or legal reasons, and backups that expire on their normal cycle.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal our decision on a request. You can exercise these rights by emailing privacy@embersocial.io from the email address on your Ember account. We verify requests before completing them and respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.

You can disconnect any source or social account in Settings, reply STOP to any Ember text message, and unsubscribe from marketing email with the link in the message. Deletion instructions are on our data deletion page.

Data deletion instructions

11. Security

We protect information with encryption in transit (HTTPS) and at rest for connected-account credentials and AI keys (AES-256-GCM), salted password hashing, per-workspace isolation, access controls, rate limiting, audit logging, and error monitoring. No system is perfectly secure; if a breach affects your personal information, we will notify you and authorities as the law requires.

12. International transfers

Ember is operated from the United States and data is processed in the United States and wherever our service providers operate. Where the law requires, we use appropriate safeguards such as Standard Contractual Clauses for transfers.

13. Google Workspace data

When you connect Google Drive, Ember can read only the individual photos you choose with Google Picker (Google's per-file drive.file permission); it cannot browse or list the rest of your Drive. If you instead give Ember a link to a folder shared as "anyone with the link can view", Ember reads that public folder without signing in to your Google account. Ember uses those photos only to provide brand-asset intake, content generation, editing, and publishing features. Ember stores encrypted authorization credentials and working copies of selected media in its database and Cloudflare R2 so those user-facing features can operate. We do not sell Google user data, use it for advertising, allow unrelated human access, or transfer it except to service providers needed to provide the visible feature with your authorization. Google Workspace API data and its derivatives are never used to create, train, or improve a generalized or cross-customer AI or machine-learning model; they may be used only for that customer's personalized, visible Ember features. Customer post previews are excluded from Ember's staff quality feed by default; an owner or admin may separately grant and revoke explicit quality-review access in the Drive connection panel. Disconnecting Drive revokes and removes Ember's saved authorization; imported working copies remain part of your workspace until you delete them or request workspace deletion. Ember's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14. YouTube data

When you connect YouTube, Ember receives the channel identity and encrypted OAuth credentials, and stores the API response identifiers for videos you explicitly approve for upload. YouTube API data is not used for AI training, creative generation, derived engagement scores, advertising, or sale. Channel identity and authorization are checked periodically; cached channel identity and upload-response data expire after 28 days unless refreshed from YouTube. Disconnecting revokes Google authorization, removes credentials, and requests deletion of associated YouTube API data. The deletion worker retries failures; we investigate unresolved deletions and complete owner-requested deletion as soon as possible and within seven calendar days. Original files and copy you provided directly to Ember are separate from YouTube API data and remain available until you delete them. Deleting Ember's stored data does not delete videos on YouTube.

Google Privacy Policy · YouTube Terms of Service · Manage or revoke Google access

15. Meta, Instagram, and Threads data

Ember publishes only content you approve, or that an automation you turned on approves, to the Facebook Pages, Instagram accounts, and Threads profiles you select, never auto-sends direct messages, and uses Instagram Business Discovery only for public business profiles you name. When you remove Ember in your Meta account settings, Meta may send us a signed deletion request; we verify it and delete the associated credentials and platform-derived data.

16. Cookies and device storage

Ember uses an essential session cookie to keep you signed in (it expires after 14 days). The website and app use local storage, session storage, and browser caches to remember preferences and workspace context, to keep a random visitor identifier for first-party product analytics, and to cache interface resources. We do not use third-party advertising cookies or trackers. Fonts are loaded from Google Fonts, which receives your IP address and browser details when fonts load. You can clear cookies and site data in your browser; doing so may sign you out or reset preferences.

17. Demo appointments

When you book a demo, we collect your name, email, selected appointment time, and any business details or notes you choose to provide. We use Google Calendar to check the Ember owner's availability and create your invitation and call link, and Resend to deliver booking notifications and reminders. The owner-only Calendar connection uses encrypted authorization credentials. Other calendar event details are used only to avoid scheduling conflicts; they are not shown to visitors, added to customer workspaces, or sent to AI providers. Your browser stores a random booking reference so an interrupted request can be recovered without creating a second appointment. Contact privacy@embersocial.io to request deletion of your booking data.

18. Community content: share links and permission requests

Some businesses that use Ember share content made by their customers and fans ("community content"), with the creator's permission. This section explains what we collect and how we use it when a business does this.

Posts that tag or mention a business. A business can review public posts that tag or mention it, posts sent to it in its Discord community, and posts it adds by link. For each one, Ember keeps a reference to the post (its link, the creator's public name or handle, a short excerpt of the public caption, public like and comment counts, and the post date) and the link to its public preview image. For a text message a member posts in the business's Discord community, Ember also keeps the words of the message (up to 500 characters) so the business can read it and decide whether to ask; it is not used in any post unless the member approves. To decide whether a post is worth asking about, Ember may analyze the public post briefly: it loads the preview image temporarily, checks its quality, and may use an automated image review to judge whether it shows the business and whether it is suitable to share (for example, that it is not focused on a child). The image is not stored. We keep only a score, a short reason and general signals (for example "shows a product" or "recognizable people present"); we do not keep descriptions of people. A business can dismiss a post; we then keep only enough to avoid suggesting it again.

Permission requests. If the business wants to share a post, the creator gets a link to a permission page. We make sure only the real creator can approve: on Discord, the Ember bot sends the link as a private message; for a post that tagged or mentioned the business, the business replies to the post with the link and, after approving, the creator confirms it is their account by replying with a one-time code from that same account; for a post the business added by link, the business must confirm it sent the link privately to the creator. The link expires after 30 days if unanswered, and so does the code. Nothing is shared unless the creator approves.

The permission page. The page shows the post (for a message, the exact words that may be quoted), the business's name and the full permission wording. To approve, the creator types their name as a signature, ticks a box and, when Ember cannot get the photo from the platform, uploads the original. We store a record of the permission: the exact wording and its version, the typed name, the handle used for credit, the time, how the creator's identity was confirmed (private message, reply code, or the business's confirmation that it sent the link privately) and when, and a one-way hash of the IP address (not the address itself).

Storing media only after permission. Ember stores a copy of the photo only after the creator approves and their identity is confirmed, either their upload or the photo from the platform where Ember can fetch it. Before storing it, we resize it and remove location and camera details. In the same way, a community member's message is used only after the member approves: the business may then quote it, as written or shortened, or use it as the idea for a post, with credit.

Photos shared through a share link. Some businesses also turn on a share link so customers can send photos directly. When you use one, we collect the photos you upload, the name and optional handle you give for credit, your optional email address, and the same kind of permission record. These photos are stored when you send them, because you give permission as you send them.

How it is used. We process this information on behalf of the business, so that business decides whether to share the content, and its own privacy practices apply to how it uses it. The business sees the name and handle you give and credits you in every post that uses your content. We use community content only to create that business's own organic posts. We do not use it in paid ads, and we do not use photos of children.

Withdrawing permission. You can withdraw at any time with the same link (or, for a share link, the withdrawal link you received). When you do, the business stops using the content, we delete our stored copy (for a message, its words), posts not yet published are cancelled, and published posts are deleted automatically on platforms that let Ember delete posts (currently Facebook, X, LinkedIn, Pinterest, Bluesky, Threads and Discord). On platforms that do not (currently Instagram, TikTok and YouTube), we alert the business right away and ask it to remove the posts within 48 hours, and we remind it daily until it confirms. The withdrawal page tells you which posts were removed automatically and which the business has been asked to remove.

Retention. We keep the permission record (what was agreed and when) as proof of the permission, including after withdrawal. For share-link submissions, we clear the email address 12 months after withdrawal. You must be 18 or older to give permission. Contact privacy@embersocial.io with any request about community content.

19. Children

Ember is a business service for adults and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where applicable). Businesses that upload photos of minors are responsible for obtaining a parent's or guardian's permission.

20. Changes and contact

We will post changes here and update the date above; for material changes we will notify account owners in Ember or by email. Questions or requests: privacy@embersocial.io, or Veil Hunts LLC, a New Jersey limited liability company, attention: Privacy.