Privacy Policy

1. Who this policy covers

Customers, their staff and our website visitors. For this information EMBRK decides how and why it is used.

Guests of our customers. If you booked a tour, rental, activity or stay with a business that uses EMBRK.AI, that business is responsible for your information and its own privacy notice applies. We process guest information on the business’s behalf, as its service provider, under a Data Processing Addendum. Section 11 explains how to exercise your rights.

2. Information we collect

Information you give us

• Account and profile: name, email address, phone number, job title, role and permissions, and a profile photo if you add one.
• Sign-in and security: your password (stored only as a one-way hash), two-factor settings (authenticator secrets are encrypted; SMS and recovery codes are stored only as hashes), passkey public keys and login history.
• Business identity: legal and trading name, tax identification number, business type, address, website, support email and phone, and industry. We use these to register the business with payment and telecommunications providers.
• Agreement records: the name, title and email of the owner who accepts our terms, the date and time, IP address and browser, and the versions accepted.
• Support and communications: messages, calls and emails you send us, demo requests and feedback.
• Billing: owner contact details, invoices, usage and payment status. Card and bank details are collected and held by Stripe, not by EMBRK.

Information we collect automatically

• Device and usage: IP address, browser and device type, pages and features used, timestamps and error diagnostics, and a push subscription if you turn on device notifications.
• Cookies: strictly necessary cookies keep you signed in and secure and remember preferences in the platform. Our public website also uses analytics and advertising tags, described in Section 6.

Information from others

• Your employer: when a business invites you, it gives us your name, email and role.
• Service providers: account status from Stripe, carrier and registry status for texting, and email delivery events.
• Services you connect: data from accounts a business connects, such as Google (Section 4).
• Public business sources: publicly available business details, such as Google business listings, to pre-fill onboarding.

3. How we use information

We use the information above to:

• provide, maintain and support the platform, including signing you in and applying the permissions your business sets;
• keep the platform and our customers secure, including detecting fraud, abuse and unauthorised access;
• set up and operate payments, messaging and phone features;
• create, store and prove agreements with us;
• bill, meter usage and collect fees;
• tell you about the service, your account, security, and changes to fees or terms;
• improve the platform using usage information and aggregated or de-identified data;
• market our services to business contacts (you can opt out at any time); and
• comply with law, enforce our agreements and protect rights and safety.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use our customers’ data to train generalised AI models offered to others. Data from Google accounts is used only as Section 4 describes.

4. Google user data

A business can connect its Google accounts to EMBRK.AI. Each connection asks for only the access its feature needs, and Google shows you that access before you agree. EMBRK.AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What each connection reads and does

AI features

Some EMBRK.AI features use AI to help a business with its own work. Where the business uses them, Google data is sent to our AI service providers only to deliver that feature to that business:

• new emails from a connected Gmail mailbox may be sorted, prioritised and given a suggested reply by Autopilot (our provider TypeSafe), if the business has Autopilot turned on;
• when a staff member asks the EMBRK.AI assistant (powered by Anthropic’s Claude models) about a conversation, recent messages from it may be included so the assistant can answer or draft a reply; and
• when a staff member asks the assistant about reports, Google Ads, Analytics and Search Console figures in those reports may be included.

We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and our AI providers are not permitted to use it to train their models.

What we never do with Google user data

• We do not sell it, or transfer it to data brokers or information resellers.
• We do not use it for advertising, including retargeting or personalised or interest-based ads, for EMBRK or anyone else. Conversion uploads go only to the business’s own Google Ads account.
• We do not use it to determine creditworthiness or for lending.
• We do not transfer it to anyone except as needed to provide or improve the features the business uses, to comply with law, to protect security, or as part of a merger or acquisition, with notice.

Who can see it

Google data in a business’s account is shown to that business’s own signed-in staff, according to the permissions it sets. EMBRK personnel do not read it unless the business asks us to for support, it is needed to investigate security issues or abuse, or the law requires it. We may also use it in aggregated and anonymised form for internal operations.

How we store and protect it

Google access tokens are encrypted at rest (AES-256-GCM) and never shown in the platform. Data is stored with the rest of the business’s account in the United States and protected as Section 8 describes.

Disconnecting and deletion

• You can disconnect a Google connection at any time in the platform settings. We then revoke our access token with Google and delete the stored token and connection settings. You can also remove EMBRK.AI’s access at myaccount.google.com/permissions.
• After you disconnect, we stop reading from and writing to that Google account. Emails already brought into the inbox stay part of the business’s conversation history until the business deletes them or its account is deleted (Section 7). Ads, Analytics and Search Console figures are fetched from Google when a report is viewed and cached for at most an hour, so they stop appearing shortly after the connection is removed.
• To ask us to delete Google data we hold, email privacy@embrk.ai.

5. How we share information

Service providers. We use these providers to run the platform and our business. Each may process personal information only to provide its service to us, under contract. The current list of providers that process our customers’ guest data is at embrk.ai/legal/subprocessors.

Services a business connects. If a business connects a third-party service (for example Google, Meta or other advertising accounts, online travel agencies, waiver or import tools, webhooks, or apps it authorises through our developer API), information flows to that service at the business’s direction and under that service’s terms.

Your business. Staff activity (for example, who changed a booking or issued a refund) is visible to your business’s owners and administrators in audit logs.

Legal, safety and business transfers. We may disclose information if the law requires it or to protect the rights, property or safety of EMBRK, our customers, their guests or others. If EMBRK is involved in a merger, acquisition or sale of assets, information may transfer as part of it, subject to this policy.

6. Our website’s analytics and advertising tags

The public pages of embrk.ai (not the signed-in platform, and not our customers’ booking pages) use these tags to understand visits and measure our own marketing:

• Google Tag Manager and Google Analytics record pages viewed, how you arrived, device and approximate location, and actions such as booking a demo. You can opt out with the Google Analytics opt-out add-on.
• Meta Pixel records page views and demo requests so we can measure and target our ads on Facebook and Instagram. You can control this in your Meta ad settings.
• RB2B may identify the business, and in some cases the professional profile, of a US visitor from their browser and IP address, so our team can follow up with interested businesses.

Our demo booking page may also use Google Analytics and the Meta Pixel. To opt out of our website tracking or follow-up, email privacy@embrk.ai. These tags are about EMBRK’s own marketing. They never receive data from Google accounts our customers connect.

7. Retention

• Account information and data in a business’s account: kept while the account is active. After a customer’s agreement ends, it is kept for a 30-day export window and then deleted or de-identified within a further 60 days, except as below.
• Agreements and acceptance records: kept for 7 years after the agreement ends, as evidence of the contract.
• Billing and tax records: kept for 7 years, or longer if the law requires.
• Security and diagnostic logs: kept for up to 90 days unless needed longer to investigate an incident.
• Backups: deleted information may remain in encrypted backups until they are overwritten on their normal rotation, which does not exceed 30 days.

8. Security

We protect information with safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest, application-level encryption of secrets such as connected-account tokens and authenticator secrets, strict separation of each customer’s data, role-based permissions, two-factor sign-in and passkeys, an append-only audit log of administrative actions, restricted and logged staff access to production systems, and card entry only in Stripe-hosted fields so EMBRK never stores full card numbers. No system is perfectly secure. If a breach affects your information, we will notify you as the law and our agreements require.

9. Your rights and choices

Depending on where you live, you may have the right to know or access the personal information we hold about you, correct it, delete it, receive a portable copy, opt out of certain processing (such as targeted advertising), limit use of sensitive information, and appeal our decision on your request. We will not discriminate against you for using these rights.

Email privacy@embrk.ai or write to the address in Section 14. We will verify your request (for example, by confirming control of your account email) and respond within the time the law requires. You may use an authorised agent where the law allows. Some information about staff (such as your role) is controlled by your employer, and we may refer you to it. You can unsubscribe from EMBRK marketing emails with the link in any of them; service, security, billing and legal notices will still be sent.

10. Children

EMBRK.AI is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children for our own purposes. Businesses may record minors as participants in bookings and waivers; that information is governed by the business’s privacy notice.

11. Guests of our customers

If you are a guest and want to access, correct or delete your information, contact the business you booked with. If you contact us, we will forward your request to that business and help it respond.

12. Where information is processed

EMBRK is based in the United States and stores information in the United States. If you use EMBRK.AI from outside the United States, your information is transferred to and processed in the United States.

13. Changes to this policy

We will post changes here with a new version number and effective date and, for material changes, email customer owners at least 30 days before they take effect. We will ask for your consent before using Google user data in a new way that this policy does not describe.

14. Contact

AAMP LLC dba EMBRK.AI, 4375 S Valley View Blvd, Ste G, Las Vegas, NV 89103 · privacy@embrk.ai. See also our Terms of Service.