Privacy notice

Controller: Ember Gaming LLC, 14534 S Abbott Rd E, Homer Glen, IL 60491, USA. Privacy contact: support@embercreator.com. Effective: November 15, 2026. This notice covers Ember Links: the company site (emberlinks.bio), the dashboard (app.emberlinks.bio) and creator pages on withme.bio, emberlnk.me, hellomy.bio and customers' own connected domains. Ember does not host or sell adult content. Creators may separately control the content and destination services they choose. A customer data-processing agreement must define any processor role; it is not implied by a plan purchase.

We process account identifiers, login/session and role information, consent receipts, creator-authored profiles/links/photos, domain onboarding details, support requests and billing references needed to provide and secure the service. Managed payment providers collect payment details in their own checkout; Ember should retain references/status, not raw card numbers or security codes. Do not upload identity documents, sensitive personal records or images you lack permission to use.

Visitor requests expose network/device information to our delivery and security services. We use limited request metadata, country and approximate city to apply protection/routing and, if enabled, show the viewer's area. This is inferred from the request and can be inaccurate; it is not GPS or evidence of a creator's location. Visits may expose campaign parameters to the creator's selected destination where configured. We must not forward unrelated query values or reveal protected destination details to analytics vendors.

Purposes include service delivery/account administration, fraud/abuse prevention, reliability diagnostics, support, billing/accounting and optional product analytics. For applicable privacy regimes, map each purpose to its actual lawful basis before publication: contract where necessary for customer service; assessed legitimate interests for proportionate security; legal obligations for required records; consent for optional analytics/marketing where required. Do not use a general terms checkbox as optional tracking consent. No marketing sale/sharing of personal data is proposed; verify the actual configuration before making any statutory no-sale/share statement.

Our service providers are: Stripe (payments, Checkout, Customer Portal, invoices); Supabase (accounts and sign-in by email/password and Google sign-in, with two-step verification; hosted in the United States, us-east-1, Northern Virginia); Cloudflare (Workers hosting, D1 database stored in the United States, Email Sending for transactional email from no-reply@notify.emberlinks.bio, Turnstile human checks, Access for staff-only areas, custom hostnames and certificates); and Sentry (error monitoring, with personal data scrubbed). Domain Shield's checkers are Google Web Risk, abuse.ch (URLhaus and ThreatFox), Quad9, Norton Safe Web and Cloudflare DNS security filters. Ember sends them only the domain name being checked, with no personal data and no visitor data. Each provider processes the lookup under its own terms and may log lookups: Google Web Risk ([Google Cloud terms](https://cloud.google.com/terms) and [Google privacy policy](https://policies.google.com/privacy)); abuse.ch for URLhaus and ThreatFox ([terms of use](https://abuse.ch/terms-of-use/)); Quad9 ([privacy policy](https://quad9.net/privacy/policy/)); Norton Safe Web ([Gen privacy](https://www.gen.com/privacy)); and Cloudflare DNS security filters ([Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/)). Ember keeps the latest scan result for each domain until the domain is removed or the account closes, including the date the domain was first flagged, which is kept with that scan result. Daily scan-usage counts are kept for 7 days. The email address used for flag alerts and free-trial reminders is kept until it changes, stops being verified, or the account closes.

PostHog (US cloud) is a processor for product analytics of the signed-in Ember Links dashboard (app.emberlinks.bio) only, that is, how creators use the dashboard. PostHog is not loaded on creators' public link-in-bio pages for their visitors. The cookies and processors register lists each provider's limits. We may disclose necessary information for lawful requests, safety and disputes, with access controls. Creator destinations have their own policies and may receive information when a visitor continues. Linking to them is not a certification.

Proposed retention: active content while the account/service requires it; recoverable deleted content up to30days and backups up to90days; security events up to30days unless an incident/claim requires a documented hold; aggregate creator analytics90days on the proposed baseline; financial/tax evidence for the reviewed statutory period. These periods require storage/vendor configuration and deletion verification before publication. Existing immutable records and unresolved revocations must not be silently purged; define their legal/security retention separately. Archives are retained content, not completed deletion. The current application diagnostic index has a seven-day expiry rule and a10,000record storage cap; its fields are reference, service and observation/expiry times. Expired entries are omitted from its recent-events view, while physical removal depends on cleanup running. This is a source configuration, not a verified deletion guarantee or the retention period of Cloudflare logs, Sentry, PostHog, support records, exports or backups. Determine and verify each of those separately before publication.

People may request access, correction, deletion, portability, restriction or objection as applicable at support@embercreator.com. Verify identity proportionately. Explain retention exceptions/holds, response times and any applicable appeal/regulator rights; do not demand unnecessary identity records. Consent, where we ask for it, can be withdrawn at support@embercreator.com or in your account settings. Optional tracking must stop after withdrawal. Service/security data necessary to operate the requested flow may continue under its appropriate basis.

Our D1 database is stored in the United States. Other providers may process data in other countries.

International transfers: Ember Gaming LLC is a US company. Personal data is processed in the United States and by the providers listed above. Where the law requires it, transfers of personal data from the EU use standard contractual clauses, and transfers from the UK use the UK addendum to those clauses.

Accounts and sign-in are run by Supabase in the United States (us-east-1, Northern Virginia), next to our D1 database. List any required representative/DPO and relevant supervisory complaint route. The service is proposed for adult account holders; do not knowingly collect children's accounts. Investigate and remove disallowed minor-related data through a documented safety process.

We notify users of material notice changes and preserve effective versions. When an account is terminated, it goes through the account closure review and data is handled as described in this notice.

Emails we send

Ember sends service emails through Cloudflare Email Sending from addresses at notify.emberlinks.bio. They are: - a receipt when you ask to close your account; - a notice when your account data is downloaded; - an alert when one of your custom domains is flagged by a safety list; - a reminder 3 days before a free trial ends, sent to the workspace owner's verified sign-in email; - a team invitation, sent to the address you enter when you invite someone.

These are service messages, not marketing. Each one goes to your sign-in address, your verified alert address, or the address you invited. Cloudflare processes the address and message content to deliver it.

AI assistants and other connected apps

You can connect an AI assistant, such as Claude, or another app to your account through the Model Context Protocol (MCP), using OAuth sign-in. - The connection is **read-only**: it can list your pages and read analytics and drafts, and it cannot publish, edit or delete. - You approve each app on a consent screen. Each app appears under Connected apps on your Account page, where you can revoke it at any time. - We store the app's name and redirect addresses, and the tokens we issue only as one-way hashes. Access tokens last 1 hour; renewal tokens last 30 days and change at each use. If the app has its own secret, it is shown once and stored only as a hash. - What the app reads is sent to that app and its provider, for example Anthropic for Claude, under **their** terms and privacy policy. Ember doesn't control what they do with it. Connect only apps you trust.

Teams

An account owner can invite teammates by email. The invitation and the invited address are kept encrypted, and the invite expires after 24 hours. A teammate who accepts gets the role the owner chose. Planned: limiting a teammate to pages with certain tags. Owners can see their team in the dashboard.

Domain Shield checks

When you connect your own domain, Domain Shield can check it against public safety lists (the providers are listed above), when you ask and once a day automatically. Results and flag alerts are kept as described above. If a domain is flagged, we email the alert address you confirmed.

Billing extras and referrals

Payments are handled by Stripe. Sparks are billed per spark (one is free on every plan). Referral earnings are paid only as Ember Links account credit, never as cash. - When someone opens your referral link, a 60-day cookie (`ember_ref`) remembers the link. If that visitor later starts their first paid plan, we record the referral against your account. - We keep the referral code, click counts, which accounts were referred, commission amounts and the credit applied.

How pages are delivered

We serve the dashboard's page frame from the Cloudflare location closest to you, and we keep your account data in the United States. That changes only where the frame comes from, not what data we process.

Account closure and downloads

A person on our team reviews each closure request. Your pages stay online until the review is done; then data is removed under the retention rules above. You can download your account data (JSON export) from the Account page. Ember emails a notice when a download happens. Downloads are partial exports as described below, not complete provider exports or backups.

Cookies

We use necessary cookies, for sign-in and session and for security (human check). We use no advertising cookies. The dashboard's product analytics (PostHog) may use browser storage. Where the law requires consent, product analytics in the dashboard runs only after you agree. The full list of cookie names, purposes and lifetimes is in the cookies and processors register.

This draft is not legal advice and does not by itself establish a working rights inbox, deletion workflow or legal compliance. Those remain launch gates.

Optional crawler-policy observations — draft technical disclosure

If enabled after review, a separate operational security ledger can record the account/page and admitted hostname, publication revision/epoch, minute-rounded time, resource category, bounded automation signal or unverified Meta agent claim, and the protected-content policy decision. A random internal event ID supports duplicate handling; it is not a visitor or login-session identifier. This ledger does not store raw IPs, user-agent text, cookies, tokens, request bodies, URL paths/queries or destinations. Delivery/security providers may separately process network information under their own configured retention and contracts.

Coverage is limited to eligible GET requests reaching the resolved page's policy layer. Earlier or upstream blocks, dropped observations and storage/rate failures may be absent. A policy-layer pass does not prove delivery or successful verification, and an agent claim does not establish verified Meta identity or Instagram account safety. Any future displayed counts must explain this partial coverage and remain separate from consented human analytics.

The separate technical proposal caps retained rows at100,000 globally and2,000 per page/UTC day, requires a per-page rate gate, and rejects writes delayed more than five minutes. Rows become eligible for removal after90days, with at most500 removed per cleanup pass; draining and recovery holds can extend actual retention. This is a distinct draft proposal requiring reconciliation with the general security-event proposal above, not approval to activate collection or a deletion guarantee. Current account/publication/address and recovery checks apply to new writes. Raw event export is withheld; aggregate export, closure, legal holds, backup/restore propagation and the applicable lawful basis still require review before activation.

Optional social-profile lookup — draft technical disclosure

If the optional management lookup is enabled after provider approval, an editor can submit a public Instagram handle to help identify the intended profile. The candidate service receives that handle and Ember's service credential; this flow does not request the creator's Instagram password. It can return a profile identifier, handle, display name, avatar address, follower count, public bio-link addresses and the observation time. This source flow does not explicitly forward visitor cookies, visitor IP addresses, Ember login tokens or creator photos to that lookup service. Provider-side request records, retention, rights and international transfers still require contractual review. Publicly accessible information must not be treated as automatically anonymous or unrestricted for reuse.

Before confirmation, the source returns a short-lived, page-bound confirmation record for review. Confirming the matching candidate can store the profile metadata together with the page/account association, source revision and confirmation time. This is an association chosen by the editor, not verification of profile ownership, age, follower authenticity or continuing accuracy. Avatar and bio addresses may contain identifying or functional query values. The current confirmation card uses an initial instead of fetching the returned avatar; storing an address does not authorize copying that image or following bio links. Do not forward these addresses or confirmation records to general analytics or error reports.

Candidate source cleanup removes the current derived snapshot after an incompatible handle/owner change, page archive or account deactivation. Deployment and actual deletion must still be verified. This cleanup does not erase historical page versions, access/audit records, provider records, previously saved exports or backups. No approved age-based expiry for an otherwise active snapshot is implemented yet. Finalize the purpose, lawful basis, applicable notice/choice, provider permissions and retention/exit schedule before activation; do not publish a universal deletion promise from these triggers.

Where separately enabled, the account owner's partial page-activity export includes retained profile ID, handle, display name, observed follower count, source revision and observation/confirmation times. It excludes raw profile JSON, avatar/bio addresses, confirmation credentials and owner namespace. Zero followers is a recorded value, not missing data. This is neither a complete profile/account/provider export nor a live count or ownership check. A saved display preference alone does not connect a follower provider or establish public follower-count support.

Account access, imports and recovery — draft technical disclosures

Where enabled, owners can create scoped API keys for their workspace. We retain key labels, permissions, creation/expiry times, revocation or recovery-invalidation state and related audit references. The generated secret is disclosed once; normal lists and account exports exclude the secret and its stored verification hash. A key marked issued is not a promise that a particular API capability is enabled. Revoking a key stops future authorized use; it does not erase the retained history of earlier access or changes.

Reading extracted import results is a separate permission from proposing an import source. Extracted text, destination links and image URLs may contain private or identifying information, including functional query values. Treat them as sensitive untrusted content. An image URL in an extraction report is not a copied or licensed image. Import review, authorized photo copying and page publication are separate actions. API/MCP access does not authorize a third party to publish content or confirm rights for the owner.

Where approved-file workflows are enabled, we also retain file claims, human rights/comparison attestations, approval references and an authorized observation when matching private media is ready. Those records link account, credential, review, approving session and asset identifiers with relevant times. The activity export projects only selected audit metadata and does not include file names, image bytes, storage addresses or API-key secrets. A ready observation may be recorded during a recovery/status read and does not prove that the browser received a response, that content was published or that an earlier API key remains active.

Access audit records document admission of a request, not proof that a client received a file or that a destination worked. They may be retained even where delivery later fails. Define and verify the applicable retention/hold rules before publishing a period for these records; immutable source guards do not establish a legal right to keep them forever.

Available download tools currently prepare selected datasets, such as saved page histories, API credential metadata/activity, media inventory, billing preparation proposals and domain requests/history or recorded leases. Each dataset requires its own enabled capability; preparation does not guarantee a successful saved file. Those files are explicitly partial and are not complete account/provider exports or operational backups. Downloaded files can contain private account identifiers and destinations; store them securely. A closure request or cancellation records an owner's intent. It does not by itself stop billing, retire a domain, erase content or remove backups. A complete rights-response and closure process remains a launch requirement.

For unexpected service failures, the application can provide an opaque diagnostic reference so authorized support can correlate a report. The local MCP bridge retains only a validated reference from unsuccessful API responses; it discards private error bodies and arbitrary headers. A reference is not proof that an external diagnostics vendor received the event. Sharing a reference with support does not authorize sharing credentials or private destinations.

Page imports — draft technical disclosure,2November2026

When an authorized editor requests an import, the source implementation fetches the selected public page and selected photo URLs. The report can contain a display name, bio, link labels, complete source/destination URLs including their query values, image addresses and descriptions, source ordering and review warnings. A source website or its content host receives the requested address and ordinary server connection metadata. Those operators have their own practices; do not describe every source website as an Ember-contracted processor. Import only content you own or have permission to reuse, and avoid entering secret preview or account-recovery URLs.

Stored job/review records can include the selected source, proposed links and photo assignments, request/lease identifiers, processing status, results and adoption references. Selected photos are copied into owned private media before their use in a draft; an external candidate address alone is not a completed copy. Account-scoped photo source-key bindings retain the association between an upload request and its source URL to prevent unsafe reuse, and can survive review-history removal. No final retention/purge schedule or complete rights-response export for those bindings has been accepted. Do not apply the proposed30/90day periods above automatically or promise that clearing history erases every related record.

The optional rendered-import path is not activated. If an isolated browser service is later selected, its provider, region, contracts, resource requests, session disposal and logs must be reviewed and added before use. The current source resource broker accepts bounded public HTTPS GETs and does not forward Ember login credentials or an editor's signed-in browser cookies. This does not establish the behavior or retention of a future browser runtime. Rendered pages still require current job/account authorization, explicit destination review, selected photo copying and separate publication. Access denial or a human challenge is not permission to bypass source protections.

These paragraphs describe current source work and launch requirements, not an active public service, approved processing agreement or completed deletion/rights workflow.

Questions about this policy: support@embercreator.com.