Privacy Notice

Effective date: August 4, 2026

This Privacy Notice explains how Ember AI handles personal data when you use Ember AI Builder, the Ember AI dashboard, related APIs, and support services.

1. Information we collect

  • Account information: your email address, verification status, session records, and account preferences.
  • Connected-site information: WordPress site URLs, connection and revocation records, and cryptographically protected authorization credentials.
  • Service content: instructions, selected WordPress block or page data, generated output, image-search terms, and technical context needed to perform a requested action.
  • Usage and technical information: credit activity, request identifiers, timestamps, action outcomes, provider usage and cost telemetry, security events, IP-derived anti-abuse data, browser and device information, and diagnostic logs.
  • Billing information: credit-pack, customer, license, transaction, refund, and credit-grant identifiers received from Freemius and, for historical orders, Paddle. We do not receive or store your full payment-card number.

2. How we use information

We use information to authenticate users; connect authorized WordPress sites; provide AI-assisted generation and editing; search for requested images; administer credits and credit-pack purchases; prevent fraud and abuse; secure, troubleshoot, and improve the Service; communicate about accounts and transactions; respond to support requests; and comply with legal obligations.

3. Legal bases

Where data-protection law requires a legal basis, we process information as necessary to perform our contract with you, for our legitimate interests in operating and securing the Service, to comply with legal obligations, and with consent where consent is required. You may withdraw consent at any time, without affecting processing already performed.

4. Service providers and disclosures

We disclose information only as needed to operate the Service, comply with law, or protect rights and security. Providers may include Cloudflare for hosting, storage, security, and bot protection; Resend for transactional email; Freemius as Merchant of Record for new checkout and payment administration; Paddle for historical payment administration; OpenRouter and selected model providers for AI processing; and Pexels for requested image search. These providers process information under their own terms and privacy obligations.

We may also disclose information in response to a lawful request, to investigate abuse or security incidents, in connection with a merger or transfer of the Service, or when you direct or authorize the disclosure. We do not sell personal data or use it for third-party targeted advertising.

5. Cookies and local storage

The Connect service uses essential security and session technologies, including a secure, HTTP-only session cookie, to keep you signed in and protect account actions. Cloudflare Turnstile may set or read technical data needed for bot detection. We do not use advertising cookies on the Connect service.

6. Retention

We retain account, site, billing, credit-ledger, and security records for as long as reasonably necessary to provide the Service, maintain transaction and abuse-prevention records, resolve disputes, and meet legal obligations. Retention periods vary by record type and provider. We delete or de-identify information when it is no longer reasonably required, subject to backups and legally required records.

7. Security

We use technical and organizational safeguards designed to protect personal data, including encrypted transport, access controls, hashed authentication tokens, limited-purpose credentials, security headers, bot protection, and provider-managed encryption. No online system can guarantee absolute security.

8. International processing

Our providers may process information in countries other than your own. Where required, we rely on recognized transfer mechanisms and provider safeguards intended to protect personal data across borders.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data, and to complain to a data-protection authority. Some records may be retained where required for security, billing, fraud prevention, or legal compliance. To make a request, contact support@emberwp.com. We may need to verify your identity before completing a request.

10. Children

The Service is intended for adults and is not directed to children under 16. We do not knowingly collect personal data from children under 16.

11. Changes and contact

We may update this notice as the Service or legal requirements change. We will update the effective date and provide additional notice for material changes when appropriate. Questions or privacy requests may be sent to support@emberwp.com.