Privacy Policy.

Embrasure provides software that helps teams connect governed data sources, ask questions, build context, and operate data agents. In most customer workspaces, the customer is the controller of the personal information they choose to put in or connect to Embrasure, and Embrasure is the processor or service provider. Embrasure is the controller for account administration, website visitors, sales, billing, security, and product improvement data we collect for our own business operations.

This policy applies to Embrasure websites, hosted product interfaces, local tooling that authenticates to Embrasure services, support communications, and related business interactions. It does not govern a customer's own data practices or third-party websites that may link to or from Embrasure.

Embrasure does not intentionally collect payment card numbers directly; payment information is processed by our payment or billing providers if a paid plan requires it.

• Directly from users and workspace administrators when they create accounts, configure workspaces, connect data sources, invite teammates, contact us, or use the product.
• Automatically from the product and website through logs, cookies, analytics events, security telemetry, and similar technologies.
• From connected systems that an authorized customer user chooses to connect, such as warehouses, identity providers, collaboration tools, or business applications.
• From business sources such as procurement systems, partner referrals, public company websites, and communications with prospective customers.

• Provide, secure, maintain, and improve Embrasure.
• Authenticate users, enforce workspace roles, support SSO and domain restrictions, and prevent unauthorized access.
• Connect to customer-authorized data sources, generate catalog metadata, run approved queries, produce agent outputs, and maintain auditability.
• Provide support, debug issues, investigate errors, and communicate about product changes, incidents, billing, and security.
• Measure usage, reliability, performance, and feature adoption so we can improve the product and prioritize engineering work.
• Protect against abuse, fraud, security threats, and violations of our agreements or acceptable use rules.
• Comply with legal, tax, accounting, security, and compliance obligations.

A workspace administrator may connect a Google Workspace directory using Google OAuth. Embrasure requests read-only access to directory users and groups. This can include names, work email addresses, account status, organizational information, group membership, and profile photos.

Embrasure's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

A workspace administrator may connect a Google account and choose a spreadsheet through Google Picker. Embrasure requests access only to Google Drive files the user explicitly selects for the app. It does not request access to browse every file in the user's Drive.

Embrasure's use and transfer of Google Sheets data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

When an administrator connects Google during Cloud SQL setup, Embrasure reads instance and database metadata in the Google Cloud project they enter. This includes instance and database names, region, PostgreSQL version, connection addresses, network and SSL settings, and database flags. We use this information to help the administrator choose a database and check connection and sync prerequisites. We read your Google account identity to identify the connected account and protect shared access during cleanup. When you choose passwordless access, your verified Google account email also identifies the database user.

Google's Cloud SQL permission allows management of Cloud SQL resources. Embrasure uses it only for metadata reads during onboarding; it does not change instances, networks, database flags, or database users through the Google API. For Scheduled sync, administrators can use their Google account when IAM database authentication and read permissions are configured, or supply a PostgreSQL login. Continuous sync uses a PostgreSQL login with replication access.

Embrasure's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

A workspace administrator may install Ember, Embrasure's Slack app. Ember responds when someone sends it a direct message or mentions it in a conversation it has been added to. It reads only conversations it can access in Slack, and only when needed to answer a request.

Embrasure supports direct queries to connected sources and ingestion into a managed warehouse. When a customer configures ingestion, Embrasure copies the selected source tables and synchronizes them using the configured sync mode. For direct queries, we may store the metadata, semantic definitions, query plans, prompts, agent activity, and bounded result rows needed to provide the product, maintain conversation history, support audit logs, and troubleshoot customer-reported issues.

Customers control the credentials, scopes, workspace roles, governance settings, retention expectations, and connected sources they configure. Customers should not connect data sources or provide personal information unless they are authorized to do so.

Embrasure uses large language models and related AI services to generate responses, plans, summaries, workflows, and other product outputs. Input to those services can include prompts, schema metadata, query context, selected result rows, and workspace configuration necessary to complete the requested task.

• We do not train Embrasure-owned foundation models on customer data.
• We do not sell customer data or share it for cross-context behavioral advertising.
• For listed AI subprocessors, we configure commercial/API processing settings intended to prevent provider training on customer data and enable zero data retention where available.
• Customers can choose available model providers and should treat AI outputs as generated assistance that may require review before business use.

We use necessary cookies and similar technologies for authentication, session management, security, preference storage, and load balancing.

We use our own analytics to understand how the website and product are used, diagnose reliability issues, and improve onboarding and core workflows. It stores a random identifier in your browser's local storage and a session identifier in session storage.

We use PostHog to record sessions on our homepage and in the signed-in product so we can find and fix usability problems. Recordings capture page layout and interactions. Form inputs are always masked. In the product, all text, images, and data values are also masked, page addresses are reduced to the product area, and recordings are linked to the signed-in user's ID, name, and email. Recording identifiers are kept in session storage and cleared when the tab closes. To opt out, block posthog.com in your browser or contact privacy@embrasure.ai.

We do not use cookies to sell personal information or to serve third-party behavioral advertising. Browser settings may allow you to block or delete cookies, but some product features may not work without necessary cookies.

We do not sell personal information. We do not share personal information for third-party cross-context behavioral advertising.

For information received from Google APIs, the Limited Use rules take precedence over the general disclosure terms above. Transfers are limited to consented, visible product features, security needs, legal obligations, or a merger, acquisition, or asset sale with the user's explicit prior consent. Human access is limited to specific data the user affirmatively permits us to view, security investigations, legal obligations, or aggregated data for lawful internal operations.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, encryption at rest, workspace access controls, row-level security, audit logging, least-privilege production access, and vulnerability management. More detail is available on our Security page.

No method of transmission or storage is perfectly secure. Customers are responsible for managing their own accounts, user permissions, connector scopes, and source-system access controls.

Customers may request deletion or export through their workspace administrator or by contacting us. We may need to verify authority before acting on a request.

Embrasure operates primarily from the United States. If personal information is transferred from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with transfer restrictions, we use appropriate safeguards such as contractual commitments, data processing terms, and Standard Contractual Clauses where applicable.

Depending on your location and relationship with Embrasure, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. You may also have the right to withdraw consent or lodge a complaint with a data protection authority.

If your information is part of a customer workspace, we may refer your request to the customer or ask the customer to authorize the request. To exercise rights, email privacy@embrasure.ai. We will respond as required by applicable law.

Embrasure is a business-to-business service. We do not sell personal information and do not share personal information for third-party cross-context behavioral advertising. We use sensitive personal information only as needed to provide, secure, support, and improve the service, comply with law, or as otherwise permitted by applicable law.

Depending on your state, you may have rights to access, delete, correct, or receive a copy of personal information, and to appeal certain decisions. You can exercise those rights by emailing privacy@embrasure.ai.

Embrasure is not directed to children and is intended for business use. We do not knowingly collect personal information from children under 16. If you believe a child provided personal information to Embrasure, contact us and we will take appropriate steps to delete it.

We may update this policy from time to time. If changes are material, we will provide notice through the product, by email, or by other reasonable means. The “last updated” date shows when this policy was most recently revised.

Privacy requests and questions: privacy@embrasure.ai

Legal notices: legal@embrasure.ai