Last updated: September 26, 2026

Privacy Policy

This document is provided in English only. The English version is the controlling text.

1. Scope of This Policy

This Privacy Policy explains how Embedio ("we," "us," "our") collects, uses, and shares information in connection with the embedio website and Service. It applies to two categories of people: (a) customers who create an embedio account to build forms, surveys, bookings, and chat widgets ("you," when we mean a customer), and (b) the visitors and end users who interact with a customer's embedded forms, bookings, or chat widgets ("End Users").

For End-User Data, the customer who configured the embed decides what to collect and why, and is responsible for it under applicable privacy law; embedio acts as a service provider or processor on that customer's behalf. If you are an End User and have a question about data you submitted through a form, booking page, or chat widget, please contact the business that operates that website directly, as contacting embedio may delay your request.

2. Information We Collect

Account and billing information

When you create an account, we collect your name, email address, password (stored as a salted hash, never in plain text), and project details. When you subscribe to a paid plan, our payment processor collects your payment card details on our behalf; we receive limited billing metadata, such as plan, amount, and invoice history, but not your full card number.

If you create or sign in to your account using Google or GitHub instead of a password, that provider gives us your name, email address, and a unique account identifier so we can create or match your embedio account; we do not receive or store your password for that provider.

Usage and security information

We collect information about how you use the Service, including sign-in timestamps, IP address, and browser or device information for each login attempt, which we use for account security and to detect and block brute-force attacks, as well as API usage, storage and submission volume, and AI credit usage.

End-User Data

Depending on which modules a customer enables, we process the information their End Users submit: form and survey responses, newsletter sign-ups, booking details such as name, email, and selected time, uploaded files, live chat messages, and AI Chat conversations. We also automatically compute spam and abuse signals, such as submission rate and repeated content, to flag suspicious activity for the customer's review.

Support and communications

If you contact us for support, or submit a contact form on our own marketing site, we collect the information you provide in that request, including your message content.

Cookies

We use a single strictly-necessary session cookie to keep you signed in to your dashboard; it does not track you across other websites. We do not use third-party advertising or analytics cookies. If that changes, we will update this Policy.

Bot and abuse protection

Our Login, Signup, Forgot-password, and Contact forms may be protected by a third-party bot-detection service (reCAPTCHA), which runs invisibly and assigns a score indicating how likely a submission is to be automated. This service may receive your IP address, browser and device signals, and your interactions on the page, and may set its own cookie as part of that scoring. We only use the resulting score to decide whether to allow a submission, not to show you ads.

3. How We Use Information

• Provide, maintain, and secure the Service, including authenticating you and preventing unauthorized access
• Process billing and send invoices and billing notices
• Detect, investigate, and prevent spam, fraud, and abuse, including flagging suspicious form submissions and rate-limiting login attempts
• Send transactional email, such as verification, password reset, and notification emails, through our email delivery provider
• Generate AI Chat responses for a customer's End Users, as described in our AI Disclosure
• Respond to support requests and communicate with you about the Service
• Comply with legal obligations and enforce our Terms of Service and Acceptable Use Policy

4. AI Processing of Information

When a customer enables AI Chat, that End User's messages and the customer's configured knowledge base are sent to our third-party AI provider to generate a response, which we relay back to the widget and store as a conversation record visible to the customer in their dashboard. Full details, including what data is sent, how long it's kept, and how a customer can turn this off, are in our AI Disclosure, which forms part of this Policy.

5. How We Share Information

We do not sell or rent personal information. We share information only as follows:

• With subprocessors who help us operate the Service under contractual confidentiality and data protection obligations, currently including cloud hosting and database providers, a file storage provider for uploaded content, an email delivery provider for transactional email, a third-party AI provider for AI Chat, and a payment processor for billing
• With a customer, for the End-User Data submitted through that customer's own forms, bookings, uploads, and chat widgets
• At a customer's direction, with third-party services that customer connects through our Connections feature (for example, a CRM, spreadsheet, messaging app, or support tool), for the End-User Data that customer configures us to send there — each such service's own handling of that data is governed by its own privacy practices, which the customer is responsible for reviewing before connecting it
• If required by law, legal process, or to protect the rights, property, or safety of embedio, our users, or the public
• In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections

6. Data Retention

• Account information is retained while your account is active. If you deactivate your account, we retain your data for 14 days in case you wish to reactivate, after which it is permanently deleted.
• Security logs, such as login and rate-limit events, are retained for a limited period to support fraud and abuse investigations.
• End-User Data is retained according to the customer's own configuration and deletion actions, for example deleting a form or unflagging or deleting a submission; deleting a customer account deletes the associated End-User Data along with it, subject to a brief backup retention window.

7. Data Security

We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), salted password hashing, per-IP and per-account rate limiting on authentication, and role-based access controls for administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights and Choices

You can access, correct, export, or delete most of your account information directly from your dashboard Settings, including changing your name, email, and password, and deactivating your account. You may also contact us at contact@tryembedio.com to make a request.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you additional rights over the personal information we collect about you as a customer or as a visitor to our own marketing site, not as an End User of a third party's embed, which that business is responsible for.

In the preceding 12 months, we have collected the categories of personal information described in Section 2 above from customers, for the business purposes described in Section 3. We do not sell or share personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months.

Subject to certain exceptions, you have the right to:

• Know what personal information we have collected about you and how it has been used and disclosed
• Delete personal information we have collected from you
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share personal information, so no action is needed)
• Limit the use of sensitive personal information (we do not use sensitive personal information for purposes requiring this right)
• Not receive discriminatory treatment for exercising any of these rights

To exercise these rights, email contact@tryembedio.com from your account email address, or use the Support option in your dashboard, so we can verify your identity as the account holder. We will respond within the timeframes required by law. If we deny your request, you may appeal by replying to our decision, and we will respond to your appeal within the time required by law.

9. Where We Process Data

We are based in the United States and our own infrastructure runs on servers located in the United States. Some of our subprocessors, including our third-party AI provider used for AI Chat (see our AI Disclosure), may process data on servers located outside the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, and processed in, the United States and, where AI Chat is involved, potentially other countries where our AI provider operates, in each case consistent with this Policy.

10. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, individuals under 18. If you believe a child has provided us with personal information, contact us at contact@tryembedio.com and we will delete it.

11. Third-Party Links

Customer forms, booking pages, and share links may link to or be embedded in third-party websites we do not control. This Policy does not apply to those third-party sites, and we encourage you to review their privacy practices separately.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through a dashboard notification before they take effect. The "Last updated" date above reflects the most recent revision.

13. Contact Us

Questions about this Policy, or requests regarding your personal information, can be sent to contact@tryembedio.com, or through the Support option in your dashboard.