Privacy Policy

1. Data Controller

Emberhop is the data controller for personal data processed in connection with the Emberhop service. For all privacy inquiries, you may contact us at:

privacy@emberhop.com

2. Data Collected

When you register for and use the Service, we collect the following categories of personal data:

• Account data: your email address and company name, provided during registration.
• Document analytics: aggregate engagement data for documents you publish — including page views, time on page, and the number of pages viewed per session. This data is associated with your organisation account, not with the individual viewers of your documents.
• Lead data: name, email address, and any other fields you configure in your lead capture form. This data is collected on your behalf when a viewer submits the form embedded in your document. You are the data controller for lead data; Emberhop processes it as your data processor.

We do not store IP addresses of document viewers. We use session cookies exclusively for authenticated users (see Section 10). We do not use tracking cookies or fingerprinting technology.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract performance (Article 6(1)(b) GDPR): processing your account data and lead data is necessary to provide the Service under our agreement with you.
• Legitimate interests (Article 6(1)(f) GDPR): we process data for security monitoring, fraud prevention, and service reliability. Our legitimate interests are not overridden by your interests or fundamental rights given the limited and non-invasive nature of this processing.
• Legal obligation (Article 6(1)(c) GDPR): we may process or retain data to the extent required by applicable law, including tax and accounting obligations.

4. How We Use Your Data

We use the data we collect exclusively for the following purposes:

• Service delivery: operating your account, storing your documents, and making your embedded document viewers available.
• Billing: processing subscription payments and maintaining billing records via our payment processor.
• Analytics dashboards: presenting document engagement metrics and lead data within your account dashboard.
• Transactional communications: sending account-related emails such as email verification, password resets, and subscription notifications.
• Security and fraud prevention: monitoring for abuse, security incidents, and Terms of Service violations.

We do not sell your data. We do not use your data for advertising or marketing purposes. We do not share your data with third parties other than the processors listed in Section 5.

5. Data Processors

We engage a limited number of EU-based sub-processors to operate the Service, covering infrastructure hosting, object storage, payment processing, and transactional email delivery. All sub-processors are established within the European Union or operate under EU-approved data processing agreements, and no personal data is transferred outside the EEA. A current list of sub-processors is available on written request to privacy@emberhop.com.

6. Data Retention

We retain your personal data for as long as your account is active and as necessary to provide the Service. Upon account deletion, we will delete your account data, documents, analytics data, and associated lead data within a reasonable period, except where retention is required by applicable law (for example, for tax or accounting purposes, in which case we retain only the minimum data required for the legally mandated period).

You may request deletion of your account at any time via your account settings or by contacting privacy@emberhop.com.

7. International Data Transfers

All personal data processed by Emberhop is stored and processed exclusively within the European Economic Area (EEA). We do not transfer personal data to countries outside the EEA. All sub-processors engaged by Emberhop are either established within the EU or operate EU-based data centres for the data they process on our behalf. No transfers are made to the United States or any other third country.

8. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Article 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): you may request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): you may request deletion of your personal data, subject to any legal retention obligations.
• Right to data portability (Article 20): you may request a machine-readable export of the personal data you have provided to us.
• Right to restriction of processing (Article 18): you may request that we restrict processing of your personal data in certain circumstances.
• Right to object (Article 21): you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@emberhop.com. We will respond within 30 days. If you believe we have not adequately addressed your request, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Data Processing Agreement

For customers on paid plans who process personal data of their own customers through the lead capture functionality, Emberhop acts as a data processor on your behalf. A Data Processing Agreement (DPA) — compliant with Article 28 GDPR — is available on request for all paid plan customers. To request a DPA, contact privacy@emberhop.com.

10. Cookies

We use session cookies solely to maintain the authenticated state of logged-in users within the Emberhop dashboard application. These cookies are set only after you log in and are cleared when you log out or close your browser session.

We do not use tracking cookies, advertising cookies, or any persistent identifiers on our marketing website or within embedded document viewers. Our document analytics are cookieless — engagement data is collected at the aggregate level without setting any cookie in the viewer's browser. As a result, no cookie consent banner is required on sites that embed Emberhop document viewers.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will notify you by email at least 30 days before the updated policy takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. The date at the top of this page indicates when the policy was last revised.

12. Governing Law

This Privacy Policy is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation) and the laws of the Netherlands. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the competent courts of Amsterdam, the Netherlands.

13. Contact

For all privacy questions, requests to exercise your rights, or to request a Data Processing Agreement, please contact:

Emberhop

privacy@emberhop.com