Privacy Policy

1. Who We Are

Emberly ("Emberly," "we," "us," or "our") operates the Emberly platform, available at emberly.app and through our mobile applications. We are committed to protecting your personal information and being transparent about how we use it.

For privacy-related inquiries, contact us at privacy@emberly.app.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Name, email address, username, and password when you create an account
• Profile information: Profile photo, bio, location (city/region), and preferences you choose to add
• Reviews and tasting notes: Written content, ratings, and descriptions you submit for cigars and spirits
• Collection data: Cigars and spirits you add to your digital humidor, quantities, storage locations, purchase prices, and aging notes
• Pairing data: Cigar and spirit pairings you create, rate, or save
• Community content: Posts, comments, messages, and other content shared in the social feed, Lounge, or direct messages
• Account signups: Email and account credentials when you create an account on emberly.app

2.2 Photographs and Images

When you use the AI cigar scanner or upload images to the Platform, we collect:

• Photographs you capture using the in-app scanner
• Images you upload to reviews, pairing posts, or your profile
• Image metadata (such as file format and size, but not GPS location data from image EXIF unless you explicitly enable location features)

See Section 4 for full details on how photographs are used, including for AI training purposes.

2.3 Information Collected Automatically

• Usage data: Features you use, pages you view, searches you perform, and how you interact with the Platform
• Device information: Device type, operating system, browser type, device identifiers, and screen resolution
• Log data: IP address, access times, referring URLs, and error logs
• Cookies and similar technologies: Session tokens, preference cookies, and analytics identifiers (see Section 8)

2.4 Location Information

If you use the Shop Discovery feature, we request access to your device's location (GPS) to show nearby cigar lounges and spirit shops. Location access is optional and only used when you actively use this feature. You can revoke location permissions at any time through your device settings.

3. How We Use Your Information

We use the information we collect to:

• Provide the Platform: Operate, maintain, and deliver all features of Emberly
• Personalization: Tailor pairing recommendations, catalog suggestions, and community content to your preferences and collection
• Communications: Send account-related emails, product updates, product announcements, and (with your consent) marketing communications
• Community features: Enable social interaction, reviews, and the Lounge
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Analytics: Understand how users interact with the Platform to improve features and fix bugs
• AI improvement: Use aggregated, anonymized data — including image data — to train and improve our AI models (see Section 4)
• Legal compliance: Comply with applicable laws and enforce our Terms of Service

4. Photographs & AI Training Data

This section describes our specific practices around photographs and AI development, which are core to Emberly's cigar identification technology.

4.1 How Photos Are Used

When you submit a photograph through Emberly — via the AI scanner, a review, a pairing post, or your profile — that image may be used for the following purposes:

• Immediate identification: Your photo is processed in real time to identify the cigar brand, blend, wrapper, and vitola
• Community display: Photos attached to reviews or posts are displayed to other Emberly users as part of the community experience
• Catalog enrichment: Submitted images may be used to supplement our cigar catalog with visual references
• AI model training: Images are aggregated into anonymized training datasets used to improve the accuracy of our AI identification engine

4.2 Aggregation & Anonymization

Images used specifically for AI training are processed as part of large aggregated datasets. Individual user attribution is removed from images before they enter our training pipeline. We do not identify or tag training images with your name, email, or account information. The purpose of this aggregation is to build a more accurate AI model that benefits all Emberly users.

4.3 Your Choices

If you do not wish your submitted photographs to be used as AI training data, you should not use the AI scanner feature or upload images to the Platform. All other Platform features (digital humidor, reviews without photos, community access, pairing, etc.) remain available without submitting photographs.

You may submit a deletion request to privacy@emberly.app to request removal of your images from our systems where technically feasible. Note that images already incorporated into anonymized AI training datasets may not be individually extractable or removable.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Public Platform Content

Information you choose to make public — including your username, profile, reviews, pairings, collection size, and photos attached to public posts — is visible to other Emberly users. Direct messages and private collection details are not publicly visible.

5.2 Service Providers

We share information with trusted service providers who help us operate the Platform, including:

• Supabase: Database hosting, authentication, and file storage for the Emberly application (account data, collections, reviews, photos, and community content). Account signups on emberly.app are stored in Supabase.
• Google Analytics: Aggregated, anonymized usage analytics for the Emberly website (page views, referring sources, click-through events). We do not share personally identifying information with Google.

All service providers are contractually required to protect your information and may only use it as directed by Emberly.

5.3 Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Emberly, our users, or the public.

5.4 Business Transfers

If Emberly is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform before your information becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

If you delete your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law or where data has already been incorporated into anonymized AI training datasets as described in Section 4.

Accounts are retained until you delete your account or request deletion.

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal and operational requirements)
• Portability: Request your data in a portable format
• Objection: Object to certain processing activities, including direct marketing
• Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time

To exercise any of these rights, contact privacy@emberly.app. We will respond within 30 days. We may need to verify your identity before processing requests.

Email Communications

You may opt out of marketing emails at any time by clicking "unsubscribe" in any email we send, or by contacting us at privacy@emberly.app. Transactional emails (account verification, password reset, security alerts) cannot be opted out of while your account remains active.

8. Cookies & Tracking

We use cookies and similar technologies to:

• Session management: Keep you logged in and maintain your preferences
• Analytics: Understand how users navigate the Platform (using anonymized or aggregated data)
• Security: Detect and prevent fraudulent activity

We do not use third-party advertising cookies or sell your data to advertising networks. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

9. Children's Privacy

Emberly is intended for users who are 21 years of age or older. We do not knowingly collect personal information from anyone under 21. If we become aware that a user is under 21, we will promptly delete their account and associated information. If you believe a minor has provided us with personal information, please contact privacy@emberly.app.

10. Data Security

We implement industry-standard security measures to protect your information, including encryption of data in transit (TLS/SSL), encryption of sensitive data at rest, access controls limiting employee access to personal data, and regular security assessments. However, no security system is impenetrable. We cannot guarantee the absolute security of your information, and we encourage you to use a strong, unique password for your Emberly account.

11. International Data Transfers

Emberly operates primarily in the United States. If you access the Platform from outside the US, your information may be transferred to and processed in the United States, where privacy laws may differ from your jurisdiction. By using the Platform, you consent to this transfer.

12. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and share, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your California rights, contact privacy@emberly.app.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal bases for processing include performance of a contract (providing the Platform), legitimate interests (improving our AI, security), and consent (marketing emails, optional features). To exercise your GDPR rights or lodge a complaint with your local supervisory authority, contact privacy@emberly.app.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email and/or by posting a prominent notice on the Platform with the effective date. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal information:

Emberly Privacy Team
Email: privacy@emberly.app
Website: emberly.app