Privacy Policy

1. Who We Are

EMBER ("we," "us," "our," or the "Service") is operated by EMBER GEMWORKS CO. LIMITED, a company registered in Hong Kong SAR. This policy explains what information we collect, how we use it, who we share it with, and the choices available to you. It applies to visitors, guest users, and registered account holders on our website and in our iOS app. Contact for privacy questions: support@emberjewelry.ai.

2. Information We Collect

Account information— if you create an account, the email address and password you provide; email confirmation is required before an account is active. If you sign in with Apple or Google instead, we receive the email address and account identifier that service shares with us — with Sign in with Apple this can be a private relay address if you choose "Hide My Email" — and we never receive your Apple or Google password. For Sign in with Apple we also keep a token Apple issues to us, used only to disconnect EMBER from your Apple ID when you delete your account.

Guest / anonymous use — you can use core features (uploading photos, generating preview images) without an account. We create an anonymous session tied to a random identifier, with no email attached, so the Service can track your uploads, credits, and generated images during your session. If you later create an account, this activity carries forward.

Content you upload — the jewelry photographs, CAD renders, factory renders, and sketches you upload, stored as you provide them. We do not currently strip embedded metadata (EXIF data) from uploaded photos — if your device embeds GPS location or camera details in a photo file, that metadata is stored along with the image. If this is a concern, you may wish to strip it yourself before uploading. We also collect any product details you optionally enter (style, metal type/color, stone type/shape/carat, dimensions), the AI-generated images produced from your uploads, any creative-direction text and optional reference images you add, your brand style settings, the generation options you choose, and any feedback or issue reports you submit.

Camera and photos (iOS app) — the app uses your camera or photo library only when you choose to take or pick a photo, and only the photos you select are uploaded. When you export an image, the app can save it to your photo library at your request.

Billing information— if you subscribe on our website, billing details are collected and processed directly by our payment processor, Stripe. If you subscribe in our iOS app, the purchase is made through Apple's App Store and processed by Apple; we use RevenueCat to confirm your purchase and receive your subscription status, plan, and billing dates. We never receive or store your card number.

Approximate region — we read a connection-derived, approximate location (not a precise address or full IP address) to determine whether certain AI-generation features can be offered in your region, since our upstream AI provider limits where those features are available. We do not log or store your IP address in connection with your account or usage, and we do not use tracking cookies or advertising cookies (see Section 6).

3. How We Use Your Information

To operate the Service — process your uploads, generate AI images, and let you manage your projects; to maintain your account, guest session, and generation credits; to process subscription payments; to respond to feedback and support requests; and to maintain the security, integrity, and reliability of the Service, including basic rate-limiting to prevent abuse; and to understand aggregate usage of our website and app so we can improve them. We do not sell your personal information, and we do not use your uploaded photos or generated images to train our own AI models or develop competing products.

4. Who We Share It With

We share information with the following service providers, strictly as needed to operate the Service:

• Third-party AI services — OpenAI (image generation and analysis of your photos, reference images, directions, and product details), fal.ai (locating and cutting out the jewelry in your photos), and Replicate (locating the jewelry in your photos). They receive the photos and text needed to create your images, not your name or email address.
• Supabase — authentication, database, and file storage.
• Vercel — hosting, and Vercel Web Analytics for aggregate usage (see Section 6).
• Inngest — background job processing.
• Sentry— error monitoring (session replay is disabled, and it isn't configured to receive personal data beyond what's incidentally present in error reports).
• Stripe — billing for subscriptions bought on our website.
• Apple and RevenueCat — App Store purchases in our iOS app, and Sign in with Apple.
• Google — Sign in with Google.

These providers only receive what's needed to perform their function. Content sent for AI processing is governed by each AI provider's API terms, and we send it only to create the images you request. In our iOS app we ask for your permission before your photos are first sent for AI processing. We don't sell your personal information, and we don't share it with third parties for their own marketing purposes. We may also disclose information if required by law, to protect the rights or safety of our users or the public, or in connection with a merger, acquisition, or sale of assets.

5. How Long We Keep Your Information

AI-generated images are automatically deleted 30 days after they're created. Photos you upload without an account are deleted 30 days after upload, and inactive guest sessions are deleted with their content. If you have an account, the photos of a piece are kept while you keep working on it and are deleted 365 days after you last worked on that piece. Creative-direction reference images, brand settings, and your account information are kept until you delete your account.

You can request account deletion at any time from your account settings (in the iOS app: Account > Account Settings). Deletion has a 14-day grace period during which you can cancel the request; after that your account, photos, generated images, reference images, and brand settings are permanently deleted, and if you used Sign in with Apple we ask Apple to disconnect EMBER from your Apple ID. Anonymized records of past credit/usage activity, with your account identifier removed, may be retained for accounting and abuse-prevention purposes and can no longer be linked back to you. Purchase and subscription records held by Apple, Stripe, and RevenueCat are kept by them under their own policies and legal obligations. Deleting your account doesn't cancel an App Store subscription — cancel it in your Apple ID subscription settings.

6. Cookies

The Service uses a single essential cookie to keep you signed in (or maintain your guest session) — required for the Service to function, and not used for advertising, analytics, or cross-site tracking. We use Vercel Web Analytics to understand aggregate usage; it doesn't use cookies or any persistent identifier, cannot be used to reconstruct an individual's browsing activity, and isn't used for advertising. We don't currently use advertising or marketing cookies; if that changes, we'll update this Policy and, where required, request your consent first.

7. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights: access to a copy of the personal information we hold about you; correction of inaccurate information; deletion of your account and associated content; portability of your data in a portable format; objection to or restriction of certain processing; and withdrawal of consent where we rely on it. To exercise any of these, contact us at support@emberjewelry.ai. Requests for a full copy of your account data are currently handled manually rather than through an automated export tool.

EEA, UK, and Switzerland (GDPR)— if you're located there, we process your personal information on the bases of contract performance, our legitimate interests in operating and securing the Service, and your consent where applicable. You have the rights above, plus the right to lodge a complaint with your local data protection authority. Where your information is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

California (CCPA/CPRA) — California residents have the right to know what personal information we collect, use, and disclose; to request deletion; to correct inaccurate information; and to non-discrimination for exercising these rights. We do not sell or share your personal information as defined under California law.

8. Children's Privacy

The Service is intended for use by adults aged 18 and older. We do not knowingly collect information from anyone under 18. You may not upload, and the Service may not be used to generate, images depicting jewelry worn by a minor — see our Terms of Service. If you believe a minor has provided us with personal information, contact us and we'll delete it.

9. Security

We use industry-standard measures to protect your information, including encrypted storage, access controls that restrict your content to your own account, and private (non-public) file storage. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

10. International Data Transfers

Because our infrastructure and service providers operate in multiple countries, your information may be processed outside the country you're located in.

11. Marketing Communications

We don't currently send marketing or promotional email. Emails you receive from us (account confirmation, password reset, billing receipts, and similar account-related messages) are transactional. If we introduce marketing communications, we'll only do so with your opt-in consent and a clear way to unsubscribe.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll update the date above and, where appropriate, notify you directly.

13. Contact

Questions about this policy, or a request about your data? Reach us at support@emberjewelry.ai.