Privacy Policy

Who is responsible

Embe Labs LLC is the controller of the personal data described here. You can reach us about anything in this policy at team@embelabs.xyz.

What we collect

Information you give us or create by using an account:

• Account details: your email address, plus the name and profile picture GitHub or Google share when you sign in with them.
• Subscription records: your Stripe customer ID, plan, status and renewal dates. Card details go straight to Stripe and never reach us.
• API keys: the name you give each key, its first few characters and when it was last used. The key itself is stored only as a SHA-256 hash.
• Systems: the sets of components you save (including Bookmarks), their names and descriptions, and whether you've shared one by link or with your team.
• Teams: the team's name, who's on it and their roles, and pending invites (the email address invited and a one-way hash of the invite link). A team's owner sees each member's name, email address and profile picture; members see the owner's name.
• Usage records: which components' source your account has read, kept to enforce the daily limit of 60 components.
• Feedback: the score, message and page you send through the feedback form, and an email address if you choose to leave one while signed out.
• Messages: anything you send us by email.

Information collected automatically:

• Connection data: when an agent or tool connects to your account (device sign-in or OAuth), we keep the client's name, a short-lived code and a one-way hash of the requesting IP address so we can rate-limit requests and spot abuse.
• Server logs: our host records IP addresses, user agents, requested URLs and timestamps to run and secure the Service.
• Analytics: Vercel Web Analytics counts page views and measures load speed without cookies, and we strip query strings from what it records.
• Bot checks: the sign-in form may use Cloudflare Turnstile, which inspects your browser and connection to tell people from bots.

Browsing, searching and previewing components needs no account. We don't run advertising, and we don't buy data about you from anyone else.

Cookies and local storage

We use only what the Service needs to work. Signing in sets cookies that keep your session. Your browser's local storage remembers your light or dark theme and, while you're signed out, your saved components. Cloudflare Turnstile may set a cookie to complete its check. We don't use advertising or cross-site tracking cookies, so there is nothing to opt out of; because we don't track you across sites, we treat Global Privacy Control and Do Not Track signals as already honored.

How we use it, and our legal bases

• To create and secure your account, sign you in and let agents you connect act for you (to perform our contract with you).
• To check your subscription, unlock component source, enforce usage limits and bill you (contract, and legal obligations for tax and accounting).
• To keep the Service running, debug it, rate-limit requests and prevent fraud, scraping and abuse (our legitimate interest in a secure, working Service).
• To read and act on feedback and answer messages (our legitimate interest in improving the Service, or your consent where you give it).
• To send service emails such as sign-in links, receipts and notices of changes to these policies (contract and legal obligations). We don't send marketing email.
• To comply with the law, respond to lawful requests, and establish or defend legal claims (legal obligation and legitimate interest).

We don't sell personal data, share it for cross-context behavioral advertising, or use it to train AI models.

Google user data

If you sign in with Google, we receive only your email address, name and profile picture, and we use them only to create and identify your account. We don't use Google user data for advertising, sell it, or share it except with the service providers below as needed to run your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We share data only with providers that run parts of the Service for us, under contracts that limit their use of it, and only what each one needs:

• Supabase: authentication and the database that holds accounts, subscriptions, API keys, systems and feedback.
• Stripe: checkout, billing, tax calculation and the customer portal. Stripe also processes payment data under its own privacy policy.
• Vercel: hosting, server logs and cookieless analytics.
• Resend: delivering sign-in and account emails.
• Cloudflare: the Turnstile bot check on sign-in.
• GitHub and Google: sign-in, when you choose them.
• Anthropic: when we use our internal component generator, our prompts are sent to Claude. Your account data isn't.

We may also disclose information when the law requires it, to protect the rights, property or safety of our users, the public or us, or to a buyer or successor if the Service or our business is sold, merged or reorganized; this policy will continue to apply to data transferred that way.

International transfers

We're based in the United States, and our providers process data in the United States and other countries. Where data protection law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

How long we keep it

• Account data, API keys, systems and subscription records: for as long as you have an account.
• Source-read records: 35 days.
• Device sign-in and OAuth codes: discarded a day after they expire. OAuth client registrations that go unused for 90 days are deleted.
• Feedback: until it has served its purpose, and for no more than three years. Feedback linked to an account is unlinked when the account is deleted.
• Server logs: for the period set by our host, usually days to weeks.
• Billing records: Stripe and we keep these for as long as tax and accounting laws require, typically up to seven years.

You can delete your account at any time from your account page, or by emailing team@embelabs.xyz. Deleting it cancels any subscription and removes your API keys, systems, usage records and subscription record from our database. We may keep a limited record where the law requires it or to resolve disputes, enforce our terms or prevent abuse.

Your rights

Wherever you live, you can ask us for a copy of your personal data, to correct it, or to delete it, by emailing team@embelabs.xyz. Depending on where you live, you may also have the right to:

• Object to or restrict our processing, or withdraw consent you've given (without affecting earlier processing).
• Receive your data in a portable format.
• Opt out of the sale or sharing of personal data, or of targeted advertising. We do neither.
• Appeal a decision we make about your request, by replying to our answer.
• Complain to your data protection authority (in the EU, UK or Switzerland) or your state attorney general (in the US).

We'll respond within the time the law requires, usually 30 to 45 days, and may need to verify your identity first, normally by confirming a request from your account email. You can use an authorized agent if you give them signed permission. We won't treat you differently for exercising these rights.

Security

Data is encrypted in transit, database access is restricted by row-level security, and API keys, sign-in codes and IP addresses are stored only as one-way hashes. No system is perfectly secure, and we can't guarantee the security of data sent to or stored by us. If we learn of a breach that affects your personal data, we'll notify you and the authorities as the law requires. If you find a security problem, please report it to us privately at the address below.

Children

Assembli is for developers and designers, not children. It isn't directed at anyone under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we'll delete it.

Links to other sites

Component pages link to source projects, licenses and other sites, and the Service connects to tools you choose. Their own privacy policies govern what they do with your data.

Changes

If this policy changes, we'll update the date at the top. For material changes, we'll give account holders notice by email or on the Service before they take effect.

Contact

Embe Labs LLC: questions, requests and complaints go to team@embelabs.xyz.