Emberu
DocsDownloadPricing

Privacy Policy

Last updated: November 5, 2026

Data Controller

Emberu is the data controller for personal data processed through the website and app. Its legal identity and business details are in the Imprint.

Privacy inquiries and data subject requests go to [email protected], the controller's contact address for this notice. No data protection officer has been appointed.

Purchases are made from Polar as merchant of record, so your invoice and the checkout page carry Polar's billing details for the payment itself. Polar handles payment, invoicing, tax, and fraud-prevention data as an independent controller under its own terms.

As data controller, Emberu determines the purposes and means of processing your personal data in accordance with the EU General Data Protection Regulation (GDPR, Articles 13 and 14) and Romanian data protection law (Law 190/2018). The supervisory authority is ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal) at dataprotection.ro.

Data We Collect

Emberu collects and processes the following categories of personal data depending on how you use the product and website:

  • Account and licensing data: email address, display name where you or your sign-in provider supply one, a password hash if you sign in with a password (never the password itself), your product-news preference, the time and version of the Terms you accepted, subscription status, credit balance, and payment identifiers. Payment card details are collected and processed by Polar, our merchant of record, not by Emberu.
  • Sign-in with Google or Apple: when you choose either, the provider sends Emberu your verified email address, your name where it shares one, and its unique identifier for you. Emberu stores those three items to link your account and keeps nothing else from the sign-in. Emberu never receives your Google or Apple password.
  • Order records: for each order, Emberu stores evidence of your consent at checkout (acceptance of the Terms, your request for immediate performance and your acknowledgement, the consent version, and the time), so it can show what you agreed to.
  • Device data: a device identifier and device name that the app registers when you sign in, used to enforce the number of devices your plan allows.
  • Usage data: credit consumption, feature usage, session information, and error reports.
  • AI feature data: the audio, transcript, subtitle text, still frames, or prompt content needed to complete an AI request you start, including Furnace with Cast or Scripts. The routes Emberu uses and what happens to that content are described in AI Processing and Third-Party Providers.
  • Technical data: app version, operating system, session state, request metadata, and error information needed for licensing, support, security, and service reliability.
  • Support and feedback: the name, email address, and message you send through the support form or the app.
  • Website data: IP address, browser type, device information, pages visited, referrer, and interaction events collected through website analytics when you consent to non-essential cookies.
  • Connected social accounts: only if you connect TikTok, Meta, or YouTube to publish exports. The sign-in is brokered through Emberu's servers for a few minutes; the access tokens are then stored on your computer, not on Emberu's servers.

Where the data comes from (GDPR Articles 13 and 14). Most data comes from you directly, when you create an account, use the app, or write to support. Sign-in identity data comes from Google or Apple at your request. Billing and order metadata (customer email, plan, subscription and payment status, order and invoice identifiers, tax status, renewal and cancellation information) comes from Polar. Technical data comes from the app on your computer.

Whether You Must Provide Data, and Automated Decisions

Your email address and payment details are needed to create an account and to subscribe; without them Emberu cannot provide the contract. Audio, transcripts, and prompts are sent for AI processing only when you start a feature that needs them, and not sending them only means that feature is unavailable. Analytics and affiliate cookies are optional, and refusing them has no effect on the service.

Emberu makes no decision about you that has legal or similarly significant effects solely by automated means, and does not profile you for such decisions (GDPR Article 22). Emberu does apply automated technical controls, such as rate limits on sign-in and account requests per IP address, plan device limits, and credit limits; Polar applies its own fraud checks to payments. These controls can block a request, a sign-in, a free trial, or a checkout attempt. If one does and you think it is wrong, email support to have a person review it, to give your view, and to contest the outcome.

How We Use Your Data and Legal Basis

Under GDPR Article 6, we process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): processing account data, sign-in, license validation, usage balance management, delivering the subscribed service, and providing support.
  • Legitimate interest (Art. 6(1)(f)): improving Emberu, analyzing usage patterns, preventing fraud and abuse, ensuring service security, keeping evidence of orders and consents, receiving the diagnostic reports described below, and sending essential service notices such as outages, maintenance, security alerts, and material changes to the service you use.
  • Consent (Art. 6(1)(a)): placing non-essential cookies on our website, sending marketing communications where applicable, and processing data beyond what is strictly necessary for the contract.
  • Legal obligation (Art. 6(1)(c)): complying with applicable tax, accounting, and regulatory requirements.

Where we rely on legitimate interest, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us at [email protected].

Emails. We send essential service and account notices (for example, scheduled maintenance, security, billing, a purchase confirmation, or material changes to your plan) on the basis of contract or legitimate interest; these do not require marketing consent. We send product news, feature updates, and offers only to accounts that opt in, with an unsubscribe link in every such message and a product-news preference you can change on your Account page. You can withdraw that consent at any time, and our opt-in is never pre-ticked or required to create an account.

We will not use your data for a new purpose that needs your consent without asking you for that consent first.

What Stays on Your Device

Subtitle editing, track layout, file exports, and DaVinci Resolve integration run entirely on your local machine. When you work with local files, those operations are not transmitted to Emberu’s servers.

  • Local subtitle editing stays inside the desktop app.
  • Subtitle exports are created and saved locally.
  • DaVinci Resolve integration uses the local Resolve API.
  • License tokens are stored locally on your device to restore your session.

Data on Your Computer

The desktop app keeps working files in its app-data folder on your computer: caches of caption plans and business plans, and the music mixes it caches for exports. They exist to save time and are not sent to Emberu.

  • Delete the caches in the app with Settings > Account > Privacy > Clear local cache.
  • The Windows uninstaller offers an opt-in to delete those caches when you remove Emberu.
  • Saved session audio and your Projects stay on your computer until you delete them yourself; clearing the cache and uninstalling do not remove them.

What Emberu Stores on Its Servers

Emberu's servers keep the following, and delete it on the schedule shown:

  • Account data (profile, subscription state, credit balance and ledger, devices, preferences, Terms acceptance time and version): while the account exists, and deleted when you delete the account.
  • AI results: the transcript, or the Refine or Cast answer, of a paid AI request is kept for 24 hours so a repeated request is answered safely, and is purged daily after that.
  • Queued job payloads (prompts and inline images): expire after 24 hours.
  • Crash reports: kept for 12 months.
  • Feedback you send: kept for 24 months.
  • Administrative audit log (actions staff take on accounts): kept for 24 months.
  • Order consent records (Terms acceptance, immediate-performance request and acknowledgement, consent version, and time, stored per order): kept as long as needed to evidence the purchase and to meet accounting and tax obligations.
  • Audio you submit for transcription: checked for format, duration, and decodability, and not kept by Emberu.

Diagnostic Reports

When Emberu fails, it sends a diagnostic report to Emberu's servers automatically so the defect can be found and fixed. This processing relies on our legitimate interest in keeping the service reliable and secure (GDPR Article 6(1)(f)); you can object to it at any time by turning off Automatic diagnostic reports in Settings > Account > Privacy. The Report button stays available for a report you choose to send yourself.

A report contains the error, the app version, the operating system, and bounded excerpts of Emberu's recent logs from the last two app launches. Before a log line is written or sent, Emberu removes file paths and file names, email addresses, access tokens and URL query strings. A report never contains your footage, audio, subtitles, scripts or transcript text, and it is not used for advertising or sold.

Reports are kept for support and defect analysis for 12 months and then deleted automatically; you can ask for earlier deletion through the contact address in this policy.

AI Processing and Third-Party Providers

Emberu sends the audio, transcript, subtitle text, still frames, or prompts needed for the AI feature you start to remote speech-processing or language-model providers. Customer requests through Emberu's AI routing service require Zero Data Retention, so the selected endpoints do not retain submitted content after processing. Emberu does not keep uploaded transcription audio; where a transcription provider temporarily stores an upload and transcript, Emberu requests deletion after processing. AI results are kept for 24 hours and purged daily after that; queued prompts and images expire after 24 hours. Contact [email protected] for details of the providers that process your data.

Payment Processing Through Polar

Payments, checkout, invoicing, tax collection, and subscription management are handled by Polar as Emberu’s merchant of record. When you purchase Emberu, Polar may collect billing contact details, payment method details, billing address, VAT or tax information, IP address, fraud-prevention signals, order details, and invoice data.

Emberu does not receive or store full payment card numbers. Emberu receives limited billing metadata from Polar, such as your customer email, product or plan, subscription status, payment status, invoice or order identifiers, tax status, and renewal or cancellation information needed to provide the service. After each purchase Emberu emails you a confirmation of your plan, price, renewal terms, and immediate-performance acknowledgement.

Licensing, Downloads, and Updates

Emberu uses license and session data to activate the app, restore access on launch, authorize downloads, and check for updates.

Your account credentials and refresh token are stored locally on your device. Access tokens are kept in memory for the active session.

  • An active license may be required for downloads and update checks.
  • Update checks do not consume credits.
  • Operational request data is used for authentication, billing, rate limiting, abuse prevention, and service reliability.

Cookies and Website Analytics

The Emberu website uses cookies and similar technologies. When optional analytics is configured, a consent banner asks for your choice. Visitors in Europe who arrive through an affiliate partner link are asked before any affiliate referral cookie is placed. Elsewhere, affiliate referral cookies are placed when you arrive through a partner link, and you can switch them off at any time.

Strictly necessary cookies are used for core website functionality and do not require consent. All analytics cookies, and marketing cookies for visitors in Europe, require your prior opt-in consent before being placed on your device, in accordance with the EU ePrivacy Directive (2002/58/EC) as transposed by Romanian Law 506/2004.

  • Strictly necessary — Emberu: Sign-in session, checkout and account security, and remembering the choice you make here. (Auth.js session cookies, the OAuth provider cookie, and ember_cookie_consent.) Duration: Session, or up to 180 days for this consent choice. No consent required.
  • Analytics — Google Analytics 4 (only when configured): Measuring site traffic and the conversion funnel (page views, CTA clicks, scroll depth). (_ga and _ga_* cookies.) Duration: Up to 24 months on your device, as configured in the platform. Requires consent.
  • Marketing and referrals — Affonso (affiliate partner platform): Attributing a visit to the partner or coupon that referred it so the partner is credited, and pre-filling that discount at checkout. (affonso_referral (Affonso), ember_aff_ref (Emberu).) Duration: 30 days. Requires consent in Europe; elsewhere it is placed when you arrive through a partner link, until you switch it off.

Analytics data may include IP addresses, browser information, device data, pages visited, and interaction events. When Google Analytics is configured, it operates under Google’s data processing terms.

Two different periods apply to analytics. The cookie lifetime in the list above is how long the identifier stays on your device (up to 24 months). The event data collected with it is kept in Google Analytics for no more than 14 months and then deleted automatically. Withdrawing consent deletes the cookies right away; data already collected is deleted when its 14 months end.

When optional tracking is active, you can change or withdraw your choice at any time through Manage cookie choices on this page, which reopens the same banner. Withdrawing a category deletes the cookies it had already placed and reloads the page so any tracker that had started stops running. Your browser settings can block or delete cookies independently of that control.

If Emberu adds additional non-essential cookies, this section and the consent banner will identify the provider, purpose, category, and duration before those cookies are placed.

Who Receives Your Data

Emberu shares personal data with the categories of recipients below only as needed for the service, or when the feature or choice involved applies. For the current list of recipients, the data involved and their locations, email [email protected]. See also Subprocessors.

  • Hosting, infrastructure, content delivery and security providers process account information, service data and request metadata to operate and protect Emberu.
  • Speech-processing and AI providers process the audio, text, prompts or images needed for the AI feature you start.
  • Email providers deliver account, service and support messages, and product news when you have opted in.
  • Payment and billing providers process purchase and payment details. Polar acts as merchant of record and an independent controller for payment data.
  • Sign-in, social publishing, analytics, affiliate and file-hosting providers receive data when you use the relevant feature or make the relevant choice, as described in this policy.

Business customers can request a data processing agreement by emailing [email protected].

International Data Transfers

Your personal data is transferred to and processed in countries outside the EU/EEA in the following circumstances:

  • Hosting and infrastructure providers process account and service data in the United States.
  • AI processing: speech-processing and language-model providers process the content of the AI requests you start, in the United States and in other countries where the provider operates.
  • Payment processing: Polar processes payment-related data internationally as required for billing and tax compliance.
  • Email, sign-in, content delivery, analytics, and affiliate providers may process data in the United States and elsewhere, when you use the relevant feature or make the relevant choice.

Every transfer to a recipient outside the EU/EEA that has no adequacy decision relies on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), or the EU-US Data Privacy Framework where the recipient is certified under it. You can ask for a copy of the safeguards at [email protected].

Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy. The windows for what Emberu's servers store are listed in What Emberu Stores on Its Servers; the rest follows these rules:

  • Account, usage, and credit data: kept while the account exists. When you delete your account from the Account page, Emberu first cancels your subscription at Polar and then deletes the account data.
  • After account deletion: crash reports and feedback keep their technical content with your email address and name removed; creator-referral order records (used for affiliate payouts and tax) keep amounts, tax details, and Polar identifiers with your email address removed; order consent records stay as long as needed to evidence the purchase and meet accounting and tax obligations.
  • Billing and invoices: held by Polar as merchant of record for as long as tax and accounting law requires.
  • Website analytics data: no more than 14 months in Google Analytics (see Cookies and Website Analytics for the separate cookie lifetime).
  • Support correspondence: retained for up to 24 months after the last interaction.

When retention periods expire, data is securely deleted or anonymized. Legal obligations (such as tax records) may require longer retention of certain data categories.

Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

  • Right of access (Art. 15): request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17): request deletion of your personal data where there is no compelling reason for continued processing. You can also delete your account yourself on the Account page.
  • Right to restrict processing (Art. 18): request that we limit how we use your data in certain circumstances.
  • Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21(1)): object to processing we base on legitimate interests.
  • Rights in relation to automated decisions (Art. 22): ask for human review of an automated control, as described above.
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint: file a complaint with the Romanian data protection authority (ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal) at dataprotection.ro, or with the supervisory authority of your EU member state of residence.

Right to object to direct marketing (Art. 21(2)): you have the right to object at any time, free of charge, to our processing of your personal data for direct marketing purposes. This right is separate from any other objection you may raise, and raising it stops direct-marketing processing immediately. Object by emailing us or by using an unsubscribe link in any marketing message you receive.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR. We may need to verify your identity before processing your request.

Complaints and Data Breaches

Complaints. If you are unhappy with how we handle your data, email [email protected]. We answer in writing within 30 days. You may also complain to ANSPDCP or to the supervisory authority of your EU member state at any time; you do not have to contact us first.

Breaches. If a personal data breach occurs, we notify ANSPDCP within 72 hours of becoming aware of it where the law requires notification, and we notify the affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Children’s Data

Emberu is not directed at children. You must be at least 18 years old (or the age of legal majority in your jurisdiction) to use Emberu.

In Romania, the GDPR consent threshold for children is 16 years of age (Article 8 GDPR, as implemented by Romanian Law 190/2018). Under the U.S. Children’s Online Privacy Protection Act (COPPA), the threshold is 13 years.

If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, contact us at [email protected].

Security Measures

Emberu implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

  • Data in transit is encrypted using TLS/HTTPS.
  • License tokens and session credentials are stored securely on your device.
  • Access to backend systems is restricted and monitored.
  • We regularly review and update our security practices.

No method of electronic transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Changes to This Privacy Policy

Emberu may update this privacy policy as the product, legal requirements, or data practices change. We notify account holders by email at least 30 days before a material change takes effect; other changes are published on this page with a new date.

If we want to use your data for a new purpose that is based on your consent, we ask for your consent again; continued use of Emberu is never treated as consent. The current version is always available at emberu.app/privacy.

Questions about privacy or your data?

Email [email protected] if you need help.