Privacy Policy

A. Emra as processor of Customer Data

A workspace is a hosted environment in which members and bots work together. It belongs to the organization or person that holds its subscription (the "Customer"). The content in a workspace, including chats, files, bot memory, routines, and data bots retrieve from connected accounts, is "Customer Data." We process Customer Data on the Customer's behalf and under its instructions, as a processor (or "service provider" under U.S. state law). The Customer is the controller of that data and decides who can use the workspace and what goes into it. Our Terms of Service and our Data Processing Addendum ("DPA") govern that processing.

If you are a member of a workspace that an organization holds, that organization's privacy practices govern your Customer Data, and you should direct requests about it to the workspace's admin. If you contact us instead, we will refer you to the Customer and help them respond.

If you sign up on your own, you are the Customer for your workspace, and we process your Customer Data in the same way. Where the law treats us as the controller of that content because you use the Services in a purely personal capacity, we use it only as this policy allows for Customer Data, and every commitment in this policy about Customer Data, including that we do not use it to train AI models, applies to it.

B. Emra as controller

Emra Tech, Inc. is the controller of the personal data we need to run our business, including account and sign-in information, billing records, usage and security records, website data, and communications with our sales and support teams.

A. Information you give us

• Account information: your email address, display name, password (stored only in hashed form), and your role in each workspace.
• Payment information: our payment processor collects your card and billing details. We do not store full card numbers. We keep your plan, subscription status, references from our payment processor, and payment history.
• Communications: what you send when you contact support or sales, answer a survey, or give feedback, along with related details such as the page you contacted us from.
• Preferences: your interface settings and email preferences.

You must provide an email address to create an account. Other information is optional, but some features will not work without it.

B. Customer Data

To provide a workspace, we store and process the content that members and bots put into it, including:

• Chats with bots, including your messages, the bots' replies, the tools they used, and images and documents you attach.
• Files bots create or download, bot memory, routines and schedules, messages bots send each other, and Bot Crossing game state.
• What bots read from, and send through, the accounts you connect (Section 3).
• Web pages bots read, code they run, and anything else they produce.

Our Acceptable Use Policy lists the kinds of data that may not be put into the Services without a signed agreement with us, such as protected health information and payment card data.

C. Information collected automatically

• Usage records: for each bot turn, the time, workspace, bot, chat, the member it worked for, the model, token counts, and cost.
• Audit log: security-relevant events such as sign-ins, invitations, role and permission changes, chat sharing and deletion, bot actions, and plan changes, including who acted, when, the outcome, and for some events the IP address. Workspace admins can view and export their workspace's audit log.
• Device and log data: IP address and the approximate location it indicates, browser and device type, time zone, the requests our servers receive, and error and crash reports.
• Cookies and analytics: see Section 6.

D. Information from third parties

• Identity providers: if you sign in with Google or your organization's single sign-on, we receive your name, email address, and an account identifier, according to that provider's settings.
• Your organization: if an admin invites you, we receive your email address and role from them.
• Our payment processor: payment status and billing details.
• Connected accounts: data from services you connect (Section 3).

We do not collect your precise location or biometric data.

Google user data

Emra's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Depending on the Google services you connect, bots can read and change your calendar events, read and edit Google Docs and Sheets, create and manage files in Drive, and send email from your Gmail address and manage its labels, in each case within the access shown on Google's consent screen. We also receive the email address of the Google account you connect.

We use Google user data only to provide the features you ask your bots for. We transfer it only to our sub-processors, including the AI model provider that generates the response you request, under terms that prohibit any other use, including training models; to the services and recipients you direct a bot to send it to; and as needed for security or to comply with law. Our sub-processors are on our sub-processor list. We do not use Google user data for advertising, we do not sell it, and we do not use or retain it to develop, improve, or train generalized or non-personalized AI or machine learning models. Our personnel do not read it unless you give permission for specific content, it is necessary for security purposes such as investigating abuse, or it is necessary to comply with law. This rule applies in place of the general access rule in Section 8.

Google user data a bot retrieves is stored in the workspace as Customer Data and is kept and deleted as Section 7 describes. You can ask us to delete it at privacy@emra.ai. To remove Emra's permission at Google as well, use the third-party access settings in your Google Account.

Stripe accounts

You connect a Stripe account by installing the Emra app from Stripe. Before you approve the installation, Stripe shows each permission the app requests. Stripe then issues access tokens for that account, which we store and refresh as described above. This connection is separate from Stripe's role as our own payment processor (Section 5.B): we do not use data from a Stripe account you connect for our billing, and we do not add our billing data to your account.

Within the permissions you approve, bots can read the following in your Stripe account and, when you ask for a specific change, create or change them: customers; products and prices; subscriptions; invoices and invoice items; payments, charges, and refunds; credit notes; saved payment methods and card setups; and Checkout Sessions. For saved payment methods, Stripe gives us only details such as the card brand, the last four digits, and the expiry date, never full card numbers. We also receive your Stripe account's email address and business name, so the Services can show which account you connected.

Your Stripe account holds personal data about your own customers, such as their names, email and postal addresses, and payment history. When a bot retrieves it, it becomes Customer Data that we process on your behalf as described in Section 1.A, and you are responsible for having a lawful basis to share it with us and for giving your customers any notice the law requires. We use data from your Stripe account only to provide the features you ask your bots for. We transfer it only to our sub-processors, including the AI model provider that generates the response you request, under terms that prohibit any other use, including training models; to the services and recipients you direct a bot to send it to; and as needed for security or to comply with law. We do not use it for advertising, and we do not sell it.

Data a bot retrieves from your Stripe account is kept and deleted as Section 7 describes. To end the connection, disconnect Stripe in Emra, which deletes the tokens we hold. To remove Emra's access at Stripe as well, uninstall the Emra app from your Stripe Dashboard, under Settings, then Installed apps.

Social networks

When you connect a social network account, the network's consent screen shows the access Emra requests. Within that access, and when you ask, bots can publish, schedule, edit, and delete posts, photos, and videos as you; reply to, hide, and delete comments; read your posts, profile, followers, and the messages and mentions the network makes available; and read the analytics it provides for your account and posts. We also receive your account's name or handle, so the Services can show which account you connected. Where you connect a Facebook Page, we also receive the access the network issues for that Page.

Content a bot posts is published under your account and is subject to the network's own terms and privacy policy. Data a bot retrieves, including posts and comments by other people, becomes Customer Data that we process on your behalf as described in Section 1.A. We use it only to provide the features you ask your bots for, transfer it only as described for Google user data above, do not use it for advertising, and do not sell it. It is kept and deleted as Section 7 describes. To end a connection, disconnect it in Emra, which deletes the tokens we hold; you can also remove Emra's access in the network's own settings for connected apps.

YouTube

Emra uses YouTube API Services. By connecting YouTube, you agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy. YouTube data is Google user data, so everything this section says about Google user data applies to it. Within the access you approve, bots can upload and edit videos, thumbnails, and playlists, read and moderate comments, and read your channel's analytics. You can remove Emra's access at any time from the Google security settings page.

AI models and your content

Bots work by sending the relevant parts of a chat, including your messages, attached files, tool results, and bot memory, to an AI model provider on our sub-processor list, which returns the bot's response. We also use a model to give each new chat a title.

We do not use Customer Data to train AI models, and our model providers may not use it to train theirs. They may keep it for a limited period, as their terms describe, to detect abuse and comply with law.

If a member connects their own model subscription to a bot, that member's agreement with the model provider governs that traffic. In that case the model provider is not our sub-processor for that traffic, and our commitment that model providers do not train on Customer Data does not cover it.

De-identified data

We may create aggregated or de-identified information from usage records and account data, not from the content of chats, files, or connected accounts, and use it to operate, improve, and report on the Services. We keep it in de-identified form and do not attempt to re-identify it.

Automated decisions

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.

A. Sub-processors

Sub-processors process Customer Data on our behalf to provide the Services, such as cloud hosting and AI model providers. Our current list is on our Sub-processors page, and we notify Customers of changes as described there and in our DPA.

B. Service providers

We use service providers to help us run our business, including payment processing (Stripe), website hosting and analytics (Vercel), and providers of email, communication, document, software development, network, banking, and security and compliance services. They handle personal data we control, such as account, billing, website, support, and sales information. Stripe also uses payment data under its own privacy policy.

C. Advertising partners

With your consent, an advertising pixel on our public website sends our advertising partner, Meta, identifiers and information about your activity on our website, such as the pages you visit and whether you created an Emra account, so we can measure our ads. Our partner may also use this information to measure and target ads under its own privacy policy. For visitors in the European Economic Area and the United Kingdom, we and our partner are joint controllers of the collection and transmission of this data. The pixel does not run inside workspaces and does not receive Customer Data.

If you accept and then create an Emra account, our servers also tell our partner about your sign-up and your first paid plan, with your email address in hashed form, so we can measure the same ads. We keep a record of your choice with your account.

D. Within your workspace

• A chat is visible to the member who started it and the people they share it with, and a chat shared with the team is visible to every member. Admins cannot open a chat that has not been shared with them.
• A bot keeps one memory and one set of files across all of its chats. Anyone who can use that bot can ask it about what it has stored, including information it saved while working for another member or retrieved through another member's connected account. Bots in a workspace can also message each other, so a bot may pass along information when you ask it to work with another bot.
• Files in a workspace's shared areas can be read by the other bots and members in that workspace.
• Workspace admins can see the member list, usage, and the audit log, and can manage bots.

E. At your direction

When you connect an account, or a bot sends email, posts a message, visits a website, or calls an API for you, data moves between your workspace and that service at your direction, and its recipients see it as they would anything you send yourself. Services you connect are governed by your own agreements with them and are not our sub-processors.

F. Other disclosures

• Legal requirements: when we believe in good faith that disclosure is required by law, court order, or a valid government request. For Customer Data, we direct the requester to the Customer where we can, notify the affected Customer before disclosing unless the law prohibits it, and disclose only what the request legally requires.
• Safety and rights: to investigate fraud or abuse, enforce our agreements, or protect the rights, property, and safety of our users, the public, or Emra.
• Professional advisers: our auditors, lawyers, accountants, and other advisers, under confidentiality obligations.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy's commitments.
• With your consent: in any other case where you direct us to or agree.

A. Essential

We use cookies and browser storage that the Services need to work, such as those that keep you signed in, secure sign-in, and remember your preferences. Our payment processor sets its own cookies at checkout to process payments and prevent fraud. These cannot be turned off in our settings.

B. Analytics

Vercel Web Analytics measures traffic to our website in aggregate. It does not set cookies or track you across other websites.

C. Advertising

With your consent, we use advertising cookies on our public website to measure our advertising (Section 5.C). When they are on, our advertising partner may collect information about your activity on our website and combine it with your activity on other sites.

D. Your choices

We ask before setting advertising cookies, and you can change your choice at any time through the "Your Privacy Choices" link in our website footer. We treat a Global Privacy Control signal from your browser as a refusal of advertising cookies and as a request to opt out of sale and sharing. You can also block cookies in your browser, but you will not be able to sign in without the essential ones. Because there is no common standard for browser "Do Not Track" signals, we do not respond to them.

A. Choices for everyone

• Update your name and preferences in your account settings.
• Turn off optional email with the unsubscribe link in any optional email. We will still send service email about your account and billing.
• Manage cookies through the "Your Privacy Choices" link in our website footer or your browser settings (Section 6.D).
• Disconnect any connected account, which deletes the tokens we hold.
• Ask us for a copy of your data, or to correct or delete it.

B. European Economic Area, United Kingdom, and Switzerland

You have the right to access, correct, delete, restrict, and receive a portable copy of your personal data; to object to processing based on legitimate interests and to direct marketing; to withdraw consent at any time without affecting earlier processing; and to lodge a complaint with your data protection authority. We respond within one month, which we may extend by two further months where the law allows.

C. United States state privacy rights

Depending on where you live, you may have the right to know what personal information we collect, use, and disclose; to access, correct, and delete it; to receive it in a portable format; to obtain a list of the specific third parties we have disclosed it to; to opt out of its sale, sharing for cross-context behavioral advertising, targeted advertising, and profiling; and not to be discriminated against for exercising these rights.

In the last 12 months we have collected the categories of personal information below, for the purposes in Section 4, and disclosed them for those purposes to the recipients shown. We keep each category for the period Section 7 gives for the kind of record it appears in.

We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16. If you accept advertising cookies, we share identifiers and internet activity with our advertising partner for cross-context behavioral advertising, which some state laws also treat as a sale. To opt out, use the "Your Privacy Choices" link in our website footer or decline advertising cookies when asked. A Global Privacy Control signal opts you out automatically. We do not sell covered information as Nevada law defines it.

We use and disclose sensitive personal information only for the purposes California law permits without offering a right to limit, such as providing the Services you request and keeping them secure. We do not offer financial incentives for personal information.

California residents may also request information about disclosures of personal information to third parties for their own direct marketing purposes. We do not make such disclosures.

D. How to exercise your rights

Write to privacy@emra.ai from the email address on your account. If you do not have an account, tell us how you have interacted with us. We will confirm your request and may ask for information to verify your identity before acting. Requests to opt out do not require verification. You may use an authorized agent if you give them written permission and verify your identity with us.

We respond to requests under U.S. state laws within 45 days, which we may extend once by a further 45 days where the law allows. If we decline your request, we will explain why, and you may appeal by replying to our decision. We respond to appeals within the period your state's law sets. If we deny your appeal, you may contact your state Attorney General. For Customer Data in a workspace an organization holds, contact that workspace's admin (Section 1.A).