Privacy policy
Last updated: 14 November 2026
This policy explains what personal data EmberCite collects on embercite.com and when you order or use our services, why we collect it, how long we keep it and what rights you have.
In short: we set no cookies ourselves, use no Google Analytics, load no fonts or scripts from third parties and have no social media plugins. We never sell your personal data.
1. Who is responsible
Martin Freiwald, trading as EmberCite 10609 101 St NW Edmonton, AB T5H 2S2 Canada Email: hello@embercite.com
We are based in Canada. Canada has an adequacy decision of the European Commission for commercial organisations subject to PIPEDA (Decision 2002/2/EC, confirmed in the Commission’s review of 15 January 2024), and the UK recognises the same adequacy. Data you send us from the UK or the EU/EEA therefore needs no additional transfer safeguards.
Our services are aimed at businesses in the United States, Canada, the United Kingdom and Australia. We do not target the European Union. Where the GDPR or UK GDPR applies, this policy follows them.
We are not required to appoint a data protection officer.
2. Content delivery and security: Cloudflare
All requests to embercite.com first pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the website against attacks, caches files and delivers them from a server close to you.
To do this, Cloudflare processes connection data: IP address, date and time, requested URL, browser and operating system (user agent), referrer and technical security signals.
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a fast, secure website.
Processor: Cloudflare processes this data on our behalf under its Data Processing Addendum.
International transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework, including the UK Extension; its Data Processing Addendum also includes the EU Standard Contractual Clauses.
Cookies: Cloudflare does not set cookies on our website during normal use. Only if Cloudflare has to check whether a request comes from a person rather than a bot, for example during an attack, it may set a strictly necessary security cookie (cf_clearance). This cookie is needed to deliver the page you requested and does not require consent.
3. Hosting and server logs
The website runs on a virtual private server provided by Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. The data centre is located in the United States (Los Angeles). The web server is nginx.
Each request is logged with:
- IP address of the connection. Because all requests pass through Cloudflare (section 2), this is usually the address of a Cloudflare server, not your own.
- date and time of the request
- requested page or file, HTTP status code, amount of data transferred
- referrer URL, if sent by your browser
- browser and operating system (user agent)
Purpose: delivering the website, security, troubleshooting. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure and working website. Retention: log files are rotated daily and deleted automatically after 14 days, unless needed longer to investigate a specific security incident. Processor and international transfer: Spaceship processes this data on our behalf under its data processing addendum, which includes the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module 2) and the UK Addendum.
4. Fonts
All fonts are hosted on our own server. No connection is made to Google or any other font provider.
5. Website analytics with Umami
We use Umami, open-source analytics software hosted on our own server, to understand how our website is used. No data is shared with third parties.
- Umami sets no cookies and uses no local or session storage. Apart from loading the script from our own domain, nothing is stored on or read from your device.
- Your IP address is shortened before processing (IPv4 to the first three blocks, IPv6 to the first 48 bits) and is not stored. Your approximate location (country, region, city) is derived locally on our server from the shortened address, without any external lookup.
- To count visits, a hash is created from the shortened IP address, user agent, website and a random value that changes daily. Visits on different days cannot be linked.
- Collected: page visited (including campaign parameters, if any), page title, referrer, browser, operating system, device type, screen size, language, approximate location, time and clicks on buttons and links.
- Session replay and heatmaps are switched off.
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in anonymous usage statistics. No consent is required because nothing is stored on or read from your device. Retention: statistics are deleted automatically after 13 months.
6. Forms: order, free mini-check and partner enquiries
We process what you enter in our forms:
- Order form: plan (audit or monitoring), brand name, website, target market, up to five competitor names (optional), your own questions (optional), email address, billing details (optional: company name, billing address, tax or VAT number) and your confirmation that you order for your business and accept our terms.
- Free mini-check: website and email address.
- Partner form: name, agency, website, email address, number of brands and your message.
- For invoicing: if you leave the billing details empty, we ask you for them by email after your order.
Forms are processed by our own service on our own server; no third-party form provider is involved. The connection is encrypted (TLS). The service sends your submission by email to our mailbox (section 7) and keeps it on the server only until it has been delivered, normally a few seconds. If delivery fails, it is kept for at most 30 days and then deleted automatically. There is no database. Your IP address is not stored. Every submission gets an order or request number.
Purpose: answering your request, running your free mini-check, invoicing, preparing and delivering the service you ordered. Legal basis: Art. 6(1)(b) GDPR (contract or steps before entering into a contract); otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Retention: enquiries and mini-checks that do not lead to a contract are deleted after 12 months at the latest. For customers see sections 8 and 9.
Free mini-check: we use your email address only to send you the result and to reply if you write back. We do not add you to a mailing list.
Spam protection: we use a hidden field, a minimum time to fill in the form and a limit on requests per connection. For the limit, a keyed hash (HMAC) of your IP address is kept in memory only and expires after at most 10 minutes. No cookies and no third-party services (such as reCAPTCHA) are used.
7. Email
Our email addresses on embercite.com are forwarded by Cloudflare Email Routing (Cloudflare, Inc., see section 2) to our mailbox at Google Workspace (Google LLC, USA, or Google Ireland Limited, Ireland). Cloudflare states that it does not store or access the content of forwarded emails. Form submissions are sent to this mailbox through Google Workspace or Cloudflare’s email service. Google is certified under the EU-U.S. Data Privacy Framework and processes emails on our behalf under its Cloud Data Processing Addendum. We use your email and its content only to handle your request (Art. 6(1)(b) or (f) GDPR).
8. Invoices and payments
We do not use an online payment provider. After you order, we send you an invoice by email, and you pay by bank transfer. For this we process your name, company, billing address, tax number (if any), order details, amount and the payment details that your bank sends us (account holder, account number or IBAN, reference). The payment itself is handled by your bank and ours, each as an independent controller.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (legal obligations under tax and commercial law). Retention: invoices and payment records are kept as long as tax and commercial law requires, generally up to 8 years.
9. How we produce mini-checks, audits and monitoring reports
To measure AI visibility, our software sends questions to AI platforms through their APIs. The questions contain your brand name, website, industry, market and competitor names, but not the names or contact details of your staff. We use the following providers, all located in the USA:
| Provider | What it does for us |
|---|---|
| OpenAI (ChatGPT) | AI platform we measure: answers our questions |
| Google (Gemini) | AI platform we measure: answers our questions |
| Google AI Overviews, retrieved through a search results data provider | AI platform we measure: we collect the AI Overviews shown in Google search results for our questions |
| Perplexity AI | AI platform we measure: answers our questions |
| Anthropic (Claude) | Helps us evaluate the collected answers and draft the report |
We use these services through their business APIs, under terms where the providers act as our service providers and do not use our queries to train their models. Where personal data from the UK or the EU is involved, transfers rely on the provider’s Data Privacy Framework certification or on standard contractual clauses.
Brand or competitor names can be personal data if they contain a person’s name (e.g. “Dr. Smith Dental”). In that case:
Legal basis: Art. 6(1)(b) GDPR for your own brand (performance of the contract); Art. 6(1)(f) GDPR for competitor names (our and your legitimate interest in a market comparison based on publicly available information). Retention: report data (raw answers, scores and the report itself) is kept for 12 months after delivery and then deleted. For monitoring, the 12 months run from each monthly measurement. You can ask us to delete it earlier. Invoices are kept as described in section 8.
10. White-label partners
If you are an agency using our white-label service, you may give us information about your clients. You are responsible for having a legal basis for sharing it. Where we process personal data on your behalf, we act as your processor and will sign a data processing agreement on request.
11. Your rights
If the GDPR or UK GDPR applies to you, you have the right to:
- access your data (Art. 15)
- rectification (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw consent at any time with effect for the future (Art. 7(3))
- lodge a complaint with a supervisory authority (Art. 77). In the UK this is the Information Commissioner’s Office (ico.org.uk). As we have no establishment in the EU, you can contact any EU supervisory authority, in particular the one in your country.
Canada: we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). You can access and correct your personal information and withdraw consent by emailing us. You may complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca). Some of our service providers (Spaceship, Cloudflare, Google, the AI platforms in section 9) are located in the USA; your information may therefore be stored and processed there and be accessible to authorities under U.S. law.
Other countries (e.g. USA, Australia): we grant the same rights to all users, regardless of where they live. We do not sell or share personal data for targeted advertising as defined in U.S. state privacy laws (such as the California Consumer Privacy Act). We do not knowingly collect data from children under 16; our services are for businesses only.
To exercise any right, email hello@embercite.com. We will answer within one month.
12. Security
We use TLS encryption (HTTPS) for all connections, keep our server software up to date and limit access to personal data to what is necessary.
13. No automated decision-making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Audit scores describe the AI visibility of a brand, not of a person.
14. Changes
We update this policy when our website, services or the law change. The version published here applies.