Privacy policy

Last updated: 9 October 2026

This policy explains how The Smithy ("we") handles personal information in Ember.

Two kinds of data

• Your account data. When you sign up and use Ember, we collect your name, email address, password (stored only as a secure hash), workspace details, and how you use the service. For this data, we are the controller.
• Your customers' data. The contacts, leads, notes, emails and form submissions you put into Ember belong to your business. We process them only to provide Ember to you, under our data processing agreement. For this data, you are the controller and we are your processor (under GDPR) or service provider (under CCPA). If someone asks us about data a business holds about them, we pass the request to that business.

What we use your account data for

• To run Ember: signing you in, keeping your workspace working, and sending service emails (confirmations, password resets, invitations, new-lead alerts).
• To keep Ember secure: preventing abuse, investigating problems, and keeping an audit log.
• To improve Ember, using aggregated information about how features are used.

We don't sell personal information, and we don't use your customers' data to train AI models.

Cookies

Ember uses only the cookies needed to keep you signed in. Ember's embedded forms on your website set no cookies and don't track visitors.

Who we share data with

Our subprocessors, listed on the Security page: hosting, database, and email delivery providers. Each is bound by a data processing agreement. We share information with authorities only when the law requires it.

Where data is stored

In the United States. For transfers from the EU, UK or Switzerland, we rely on the Standard Contractual Clauses and the UK addendum.

How long we keep it

Account data: while your account is open. Workspace data: until you delete it or the workspace. Backups: up to 30 days. Operational logs: up to 30 days; the audit log, up to a year.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict our use of it, and complain to your data protection authority. Contact us at privacy@thesmithy.io.

Changes

We'll tell you by email or in Ember before material changes take effect.