Privacy policy

Last updated: September 13, 2026

This document explains which personal data is processed when you use Embra, why, for how long, who has access to it, and how to exercise your rights.

It covers the website embraapp.com, the application app.embraapp.com, and the pages published by Embra's customers at addresses of the form app.embraapp.com/a/…. These three sets do not process the same data and are not subject to the same rules: sections 5 and 6 distinguish between them.

1. Who processes your data

EMBRA, a société par actions simplifiée (French simplified joint-stock company) with a share capital of 100 euros, whose registered office is at 149 avenue du Maine, 75014 Paris, France, registered with the Paris Trade and Companies Register under number 109 096 271. Full contact details are given in the legal notice.

For any question or request about your data: data@embraapp.com

The contractual terms applicable to customers are set out in the terms of service, article 10 of which specifies the allocation of roles described below.

2. Two different roles, and it is essential to distinguish them

Embra is a tool that companies use to create interactive content and collect contacts. Depending on the data concerned, our role is not the same.

3. When we are the controller: our customers' data

3.1 The account and the company profile

When the account is created and while it is used, we process: your e-mail address, your company's name, its website, the description of your offer, your target customers and the problems you solve, your industry, your size, the desired tone, your presentation texts, your booking link, and your brand elements (logo, colours, signature, figures and references you enter).

Purpose: to provide the service, generate the content you request, and display your brand on your public pages. Legal basis: performance of the contract between us.

3.2 Use of the service and invoicing

We keep a count of your usage (generations, searches, articles, messages) to apply the limits of your plan, as well as the information needed for invoicing.

Legal basis: performance of the contract for usage, and our accounting and tax obligations for invoicing.

4. When we are the processor: data of the people our customers contact

4.1 People who fill in a form

When a person completes interactive content published by one of our customers, the information requested may include: their name, e-mail address, company, job title and phone number. The e-mail address is always requested; the other fields are enabled or not by the customer.

Depending on the content, the questionnaire answers, the score obtained and the resulting result tier are also recorded.

This information is recorded on the customer's behalf and sent to the customer: a notification is e-mailed to the customer as soon as the form is submitted, containing the details entered and, where applicable, the score.

When the customer uses the free plan, only the first three contacts are readable by the customer. The following ones are shown to the customer as a count, without the ability to read their details, until the customer subscribes to a paid plan. If the customer does not subscribe, these details are deleted 90 days after their collection.

4.2 Searching for information about a person or a company

Embra offers its customers a sales-preparation feature. From a name and a website address entered by the customer, it searches for publicly accessible online information about the company concerned and, when the customer enters a surname, about the person targeted.

The information collected comes from public web pages. It is analysed to extract elements useful for a professional contact, then attached to the contact's record in the customer's workspace.

What we do to limit this processing:

• Without a surname entered, no search about the person is performed.
• A page is retained only if it mentions both the person's name and their company.
• Any information from a page that merely cites the person, without directly concerning them, is automatically discarded.
• No search is carried out on Embra's initiative: it results solely from an express request by the customer.

5. Visitors to the website embraapp.com

This section concerns our own presentation website. Pages published by our customers follow different rules, described in section 6.

5.1 Audience measurement

We use Google Analytics to understand which pages are viewed and which are useful. This tool places cookies on your device and sends Google information about your visit: the pages viewed, the address you arrived from, technical information about your browser, and your IP address.

Three specific interactions are also recorded: clicking through to account creation, opening a format example, and clicking on a content radar signal.

5.2 Your choice, and how to change it

On your first visit, a banner asks whether you accept audience measurement. Your decision is recorded in your browser's local storage, under the key embra_consent_v1, together with its date.

You can change it at any time via the "Cookie preferences" link in the footer, on every page of the website.

Cookies strictly necessary for the operation and security of the website do not depend on this choice and cannot be disabled. Only one is placed, by our security provider Cloudflare: __cf_bm. It is used exclusively to distinguish human visitors from automated bots, and its lifetime is about thirty minutes.

5.3 Where your visit came from

When you reach the website from a campaign link, that link sometimes contains parameters indicating where it comes from — a social network, a newsletter, an advertisement. We keep them in session storage, under the key embra_utm_v1, to pass them on to the sign-up page if you create an account, and thus know which actions bring us visitors.

• These parameters are read from the page address; they are not collected from you.
• They are kept in session storage: they disappear when the tab is closed.
• They are not linked to any other information about you until you create an account.

This record is independent of the banner: it is necessary for the sign-up flow to work and is not used for any advertising measurement. No advertising tag is present on this website.

6. People who view a page published by a customer

Pages published with Embra at addresses of the form app.embraapp.com/a/… are accessible without an account and without registration. They contain neither Google Analytics, nor any third-party measurement tool, nor any advertising tag. Embra counts views and answers of each tool to show them to its customer; this count relies on no third-party cookie.

6.1 Audience measurement

To let the customer know how many people viewed its content and through which channel, a random identifier is generated and kept in the browser's session storage, under the key embra_visit. The following are recorded: this identifier, the page viewed, the source of the link when indicated in the address, and whether a final call-to-action button was clicked.

This identifier has three characteristics:

• it is entirely random and is not linked to any other information about you;
• it is stored in session storage: it disappears when the tab is closed, and therefore cannot recognize you from one visit to the next;
• it is never used on other websites nor cross-referenced with data from elsewhere.

If your browser blocks this storage, measurement still works and nothing is written to your device.

6.2 Why no banner is shown to you on these pages

Because there is nothing to ask you. These pages place no advertising cookie, no third-party tracker and no external measurement tool. The only cookie placed is Cloudflare's __cf_bm, needed to protect the service. The measurement described above is strictly limited to the content viewed, with no cross-site tracking.

6.3 Two connections to third parties you should know about

When you view a public page, your browser establishes two connections we must inform you of, because they transmit your IP address to third parties:

• Google, to load the fonts used by the page.
• The website of the company that published the page, when its logo is hosted there.

Neither of these connections transmits the content of your answers or the information you enter.

7. Who else has access to your data

We use the following service providers, solely for the needs of the service:

None of these providers is authorized to use your data on its own behalf. Your data is not used to train artificial intelligence models.

8. Transfers outside the European Union

The service's database is hosted in Ireland, within the European Union.

Some processing nevertheless involves providers established or operating outside the European Union, in particular Anthropic for content generation and analysis, Lovable for hosting, Stripe for payments, Google for audience measurement and fonts, and Linkup for searching public pages. These transfers are governed by the safeguards provided for in the General Data Protection Regulation, in particular the European Commission's standard contractual clauses.

9. How long we keep your data

10. Security

Exchanges with the service are encrypted and the website enforces a secure connection. Access to data is partitioned by organization at the database level itself, not only at the interface level. Privileged access keys are used only by server-side processing and are never exposed in the browser. The service is protected against abusive automated access by our content delivery provider.

No system is perfectly secure. In the event of a data breach likely to result in a risk to your rights, we notify the competent authority and, where the law requires it, the persons concerned.

11. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over the data concerning you.

To exercise them, write to data@embraapp.com. We respond within one month.

If your request concerns data collected by one of our customers (points 4.1 and 4.2), we forward it to that customer, who is the controller, and we assist them in responding.

You may also lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

12. Changes

This policy may evolve with the service. The date of the last update appears at the top of the document. In the event of a substantial change, we inform our customers by e-mail.