Privacy policy

Who is responsible

Embedy, SIA is the controller of the personal data described here, which means we decide why it is collected and what happens to it. We are established in Latvia, so our lead supervisory authority is the Latvian Data State Inspectorate.

Registered name

Embedy, SIA

Registration number

40203614227

VAT number

LV40203614227

Registered address

Mēness iela 21 k-1 - 14, Rīga, LV-1013, Latvia

Email

ed@embedy.ai

Website

embedy.ai

We are not required to appoint a Data Protection Officer under Article 37 and have not appointed one. There is no committee behind that email address. Anything in this policy raised there reaches a person who can act on it.

What we collect, and when

There are exactly two ways personal data reaches us through this site. You fill in the enquiry form, or your visit is counted by our analytics after you have agreed to it. We do not buy lists, we run no advertising, we operate no retargeting and we do not track you across other websites.

The enquiry form asks for the following. Three of them are required because we cannot answer you without them, and the rest are there because they make the first reply useful instead of a list of questions back.

• Your full name and your email address. Both required.
• Your company name. Required. Your company website, which is not.
• Your phone number and its country code, if you want to give one.
• Which service you are asking about, and a rough budget band, if you want to pick them.
• Whatever you write in the message box.

The message box is free text and we cannot control what goes into it, so: please do not put special category data in it. That means anything about health, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, sex life or sexual orientation, which Article 9 treats differently and which we have no reason to hold. Please also keep other people's personal data out of it, and anything genuinely confidential. If you need to tell us something sensitive, say that you do and we will agree a better channel than a web form.

The form carries one hidden field that no person can see, reach, tab to or hear. It is a spam trap. A submission that arrives with it filled in was filled in by a script: it is discarded, nothing is stored and nothing is forwarded.

Analytics. If, and only if, you accept analytics cookies, Google Analytics 4 records the visit: which pages were read, roughly which country and city you are in, which site or search sent you, and general device, browser and language information. The next section sets out each identifier and how long it lasts.

Technical records. Our host keeps short-lived server logs containing IP addresses, as every web server does, and our form provider does the same. These exist to keep the site standing and to stop abuse. They are not used to build a picture of you and we do not go looking in them. One exception worth naming: if forwarding your enquiry to our inbox fails, the enquiry is written to that log so it is not simply lost, and it is deleted when the log rotates.

Cookies, and what is stored on your device

Two things, and that is the whole list. One record of the choice you made about analytics, and Google Analytics itself if you allowed it. There is no advertising, no retargeting, no conversion pixel, no social network button, no session recording and no fingerprinting. Nothing here follows you to another website, because none of it is capable of it.

A cookie is a small file a website asks your browser to keep and hand back on your next visit. Local storage does much the same thing, stays on your device, and is covered by the same rules, which care about whether something is stored on or read from your device rather than what it is called.

The Latvian Law on Information Society Services, which implements Article 5(3) of the ePrivacy Directive, lets us store what is strictly necessary to provide what you actually asked for, and requires your consent before anything else. The Data State Inspectorate's guidance of March 2022 is explicit that analytics is in the second group, so we ask, and we ask before anything loads rather than after.

embedy_consent. Strictly necessary, stored without asking.

Records whether you accepted or declined analytics, and when. Kept for 12 months, after which we ask again. It lives in your browser's local storage rather than in a cookie, which means it is never attached to a request and never reaches our server: the page reads it locally to decide whether to load anything else. No consent is needed for it under Article 5(3), and a banner that needed consent to remember your consent would be an absurd object.

_ga. Google Analytics, only if you accept.

Tells one browser apart from another, so somebody coming back twice is not counted as two people. Expires after 13 months, which is our setting; Google's default is two years and we shortened it.

_ga_ followed by our property id. Google Analytics, only if you accept.

Holds the state of your current session, so one visit across several pages is one visit. The same 13 months.

Neither Google identifier is set until you press Accept. Before that the tag is not on the page at all: no script is fetched, no request reaches Google and your IP address is not disclosed to them. This is the part most implementations get wrong, and it matters, because loading the script is itself a disclosure to a third country. We also run Google Consent Mode v2 with every storage type defaulted to denied, so even the tag's own signalling waits for you rather than going out in a cookieless form.

How the property is configured, since the settings matter more than the product name: IP addresses are truncated before storage and never written to disk in full. Google Signals is off. Advertising features and remarketing are off. Data sharing with other Google products is off. Retention is 14 months. What we get out of it is how many people came, which pages they read and which site or search sent them, and we make no attempt to identify an individual visitor.

Changing your mind

There is a round cookie button in the bottom left corner of every page, including this one. Press it and the privacy settings panel comes back, showing what you actually chose rather than a fresh default. It is there whichever way you answered, and whether you answered at all.

Closing the panel with the X counts as declining, and the button says so when you hover it. We would rather read a dismissal as a no than leave the question hanging and ask again on the next page, and reading it as a yes would not be defensible at all.

Declining takes effect immediately rather than on the next page load: the tag stops running and any _ga identifiers already set are deleted from your browser there and then. Nothing else about the site changes, because nothing about the site depends on being measured. Withdrawing does not make the measurement taken before it unlawful.

We do not use a cookie wall. Declining costs you nothing and the site is identical either way, which is what the Data State Inspectorate's guidance requires and, more to the point, is the only honest way to ask. Accepting and declining are the same size, the same weight and one press each, for the same reason.

Your browser can do it too. Every current browser can block or delete cookies and site data for one site or for all of them, usually under Settings and then Privacy, and most can be told to clear everything when they close. Tracking protection or a content blocker will stop our analytics whether or not you ever answer the panel, and we are not going to try to work around it. Clearing site data also clears the record of your choice, so you will be asked again next time, which is the system working rather than failing.

If we ever add something that stores or reads anything else on your device, this section is updated before it goes live and your earlier consent does not carry over to it: we ask again, for the new thing, by name.

Why we are allowed to use it

Every use below has a lawful basis under Article 6, and the basis matters to you because it decides which rights you have. The ones that run on legitimate interest can be objected to; the one that runs on consent can be withdrawn.

Answering your enquiry and preparing a proposal

Article 6(1)(b), steps taken at your own request before entering into a contract. Where an enquiry turns out not to be about a contract at all, Article 6(1)(f): we have a legitimate interest in replying to somebody who deliberately asked us a question, and replying to them cannot sensibly be said to override their own interests.

Running a project once you have engaged us

Article 6(1)(b), performance of the contract between us. Where that project involves personal data of your own customers or staff, we are a processor rather than a controller and a separate agreement governs it. See the section on client work below.

Invoices and accounting records

Article 6(1)(c), a legal obligation. Latvian accounting and tax law requires source documents to be kept, and we cannot delete an invoice on request.

Analytics

Article 6(1)(a), your consent, given through the banner and withdrawable in one click at any time.

Keeping the site up, and defending it from abuse

Article 6(1)(f). Our legitimate interest in a site that works and a form that is not a spam relay.

Bringing or defending a legal claim

Article 6(1)(f), if it ever comes to that. It has not.

We do not send marketing you did not ask for. Filling in the enquiry form puts you on no list. If we ever want to send you something that is not a reply to your own message, we will ask you first, separately, and you will be able to say no without it affecting anything else.

What we do not do with it, including the AI part

We build AI systems for a living, so it is worth being blunt about this rather than leaving you to wonder.

• What you send through the form is read by a person.
• It is not used as training data for any model, by us or by anybody we use. No part of this site feeds a model.
• There is no automated decision making within the meaning of Article 22 and no profiling. Whether we reply, and what we say, is a human judgement made by a human.
• We do not sell personal data, and we do not share it with anyone for their own purposes. The only companies that touch it are the ones listed below, acting on our instructions.

Client work is a different thing and is not covered by this policy. Where we build or run a system for a client and personal data goes into it, that data is the client's: they are the controller, we are the processor, and we act only on their written instructions under an agreement meeting Article 28 that is signed before anything reaches us. If you are trying to find out why a company you deal with holds data about you, that company is who to ask, not us.

The question links at the end of our FAQ open ChatGPT or Claude in a new tab with a question already typed into them. Following one takes you to somebody else's service, under their own privacy policy and their own terms. We do not see what you type there, we receive nothing back from it, and we have no account relationship with you in it.

Who else handles it

The list is deliberately short, and we checked where each one physically keeps things before we chose it. Every company here is a processor under a written contract meeting Article 28, may act only on our instructions, and may not use your data for anything of its own.

Trampoline Software SRL, trading as Formspark. Belgium.

Receives the enquiry form and forwards it to our inbox. Submissions are stored in Ireland and Germany. Nothing it holds leaves the European Economic Area.

Vercel, Inc. United States, with the processing pinned to Stockholm.

Hosts the site. The code that validates your submission and hands it to Formspark runs in Vercel's Stockholm region, so the form itself is processed inside the EEA. Vercel is a US company and is certified under the EU-US Data Privacy Framework; we hold its Data Processing Addendum, which incorporates the Standard Contractual Clauses.

Google Ireland Limited.

Provides Google Analytics 4, and only ever after you have consented to it. Advertising features, Google Signals and data sharing with other Google products are switched off, so the measurement data is not used to build advertising profiles.

Google Workspace, provided by Google Ireland Limited.

Holds the enquiry from the moment it is delivered to our inbox, and every exchange that follows from it. Access is limited to the people who need it and protected by two factor authentication. Google is an American company and the section below on transfers covers what that means.

If we ever add or change one of these, this list changes with it before the change goes live.

Sending data outside the EEA

The route your enquiry takes stays inside the European Economic Area until it reaches our inbox. It is received by a Belgian company, stored in Ireland and Germany, and the code that validates it and passes it on runs in Sweden. The fonts on this site are served from our own domain rather than from Google's, so simply loading a page sends your IP address to nobody but our host.

Our inbox is the exception, and it is worth being plain about it. We run Google Workspace, so once an enquiry is delivered it sits with Google. Two of our providers are therefore American companies whose systems may in principle be reachable from the United States: Vercel, which hosts the site, and Google, which holds our email and, if you allow it, provides analytics. In both cases the company we contract with is the European one where there is one (Google Ireland Limited), and in both cases the transfer rests on two things at once.

First, the EU-US Data Privacy Framework, which the European Commission decided in July 2023 provides an adequate level of protection, making those transfers lawful under Article 45. Second, and deliberately, the European Commission's Standard Contractual Clauses on top of it: the adequacy decision was upheld by the General Court in September 2025 and is under appeal to the Court of Justice, and if it were ever struck down the clauses would carry the transfer on their own under Article 46. You can ask us for a copy of either.

If you would rather nothing of yours sat with an American company at all, decline analytics cookies and tell us when you write, and we will agree a channel that suits you. We would rather have the conversation than have you not get in touch.

How long we keep it

An enquiry that does not turn into work

24 months from your last message to us, then deleted. People do come back a year later referring to an earlier conversation and we would rather still have it. After two years it is just old data about somebody who went elsewhere.

An enquiry that turns into work

For as long as the engagement runs, and then 5 years, which is how long Latvian law requires the accounting records behind it to be kept.

Invoices and accounting records

5 years from the end of the relevant financial year, as the Accounting Law requires. We cannot shorten this one on request.

Analytics

14 months, set on the Google Analytics property itself rather than left at the default. After that only aggregate reports survive, and those are not personal data.

Server logs at our host

Around 30 days, then overwritten. If our forwarding ever fails, the enquiry itself is written to that log rather than being lost, so that we can still answer you. It is deleted with the rest of the log.

Records at Formspark

Server logs 7 days. IP address and location data 12 months. Email delivery records 24 months. A submission we delete is recoverable for 30 days and is then gone for good.

If you ask us to delete something sooner, we will, unless we are legally required to keep it. If part of it has to stay for tax reasons we will tell you which part and why, rather than refusing the whole request.

Your rights

These are yours under the GDPR, they are free, and using one of them is not held against you in any way.

Authority

Datu valsts inspekcija (Data State Inspectorate)

Address

Elijas iela 17, Rīga, LV-1050, Latvia

Email

pasts@dvi.gov.lv

Phone

+371 67 22 31 31

Website

www.dvi.gov.lv

• See what we hold about you, and get a copy of it. Article 15.
• Have anything inaccurate corrected, or anything incomplete completed. Article 16.
• Have it deleted. Article 17. We will, unless we are obliged to keep a specific document.
• Have us stop using it while a disagreement about it is resolved. Article 18.
• Get it in a machine readable file, or have us send it to somebody else. Article 20.
• Object to any use that runs on legitimate interest. Article 21. Say so and we stop, unless we can demonstrate compelling grounds that override your interests, which for an enquiry form we almost certainly cannot.
• Withdraw consent to analytics whenever you like. Article 7(3). It is one press of the round cookie button in the bottom left corner of any page, it takes effect at once, and it does not make the measurement taken before it unlawful.

To use any of them, write to ed@embedy.ai. We answer within one month, as Article 12(3) requires, and tell you if a complex request needs longer. We may ask you for something that confirms you are who you say you are, and we will not ask for more than is needed to establish that.

If we get it wrong, or you simply are not satisfied with how we handled it, you can complain to a supervisory authority. Ours is the Latvian one, and you may also go to the authority in the EU country where you live or work, or where you think the problem happened.

If you are not in the EU

We are a Latvian company and this policy is written to the GDPR, which is the strictest regime we deal with. We apply it to everybody, wherever you are, rather than keeping a thinner standard for people whose own law permits one. Every right listed above is yours whether or not the country you are in grants it.

Where to complain, if it comes to that, depends on where you are:

United Kingdom

The UK GDPR gives you the same rights in nearly the same words. The Information Commissioner's Office at ico.org.uk takes complaints, and transfers to the United States rest on the UK extension to the Data Privacy Framework alongside the UK Addendum to the Standard Contractual Clauses.

Switzerland

The revised Federal Act on Data Protection applies and the Federal Data Protection and Information Commissioner at edoeb.admin.ch is your authority.

Canada

PIPEDA covers commercial activity of this kind, and the Office of the Privacy Commissioner of Canada at priv.gc.ca takes complaints.

California

The CCPA, as amended by the CPRA, gives residents the right to know, to delete, to correct, and not to be treated worse for asking. We are near certainly not a business within its thresholds, which turn on revenue and volume we are nowhere near, but those rights cost nothing to honour and we honour them anyway. We do not sell or share personal information as that Act defines those words, we have never done so, and we have no plans to.

If you are somewhere not on this list, write to us anyway. The answer will be the same, because there is only one way we handle this and it is the one described above.

Keeping it safe

The site is served over HTTPS throughout. The form is validated on our own server before anything is forwarded anywhere, so a malformed or automated submission never reaches a third party. Access to the inbox is limited to the people who need it and protected by two factor authentication. Our providers are chosen partly on where they store things and what they will put in writing about it.

Nobody can honestly promise perfect security. If a breach ever occurred that put your rights and freedoms at real risk, we would notify the Data State Inspectorate within 72 hours as Article 33 requires, and notify you directly where Article 34 requires it. We would tell you what happened rather than the shortest sentence we could get away with.

Children

This site sells professional services to businesses. It is not directed at children, and we do not knowingly collect personal data from anybody under 16. If you believe a child has sent us something through the form, write to us and it will be deleted.

Changes to this policy

When this policy changes, the date at the top changes with it, and the version on this page is always the one in force. If a change affects something you have already given us, we will do more than quietly update the page: we will tell you where you can see it.

Getting in touch

Anything at all about this policy, or about data we hold, goes to ed@embedy.ai. A letter to Mēness iela 21 k-1 - 14, Rīga, LV-1013, Latvia reaches us too, and gets the same answer a little slower.