Privacy and data

Who can you contact?

embrlla is operated by Printmaker ApS. Send questions about personal information, access or deletion to comboworks@gmail.com. Please identify your workspace and the relevant website, but do not send passwords or API keys.

Information in embrlla

When you scan a website, we process its entered address, publicly available text, metadata, images and technical measurements. Scan results and reports may be saved so you can continue your work later.

If you use a workspace, we process the account and membership information that gives you access, together with the materials you add: brand information, images, text, keyword plans, drafts and scheduled activities. We use this information to provide the features you choose and protect access to the workspace.

When you connect Google

Google connections are optional. You choose whether to continue to Google sign-in and approve access. embrlla receives access tokens from Google; we do not receive your Google password. Features are available only when the required configuration and permissions are in place.

• Google Search Console: We use read access to find websites you can access and retrieve search queries, pages, clicks, impressions, click-through rates and average positions for the selected website. These data support visibility reports, history and planning in your workspace.
• Google Analytics: We use read-only access to list GA4 properties you can access and read aggregate visitor totals, daily visitor trends, country and city reports for the property and website you select. These reports provide your workspace’s visitor overview and history. This connection does not edit Analytics settings, install tracking tags or read individual visitor identities.
• Google Ads: We read the selected account’s customer ID, name, currency and account type, along with keyword suggestions, search volumes and historical bid estimates for your chosen keyword and market. We use these for research and keyword plans. Google displays a broad Ads permission, but this connection does not create or change campaigns or buy advertising.

Google data and derived results support the features you choose in embrlla. They are not sold or used to target advertising at you. Our use and transfer of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements.

Storage and access

Accounts, connections and saved results are stored in embrlla’s database and file storage at Supabase. The public app is hosted at Vercel. Google access tokens are encrypted before storage. Access to workspace data is checked on the server by account, organization and role.

Google Ads results are reused for up to 24 hours before new results are retrieved. Saved reports and keyword plans have their own lifetime and are not automatically deleted when this cache expires. Saved workspace data remain available until removed or the workspace is closed; contact us about deletion and any remaining retention in operational logs or backups.

How we protect sensitive Google data

Google connection credentials and the private reports associated with your workspace are treated as sensitive information. The production app and its Google API connections use HTTPS to protect data in transit.

Google access and refresh tokens are encrypted on our server with AES-256-GCM authenticated encryption before they are stored. The encryption key is kept in the server environment, separately from the stored connection records. Analytics and Ads token encryption is also bound to the relevant organization and site or Ads account. Tokens and client secrets are used on the server; they are not included in browser reports or published content.

Server-side authorization checks restrict private workspace information and Google connection actions to the signed-in account, its organization membership and the required role. OAuth requests use a short-lived, checked state value to bind the callback to the request; Analytics and Ads also use PKCE. These controls help prevent another account from completing or using your connection.

Analytics reports contain aggregate visitor counts and location summaries, rather than individual visitor identities. We request Google access only for the integration you choose. You can disconnect a saved connection or revoke access through Google; the deletion and retention limits are explained below. Please contact us if you suspect unauthorized access to your workspace.

AI and other providers

When you choose an AI feature, your instructions and the relevant website, text or image materials may be sent to the configured provider, such as OpenAI or Google Gemini, to produce the result. If you generate text from a keyword in Research, the selected keyword and website context are sent to the text provider. Ads access tokens and account details are not included in that text request.

Google provides the Google features you choose. Other connected media and publishing tools receive the materials needed for the selected action. Providers may process information outside your country. Contact us for details of the providers and agreements that apply to your workspace.

Cookies and operational information

Sign-in and connections use cookies for sessions and security. Server and hosting providers process technical operational information to deliver and protect the service. If product analytics are enabled, PostHog records page views and events, such as a completed scan. Analytics may include the scanned address and result identifiers.

Remove access or request deletion

You can remove the Google Analytics or Google Ads connection in embrlla’s connection settings. This removes the saved access tokens from the active connection. It does not automatically delete earlier reports or plans. You can also revoke embrlla’s overall Google access in your Google account’s connections; this may affect Analytics, Ads and Search Console.

Contact comboworks@gmail.com to request access, correction, export or deletion of personal information or saved Google data. We may ask you to confirm which workspace and data your request concerns to protect other users’ information. You can complain about the processing of personal information to the Danish Data Protection Agency.

When you connect Facebook or Instagram

Meta connections are optional. You sign in with Meta and choose the business assets you authorize; embrlla does not receive your Facebook or Instagram password. We receive access tokens, granted permissions, Page identifiers and names, available Page tasks and the identifier of any linked professional Instagram account. We use these to show the accounts available to you, attach the accounts you select to your project and check which publishing actions your access permits. Tokens are encrypted before storage and accessed on the server.

When you approve a publication and delivery is enabled, the selected image, caption or link and the target account identifier are sent to Meta. We retain delivery status and the publication identifier Meta returns. Connecting an account alone does not publish anything. A separate Meta Ads connection, if used, reads selected advertising-account details and performance data; it does not purchase advertising.

Meta data deletion instructions

In your project’s connection settings, choose Facebook & Instagram and remove the saved connection. This clears the active connection’s stored credential and disables its use in embrlla; it does not delete posts already published on Meta or earlier saved workspace content. You can also review or revoke Signal Hub/embrlla’s access in your Facebook Business Integrations settings.

To request deletion of Meta-related data retained by embrlla, email comboworks@gmail.com with the subject “Meta data deletion” and identify the workspace, project website and relevant Facebook Page or Instagram account. Do not send passwords or tokens. We will verify your authority for the workspace, identify the requested data and respond about deletion and any remaining retention in logs or backups. Disconnecting a single project is separate from deleting all your workspace data.