Legal
Last updated: October 14, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between EmbedAuth ("EmbedAuth", the processor) and the organization using the Service (the "Customer", the controller). It applies to the personal data of the end users of each application for which the Customer has turned on GDPR mode, and it is accepted on the Customer's behalf by the owner or admin who turns GDPR mode on in the dashboard. For applications in UK GDPR mode, the UK Addendum at the end of this page applies as well. It is made under Article 28 of Regulation (EU) 2016/679 (the "GDPR"), whose definitions it uses.
Version 2026-10-14.
EmbedAuth processes end users' personal data to provide the Service to the Customer: creating and verifying accounts, signing end users in by password, emailed link, one-time code or a linked provider account, keeping their sessions, issuing the tokens the Customer's application verifies, protecting sign-in against abuse, letting end users manage and delete their own accounts, and sending the Customer the webhooks it subscribes to. Processing lasts for as long as the application exists in the Service, and ends as described in section 10.
Data subjects are the end users of the Customer's application. The personal data is:
The Service is not designed for special categories of personal data, and the Customer will not use it to process them.
EmbedAuth processes the personal data only on the Customer's documented instructions — this DPA, the Terms, and the Customer's configuration of the application in the Service — including with regard to transfers to third countries, unless EU or Member State law requires otherwise, in which case EmbedAuth informs the Customer first unless that law prohibits it. EmbedAuth informs the Customer immediately if, in its opinion, an instruction infringes data protection law.
Everyone EmbedAuth authorises to process the personal data is bound by confidentiality, by contract or by law.
EmbedAuth maintains measures appropriate to the risk, as Article 32 requires, including:
The Customer gives EmbedAuth general authorisation to engage sub-processors. These are the current ones:
| Sub-processor | Purpose |
|---|---|
| Hetzner Online GmbH Germany (EU) | Hosting: the application servers, the database holding end users' accounts, and the mail server that sends sign-in, verification and reset emails. |
| Cloudflare, Inc. United States, with a global network | Content delivery: serves the widget pages and their files, and so handles visitors' IP addresses and requests in transit. Stores no end-user accounts. |
EmbedAuth imposes on each sub-processor, by contract, data protection obligations equivalent to this DPA, and remains liable to the Customer for their performance. EmbedAuth gives the organization's owners at least 30 days' notice by email of an intended addition or replacement; the Customer may object within that period on reasonable data protection grounds, and if the objection cannot be resolved, may turn off GDPR mode or end its use of the Service.
Some services act at the Customer's or the end user's direction rather than as EmbedAuth's sub-processors: Google reCAPTCHA, which runs with the Customer's own keys when the Customer turns it on; Google and Discord, when an end user chooses to sign in with their account there; and the webhook endpoints the Customer configures.
End users' accounts are stored in the European Union. Cloudflare may handle requests to the widgets outside the European Economic Area; that processing is covered by the Standard Contractual Clauses in Cloudflare's data processing terms. EmbedAuth makes no other transfer without a safeguard required by Chapter V of the GDPR.
The Service lets the Customer answer end users' requests itself. In the account widget, when the Customer offers it, end users can see their profile and correct their name, review and end their sessions, and delete their account; and the Customer can delete any end user from its server through the user deletion API. Deletion is permanent and removes the end user from everything EmbedAuth holds about them. For access and portability requests, end users can download a copy of their data from the account widget, the Customer's server can fetch any end user's copy through the API, and the dashboard downloads every end user's at once, all in a structured, machine-readable format. For any other request, the Customer can write to [email protected], and EmbedAuth will help in time for the Customer to meet its own deadlines. EmbedAuth forwards to the Customer any request it receives directly from an end user, and does not answer it itself.
EmbedAuth notifies the Customer of a personal data breach affecting its end users without undue delay, and where feasible within 48 hours of becoming aware of it, with the information Article 33(3) of the GDPR requires as it becomes available. EmbedAuth also gives the Customer the information it reasonably needs for its data protection impact assessments and any prior consultation with a supervisory authority.
While GDPR mode is on, EmbedAuth keeps the personal data only as long as the following schedule allows, and removes the rest automatically:
| Data | Kept for |
|---|---|
| IP address, browser and details on sign-in events and on account changes | 90 days |
| Sign-in events | 365 days |
| Log of webhook deliveries about end users | 30 days |
| Accounts that never confirmed their email address, on an application that requires it, with no open session | 30 days |
| Expired sessions, sign-in links, one-time codes and password reset links | 1 day after expiry |
| Privacy complaints (UK GDPR mode), once resolved | 365 days |
When the Customer deletes the application, EmbedAuth permanently deletes its end users and their personal data at once, and removes their identifiers from the organization's audit log and webhook delivery log. Before deleting it, the Customer can download every end user's data from the application's GDPR page in the dashboard. Data that EU or Member State law requires EmbedAuth to keep is kept only for as long as that law requires.
EmbedAuth makes available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates, on reasonable notice and subject to confidentiality.
A new version of this DPA is published on this page with a new version number, and the Customer is asked to accept it in the dashboard. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
Questions about this DPA, or notices under it: [email protected].
Version 2026-10-14.
This Addendum supplements the DPA above for each application for which the Customer has turned on UK GDPR mode, and applies to the personal data of its end users that is subject to the UK GDPR. It is accepted, together with the DPA, by the owner or admin who turns UK GDPR mode on.
References in the DPA to the GDPR are to the UK GDPR and the Data Protection Act 2018, as amended (including by the Data (Use and Access) Act 2025); "supervisory authority" means the Information Commissioner's Office (ICO); and "EU or Member State law" means the law of the United Kingdom or of a part of it. Everything else in the DPA applies unchanged.
End users' accounts are stored in Germany, a transfer the United Kingdom's adequacy regulations for the European Economic Area cover. Where Cloudflare handles requests to the widgets in the United States or elsewhere, the transfer is covered by the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses in Cloudflare's data processing terms. EmbedAuth makes no other restricted transfer of UK personal data without a safeguard the UK GDPR allows.
UK law requires the Customer, as controller, to let people complain about how it uses their personal data, to acknowledge each complaint within 30 days, to look into it without undue delay and to tell the complainant the outcome. EmbedAuth runs the channel on the Customer's behalf: a complaints form for the application's end users, an acknowledgement emailed to the complainant on receipt, notice to the Customer by email and webhook, and a record of each complaint and each answer in the dashboard, from which the Customer's answers are emailed to the complainant. Looking into a complaint and deciding its outcome remain the Customer's. EmbedAuth forwards to the Customer any complaint about the application it receives by other means. A complaint is kept until a year after it is resolved, and is deleted with the end user who made it, the Customer having been sent a copy when it arrived.
Section 9 of the DPA applies, so that the Customer can notify the ICO within 72 hours where the UK GDPR requires it.
For personal data subject to the UK GDPR, where this Addendum and the DPA conflict, this Addendum prevails. A new version is published here with a new version number, and the Customer is asked to accept it in the dashboard.