Privacy Policy — EmbedAuth

This Privacy Policy explains how EmbedAuth ("EmbedAuth", "we", "us") handles personal data when you visit embedauth.com (the "Site") or use our embeddable authentication service (the "Service"), and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

EmbedAuth is operated by Emilian Gheonea, in Romania, who is the controller of the personal data described here. For anything about this policy or your data, write to [email protected]. We have not appointed a Data Protection Officer, as the GDPR does not require one for processing of this kind.

2. What we process, why, and for how long

For each purpose: the data we use, the lawful basis under Article 6 of the GDPR, and how long we keep it.

Your account

Data: Name, email address, password (stored only as a hash), avatar, the organizations you belong to and your role in each.
Lawful basis: Contract — we need it to provide the Service to you.
Kept: Until you delete your account. Deletion is immediate and permanent.

Signing in and keeping accounts secure

Data: Your sessions, with the IP address and browser each started from; a log of security-relevant actions in your organization; short-lived counters that limit repeated attempts.
Lawful basis: Contract, and our legitimate interest in protecting accounts from misuse.
Kept: Sessions: 30 days after they end. Counters: a day after their window. The action log: as long as the organization exists — it is the organization's security record — but your name, IP address and details are removed from it when you delete your account.

Stopping automated abuse

Data: When you submit the sign-up or sign-in form: your IP address and browser details, assessed by Google reCAPTCHA.
Lawful basis: Our legitimate interest in keeping bots out of the Service.
Kept: We keep only the result of the check, and only for that request. Google's own retention is set out in its privacy policy.

Emails about your account

Data: Your email address and name, for verification, password resets, team invitations and notices about the Service.
Lawful basis: Contract.
Kept: Reset links and invitations not accepted: 30 days after they expire.

Billing

Data: Your organization's name and plan, and the customer and subscription references of our billing provider. Card details go straight to Stripe and never reach us.
Lawful basis: Contract, and our legal obligation to keep accounting records.
Kept: For as long as you subscribe, then as long as accounting and tax law requires.

Answering you

Data: What you write to us and your email address.
Lawful basis: Our legitimate interest in answering questions and keeping a record of what we agreed.
Kept: As long as needed to resolve your request and keep that record.

Running the website

Data: Web server logs: IP address, browser, the page requested (without its query string) and the time.
Lawful basis: Our legitimate interest in operating and securing the site.
Kept: Up to 7 days.

Newsletter

Data: Your email address, if you subscribe.
Lawful basis: Consent.
Kept: Until you unsubscribe, which you can do from any newsletter.

Third-party content and advertising

Data: Your IP address and browser details, received by the services named in the Cookie Policy — only after you accept them in the cookie banner.
Lawful basis: Consent.
Kept: Until you withdraw it under Cookie settings. The services' own retention is set by them.

Where we rely on our legitimate interests, we have weighed them against your rights and expectations, and you can object (section 6).

3. The end users of your apps

When you add EmbedAuth to your application, we store data about the people who sign in to it — their email address, name and avatar if known, a password hash or a linked Google or Discord account, their sessions with the IP address and browser each started from, and a log of their sign-ins. We process it on your behalf, as your processor, and you are the controller: your own privacy policy tells your users how it is used. For applications in GDPR mode, our Data Processing Agreement applies and sets how long each kind of data is kept. If you use EmbedAuth to sign in to an app, the app's owner decides what happens to your data; write to them first.

4. Who receives it

We do not sell personal data. We share it only with the services that help us run EmbedAuth, under contracts that require them to protect it, or where the law requires us to:

Recipient	What for
Hetzner Online GmbH (Germany)	Hosts our servers, our database and the mail server that sends our emails.
Cloudflare, Inc. (United States)	Delivers the sign-in widgets and our website through its network.
Stripe (United States and Ireland)	Processes card payments.
paybroadcast	Runs subscriptions and the pricing table.
subscribeam	Runs the newsletter.
Google LLC (United States)	reCAPTCHA on our forms; Google Fonts for the pricing table once you accept; and sign-in, if you choose to sign in with Google.
Discord Inc. (United States)	Sign-in, if you choose to sign in with Discord.

5. Transfers outside the European Economic Area

Our servers and database are in Germany. Cloudflare, Stripe, Google and Discord may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework, where the recipient is certified under it, or on the European Commission's Standard Contractual Clauses. Write to us for a copy of the safeguards that apply.

6. Your rights

You have the right to:

Access and portability — get a copy of your data. Signed in, use Settings → Download my data for a machine-readable copy; or ask us.
Rectification — have inaccurate data corrected. Write to us.
Erasure — delete your account at any time under Settings → Delete account, or ask us.
Restriction — ask us to limit how we use your data while a question about it is settled.
Objection — object to processing based on our legitimate interests; we then stop unless we have compelling grounds that override yours.
Withdrawing consent — at any time, under Cookie settings at the bottom of every page, or with the unsubscribe link in the newsletter. Withdrawing does not affect what was done before.
Complaint — to a data protection authority: in Romania, the ANSPDCP, or the authority where you live or work.

Write to [email protected] to exercise any of them. We answer within one month, free of charge, and may ask you to confirm your identity first.

7. What you must provide

An email address and a password, or a linked Google or Discord account, are needed to create an account: without them we cannot provide the Service. Everything else is optional.

8. Automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects. Our protections against abuse — limits on repeated attempts, and reCAPTCHA — can turn away a sign-in or sign-up attempt for a while; if that happens to you wrongly, write to us.

9. Security

We protect data with encryption in transit, passwords stored only as hashes, encryption of secrets at rest, and access limited by role. No method of transmission or storage is completely secure, but we work hard to safeguard your information. See our Security page for more.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

11. Changes to this policy

We may update this policy. We will revise the "Last updated" date above and, for material changes, tell account holders by email before they take effect.

12. If you are in the United Kingdom

The UK GDPR and the Data Protection Act 2018 apply to you as well, and everything above holds under them: we rely on the same lawful bases (none of them the UK's "recognised legitimate interests"), and you have the same rights.

Complaining to us — write to [email protected] with "Privacy complaint" in the subject. We acknowledge every complaint within 30 days — usually within two working days — look into it, and tell you the outcome.
Complaining to the regulator — the Information Commissioner's Office (ICO), at any time.
Transfers — data sent from the UK to our servers in Germany is covered by the UK's adequacy regulations for the European Economic Area; transfers to the United States rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.

13. Contact

Questions about this policy? Email [email protected] or visit our contact page.