Legal

Privacy Policy

Data Controller

The data controller for personal data processed through Ember is Ember, operated from Romania. Full data controller identification relevant to your purchase is provided on your invoice and at checkout by Polar, our payment and merchant-of-record provider.

For privacy inquiries or data subject requests, contact us at support@embersubs.com.

As data controller, Ember determines the purposes and means of processing your personal data in accordance with the EU General Data Protection Regulation (GDPR, Article 13) and Romanian data protection law (Law 190/2018). The supervisory authority is ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal) at dataprotection.ro.

Data We Collect

Ember collects and processes the following categories of personal data depending on how you use the product and website:

Account and licensing data: email address, subscription status, and payment identifiers. Payment card details are collected and processed by Polar, our merchant of record, not by Ember.
Usage data: credit consumption, feature usage patterns, session information, and error reports.
AI feature data: when you use transcription, Cast, translation, Furnace, or other AI-assisted editing, Ember sends only the audio, transcript, subtitle text, or prompt content needed to complete that request. Ember currently routes transcription through OpenRouter to Microsoft's MAI Transcribe model and Cast to models through OpenRouter; both routes are configured for Zero Data Retention (ZDR). Translation and other AI-assisted features may use other third-party providers. Models and providers may change.
Technical data: app version, operating system, session state, request metadata, and error information needed for licensing, support, security, and service reliability.
Website data: IP address, browser type, device information, pages visited, referrer, and interaction events collected through website analytics when you consent to non-essential cookies.

How We Use Your Data and Legal Basis

Under GDPR Article 6, we process your personal data on the following legal bases:

Contract performance (Art. 6(1)(b)): processing account data, license validation, usage balance management, delivering the subscribed service, and providing support.
Legitimate interest (Art. 6(1)(f)): improving Ember, analyzing usage patterns, preventing fraud and abuse, ensuring service security, and communicating product updates.
Consent (Art. 6(1)(a)): placing non-essential cookies on our website, sending marketing communications where applicable, and processing data beyond what is strictly necessary for the contract.
Legal obligation (Art. 6(1)(c)): complying with applicable tax, accounting, and regulatory requirements.

Where we rely on legitimate interest, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us at support@embersubs.com.

What Stays on Your Device

Subtitle editing, track layout, file exports, and DaVinci Resolve integration run entirely on your local machine. When you work with local files, those operations are not transmitted to Ember’s servers.

Local subtitle editing stays inside the desktop app.
Subtitle exports are created and saved locally.
DaVinci Resolve integration uses the local Resolve API.
License tokens are stored locally on your device to restore your session.

AI Processing and Third-Party Providers

When you use Ember’s AI-powered features (such as transcription, translation, Cast, or AI-assisted editing), the audio, text, and prompts needed for the task may be transmitted to third-party providers for processing.

Current cloud processing routes include:

Cloud transcription — Ember currently routes transcription audio through OpenRouter to Microsoft's MAI Transcribe model. This route is configured for Zero Data Retention (ZDR).
Cast — Ember currently routes Cast requests to models through OpenRouter. This route is configured for Zero Data Retention (ZDR).
Other AI-assisted features — translation, Furnace, Scripts, and other features may use other third-party providers selected for the requested task.

Models, providers, and processing routes may change. Only use AI features with content you are comfortable sending for remote processing.

You are responsible for ensuring you have the rights and, where required, consent from speakers, performers, clients, or rights holders before submitting audio, video, transcripts, subtitles, or prompts for AI processing.

Payment Processing Through Polar

Payments, checkout, invoicing, tax collection, and subscription management are handled by Polar as Ember’s merchant of record. When you purchase Ember, Polar may collect billing contact details, payment method details, billing address, VAT or tax information, IP address, fraud-prevention signals, order details, and invoice data.

Ember does not receive or store full payment card numbers. Ember receives limited billing metadata from Polar, such as your customer email, product or plan, subscription status, payment status, invoice or order identifiers, tax status, and renewal or cancellation information needed to provide the service.

Licensing, Downloads, and Updates

Ember uses license and session data to activate the app, restore access on launch, authorize downloads, and check for updates.

Your account credentials and refresh token are stored locally on your device. Access tokens are kept in memory for the active session.

An active license may be required for downloads and update checks.
Update checks do not consume credits.
Operational request data is used for authentication, billing, rate limiting, abuse prevention, and service reliability.

Cookies and Website Analytics

The Ember website uses cookies and similar technologies.

Strictly necessary cookies are used for core website functionality and do not require consent. All other cookies — including analytics and marketing cookies — require your prior opt-in consent before being placed on your device, in accordance with the EU ePrivacy Directive (2002/58/EC) as transposed by Romanian Law 506/2004.

Strictly necessary cookies: essential for website operation (such as security). No consent required.
Analytics cookies: used to understand site traffic and usage (e.g., Google Analytics when configured). Require prior consent.
Non-essential cookies are not placed until you provide affirmative consent.
You can withdraw cookie consent at any time through your browser settings or our cookie preferences.

Analytics data may include IP addresses, browser information, device data, pages visited, and interaction events. When Google Analytics is configured, it operates under Google’s data processing terms.

If Ember adds additional non-essential cookies, the cookie notice or preferences interface will identify the provider, purpose, category, and duration before those cookies are placed.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the EU/EEA in the following circumstances:

AI processing: content sent to AI providers may be processed in the United States or other jurisdictions where the provider operates.
Payment processing: Polar may process payment-related data internationally as required for billing and tax compliance.
Infrastructure: Ember’s backend services may be hosted in jurisdictions outside the EU/EEA.

All international transfers are protected by appropriate safeguards as required by GDPR, including Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms.

Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

Account and licensing data: retained for the duration of your subscription and up to 12 months after termination, unless longer retention is required by law.
Usage and billing data: retained for up to 24 months for service improvement and as required by tax and accounting obligations.
AI processing content: Ember currently routes transcription through OpenRouter to Microsoft's MAI Transcribe model and Cast to models through OpenRouter; both routes are configured for Zero Data Retention (ZDR). Translation and other AI-assisted features may use other third-party providers. Models and providers may change.
Website analytics data: retained for up to 14 months, or as configured in the analytics platform.
Support correspondence: retained for up to 24 months after the last interaction.

When retention periods expire, data is securely deleted or anonymized. Legal obligations (such as tax records) may require longer retention of certain data categories.

Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of the personal data we hold about you.
Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): request deletion of your personal data where there is no compelling reason for continued processing.
Right to restrict processing (Art. 18): request that we limit how we use your data in certain circumstances.
Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interest or for direct marketing purposes.
Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: file a complaint with the Romanian data protection authority (ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal) at dataprotection.ro, or with the supervisory authority of your EU member state of residence.

To exercise any of these rights, contact us at support@embersubs.com. We will respond within 30 days as required by GDPR. We may need to verify your identity before processing your request.

Children’s Data

Ember is not directed at children. You must be at least 18 years old (or the age of legal majority in your jurisdiction) to use Ember.

In Romania, the GDPR consent threshold for children is 16 years of age (Article 8 GDPR, as implemented by Romanian Law 190/2018). Under the U.S. Children’s Online Privacy Protection Act (COPPA), the threshold is 13 years.

If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, contact us at support@embersubs.com.

Security Measures

Ember implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Data in transit is encrypted using TLS/HTTPS.
License tokens and session credentials are stored securely on your device.
Access to backend systems is restricted and monitored.
We regularly review and update our security practices.

No method of electronic transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Changes to This Privacy Policy

Ember may update this privacy policy as the product, legal requirements, or data practices change. Material changes will be communicated via the Ember website.

The current version is always available at embersubs.com/privacy. Continued use of Ember after changes take effect constitutes acceptance of the updated policy.

Questions about privacy or your data?

Email support@embersubs.com if you need help.

Privacy PolicyPrivacy Policy