Emberly

GDPR overview

Emberly AS is established in Norway, inside the EEA, so the GDPR applies to it directly rather than by extension. A Data Protection Officer is named and genuinely reachable: Gina Husebø, at dpo@ember.ly. The policy enumerates EEA rights in full, including access and a copy of the data, rectification, erasure, restriction, portability and objection, and confirms that consent can be withdrawn at any time without retroactive effect. Requests go by email to the DPO, with a stated 30-day response window, and readers are pointed to the directory of European supervisory authorities should they wish to complain. Californian rights are handled separately under Shine The Light and the CCPA. Two caveats: the site does not respond to Do-Not-Track signals, and no Article 27 representative is named, which is normal for a controller established inside the EEA. The text itself was produced from a Termly template.

Who owns the data?

Nothing in the documents Emberly publishes claims ownership of what you put into a map: no clause in the terms or the privacy policy asserts a licence over user notes, files or bookmarks. The practical burden, however, sits squarely with you. Clause 11.2 of the terms states that you are responsible for downloading or exporting your data before closing an Emberly account. Once you ask to terminate, the publisher deactivates or deletes the account and its information from its active databases, while keeping some records where it needs them to prevent fraud, troubleshoot problems, assist investigations, enforce the terms or meet a legal obligation.

Reuse rights

The privacy policy sets out what Emberly does with the data it collects: create and manage your account, send administrative information, run marketing communications you can unsubscribe from, fulfil orders, publish testimonials where you have consented, handle feedback requests, keep the site secure, enforce the terms, respond to legal requests and analyse usage. The legal bases invoked are legitimate interest, performance of the contract, consent and legal obligation. The publisher states plainly that it does not share, sell, rent or trade your information with third parties for their promotional purposes. Analytics run on Fathom without cookies: an IP address is processed briefly, nothing personal is kept over time, and the basis cited is Article 6(1)(f). What is missing matters more than what is written. The retrieved documents say nothing whatsoever about whether user content is used to train AI models, and the policy is dated 14 February 2023, before the product had any AI features. That silence is a gap in the paperwork, not an undertaking.

Data retention & training

Hosting summary

The privacy policy names the infrastructure providers rather than the places. Google Cloud Storage and Google Cloud Services hold files, MongoDB Atlas holds the database, Auth0 handles authentication, Paddle handles billing and Fathom handles analytics. Every subprocessor is disclosed by name, which is more than many publishers of this size manage. What is never stated is where any of it physically sits: no hosting country and no region appears anywhere in the retrieved documents. A DNS lookup on the site resolves to 130.211.25.225, an anycast node operated by Google LLC (AS396982) that geolocates to the United States, but that describes the point of presence serving the site, not the location of your data, and should not be read as one. The publisher itself, Emberly AS, is established in Norway, so the GDPR applies to it directly whatever the storage region turns out to be. If your organisation needs a documented hosting jurisdiction, ask before signing up, because the answer is not published.