Privacy policy

This policy explains how Emberly ("we", "us") handles personal data when you use emberlycert.app, our mobile apps and related services. We act as a data controller for account data, and as a data processor for the customer and job data companies store in Emberly on their own behalf.

Data we collect

• Account details: name, email address, company name, logo and contact details.
• Business records you add: clients, sites, jobs, bookings, certificates, quotes, invoices, photos, notes, forms and logbook entries.
• Usage data: clock-in times, activity logs and basic technical information such as device and browser type.
• Payment details are handled by our payment provider (Stripe); we do not store card numbers.

How we use it

• To provide the service: creating certificates, scheduling, sending emails you ask us to send, and the customer portal.
• To manage subscriptions and billing.
• To provide support and tell you about important changes.

Our lawful bases are performance of a contract, legitimate interests in running and improving the service, and legal obligations.

Connected services (Xero)

If you choose to connect Xero, we access only the data needed for the features you use: contacts, quotes, invoices and payment status. Xero access tokens are stored encrypted. We use Xero data solely to provide those features to you. We do not sell it, share it with other customers, aggregate it across companies, or use it to train AI models. You can disconnect Xero at any time under Company › Xero, which deletes the stored tokens.

Sharing

We share data only with providers who help run Emberly (hosting, database, email delivery, payments, AI text assistance) under appropriate agreements, or where required by law. We never sell personal data.

Retention and security

We keep data while your account is active and for as long as needed for legal or record-keeping purposes. Data is encrypted in transit, access is restricted by company and role, and sensitive credentials are encrypted at rest.

Your rights

Under UK GDPR you can ask to access, correct, delete, restrict or export your personal data, and object to processing. You can also complain to the Information Commissioner's Office (ico.org.uk).

Contact

Email olly@emberlycert.app with any privacy question or request.