Embedder procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Embedder is a US-based company and our production systems are hosted in the United States (GCP, region us-central1 ). If you access the Services from outside the United States, your information will be transferred to and processed in the United States. For transfers from the European Economic Area, the United Kingdom, and Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) with our sub-processors, supplemented by additional safeguards as required.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit: https://app.prighter.com/portal/embedder” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may terminate your account at any time through your account settings or by contacting us. Termination will be effective at the end of your current billing period. You will not receive a refund for any prepaid fees, except as expressly provided in these Terms.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Your Backup Responsibility. You are responsible for maintaining your own backups of Your Content. The Services are not intended to serve as your sole repository or system of record, and you should retain independent copies of any data that is important to you. To the maximum extent permitted by law, we are not liable for any loss, corruption, or deletion of Your Content. Data Location. The Services are currently hosted in the United States. Customers requiring data residency in a specific region should contact us at [email protected] before subscribing; regional hosting may be available under an Enterprise plan. Data Subject Rights: For details on your rights under applicable data protection laws (including the EU GDPR, UK GDPR, and California Consumer Privacy Act), please refer to our Privacy Policy. Data Processing Addendum: Enterprise customers and customers subject to GDPR, UK GDPR, or similar regulations may request a Data Processing Agreement (DPA) by contacting us at [email protected] .” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ We retain information for as long as we need it to provide the Services and to meet legal obligations. Account and uploaded content: retained while your account is active. When you delete your account, we deactivate it immediately and complete erasure of account records and uploaded content across our primary database and sub-processors within 45 days, subject to legal-hold and backup-rotation exceptions described below. Backups containing deleted data age out under the schedule in this section and are not restored to production except in the event of a disaster-recovery incident, in which case re-deletion is performed. Database backups: we keep up to 30 most-recent automated backups of our primary database and 7 days of point-in-time recovery transaction logs. Backups roll forward and old backups age out automatically. Application and telemetry logs: retained for approximately 14 days in our default log store. Specific operational logs may be retained for shorter or longer periods as configured. Audit logs: retained for 730 days under bucket-locked, write-once storage to support security investigations and compliance. Billing records: retained for 7 years to comply with tax and accounting regulations. Legal holds: data may be retained longer where required for legal, regulatory, or legitimate business purposes.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ We will delete or anonymize your personal information within 45 days, except as required by law Backup copies may be retained for the period described in the retention schedule in our Privacy Policy ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google Cloud Platform (GCP): primary hosting, Cloud SQL (PostgreSQL), Cloud Storage, Memorystore (Redis), Secret Manager. All production workloads run in us-central1 . We also operate self-hosted instances of the Weaviate vector database and Sentry error-monitoring software on GCP infrastructure in us-central1 ; these are not separate sub-processors. Cloudflare: edge network, DNS, CDN, WAF, Zero Trust Access, Cloudflare Tunnel.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell your personal information or uploaded content to third parties. We may share your information only: With the sub-processors listed in Section 5, under contractual confidentiality and use restrictions. When required by law, court order, subpoena, or other legal process, or to establish, exercise, or defend legal claims. To investigate, prevent, or take action regarding suspected fraud, abuse, or violations of our Terms of Service. In connection with a merger, financing, acquisition, or sale of assets; we will notify you of any such transfer that affects your information. With your explicit consent for a specific purpose. As aggregated or de-identified data that cannot reasonably be used to identify you.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We engage the following third parties to deliver the Services. They access your information only to perform tasks on our behalf under written agreements that restrict use to those tasks.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Stripe: payment processing and subscription management. Loops: lifecycle and product email.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The following providers support internal operations and do not, in normal use, receive customer content: Google Workspace (corporate email and documents), Drata (compliance automation; receives metadata about systems and personnel only), and Kandji (workforce-device management; does not process customer data). We will update this list when we add or remove a sub-processor. Customers under signed agreements receive advance notice of material sub-processor changes per the terms of their agreement. Customers processing personal data through the Services may request our Data Processing Agreement at [email protected] .” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We are not liable for any loss or damage arising from your failure to maintain account security. Permitted Users. If you are a paid customer, you may permit your employees and contractors to use the Services for your internal business purposes, provided each such user complies with these Terms and you remain responsible for their use. Each individual user must have their own account; account sharing is not permitted.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “We will provide at least 30 days' advance notice of fee increases for existing subscriptions. No Refunds: All fees are non-refundable except (i) as required by law, (ii) as expressly stated in these Terms (including the refund for termination without cause described in Section 9.2), or (iii) as set forth in your Order Form. Auto-Renewal: Unless otherwise stated in your Order Form, all subscriptions automatically renew at the end of each subscription term for a renewal term equal to the then-current term, at the then-current rates, until cancelled in accordance with this Section. Cancellation: You may cancel your subscription at any time through your account settings or by contacting us at [email protected] . Standard cancellation terms are as follows, except as otherwise provided in your Order Form or a separate Master Services Agreement: Month-to-Month Subscriptions: You may cancel at any time. Cancellation takes effect at the end of the current monthly billing period, and you will continue to have access to the Services through the end of that period. You will not be charged for any subsequent month, and the subscription will not renew. Annual (Yearly) Subscriptions: To cancel or prevent automatic renewal of an annual subscription, you must provide written notice of cancellation at least thirty (30) days before the end of the current annual term. Cancellation takes effect at the end of the current annual term, and you will continue to have access to the Services through the end of the paid term. ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “If notice is not received at least thirty (30) days before the end of the term, the subscription will automatically renew for a subsequent term, and cancellation will instead take effect at the end of that renewal term. Except as required by law or as expressly provided in these Terms or your Order Form, cancellation does not entitle you to a refund of any prepaid fees for the remainder of the current billing period or term. Order Form and MSA Control. The cancellation, renewal, and refund terms in this Section are the standard terms governing your subscription, including any subscription purchased under an Order Form. If your Order Form or a separate Master Services Agreement (MSA) signed by both parties contains different cancellation, renewal, notice, or refund terms, those terms control to the extent of any conflict.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Fees: Use of certain Services requires payment of fees. All fees are stated in U.S. dollars unless otherwise specified. By subscribing to a paid plan, you agree to pay all applicable fees. Billing: Subscription fees are billed in advance on a recurring basis (monthly or annually). You authorize us to charge your payment method on file for all applicable fees. Usage-Based Fees: Certain plans may include usage-based charges based on metered consumption (such as AI tokens consumed, processing time, or other resources). You are responsible for all charges incurred under your account. Late Payments: Payment obligations are non-cancelable. If you fail to pay any amount when due, without limiting our other rights and remedies: (i) we may charge interest on past-due amounts at the rate of 1.5% per month, or the highest rate permitted by applicable law if lower; (ii) you will reimburse us for all reasonable costs of collection, including attorneys' fees, court costs, and collection agency fees; and (iii) if the failure continues for ten (10) days or more, we may suspend your access to any or all of the Services until all overdue amounts are paid in full. Taxes: All fees are exclusive of any applicable taxes, including sales tax, VAT, GST, or similar taxes. You are responsible for paying all such taxes associated with your use of the Services, except for taxes based on our net income. Price Changes: We reserve the right to change our fees at any time. ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Use of the Services by U.S. Government end users, or in performance of a U.S. Government prime or subcontract, is subject to a separate Government Addendum executed by both parties. Without such an addendum, the Services are provided as "commercial computer software" and "commercial computer software documentation" pursuant to FAR 12.212 and DFARS 227.7202, and any flow-down clauses (including those from FAR Part 52 or DFARS Part 252) are expressly excluded.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.