What Ember handles
Account and contact details, website files, conversations, supplied images, form submissions, billing references and usage or diagnostic information. Published pages are public unless protected. Avoid submitting secrets or sensitive information that your website does not need.
The Privacy Policy describes collection and your rights. The Service Providers page identifies recipients, their purposes and processing locations. The Terms of Service govern use of Ember.
Browser analytics include session replay and ordinary input text. Real password inputs are masked and Stripe payment forms are excluded. Advertising measurement is described in the Privacy Policy.
Our October 12, 2026 review corrected earlier disclosures that did not consistently describe the existing service configuration. The dated correction notice explains those changes and preserves customers' rights under earlier policies.
Storage and international access
StableModels personnel operate from the United States. Cloudflare provides global request processing and support; primary site storage and index placement is currently Eastern North America, without a US jurisdiction restriction; this is not a US-only residency guarantee. PostHog uses US Cloud hosting with international subprocessor and support access. Other providers process data under their applicable policies. Hosting region, staff access and request processing are different; Ember does not offer a data-residency guarantee.
Ember serves customers in the United States, Canada excluding Quebec, and Australia, ages 18 and over. Service availability does not restrict where our providers can process data. Provider location disclosures can change; the linked policies identify their current arrangements.
Access and security
Ember uses encryption in transit and provider encryption at rest, account and site ownership checks, scoped credentials, and access limited to authorized users. Sign in with Google or email and password; passwords are stored as salted, one-way hashes.
MCP connections use user-authorized OAuth with scoped access tied to the Ember account. Tools can read, create, edit, preview, publish and archive sites within that account's permissions. The AI host also handles what you send to it under its own policies. Read our MCP documentation for connection details.
No system is perfectly secure. This page does not claim a certification, service-level agreement or country-specific residency guarantee.
AI processing
We do not train AI models on your content. Providers receive the information needed for the requested task under their applicable service terms. The selected model and feature determine which provider receives a request.
TypeSafe AI's Jev provides design relevance ranking and other structured decisions through Cloudflare AI Gateway. Design search uses a bounded query and public design descriptions. Action suggestions can use recent conversation context, and form-spam classification can process submitted form content. TypeSafe's public policy says inputs are not used to train or fine-tune models.
Model-provider retention and gateway logging are separate. Ember uses its own provider credentials: Cloudflare's zero-retention guarantee for Cloudflare-managed credentials does not establish zero retention for these requests. See the retention details below and the provider disclosures.
Retention and deletion
- Account and site content — While your account is open, then 30 days after account closure so you can retrieve it, followed by deletion under our account-closure policy. Export before closing. Billing, provider records and backups have separate schedules.
- Deleted Sites and conversations — Moving a site to Deleted Sites is a recoverable archive, not permanent erasure. Site files and conversations remain available for restoration. Contact support for permanent deletion or account closure.
- Billing records — For tax and accounting obligations, typically seven years, including after account closure.
- Session recordings — PostHog session replay is configured for 30 days.
- Product analytics — PostHog's paid-plan event query window is seven years. A query window limits access to older events; it is not a guaranteed physical deletion deadline. Deletion requests require separate handling.
- AI Gateway logs — Enabled request and response logging uses a capacity limit with oldest-first eviction. There is no fixed maximum retention age in days. Design-ranking requests bypass gateway caching; cache expiry is separate from log retention.
- AI providers — Provider-specific terms govern retention. TypeSafe's listed AI-compute subprocessors describe prompt processing without storage, but this does not establish zero retention across its full service or Cloudflare gateway logs. Cloudflare's zero-retention guarantee for its managed model credentials does not apply to Ember's own provider credentials.
- Published-site visitor analytics — Detailed traffic records about 90 days; daily aggregates can be kept longer.
- Advertising, other diagnostics and backups — Category-specific provider and operational schedules apply; no single maximum deletion deadline covers these records. Ask support about a deletion request and any required retention.
Requests and contact
For access, export, permanent deletion, account closure, or opting out of session replay or advertising measurement, email support@embersites.com from your account email. We verify the requester and explain any required retention or provider limitations. Site files can also be exported through the builder or CLI.
Send security reports to the same address. Describe the issue without including live credentials or other people's private information.
The Privacy Policy describes disclosures required by law and the privacy rights available in our supported markets. We do not claim additional government-request notification or challenge procedures here.
Keeping these disclosures current
StableModels product operations reviews these disclosures when functionality, providers or data handling change. Disclosure review is part of our development process. The review date above describes the latest disclosure review. Provider policies and live settings are checked separately; a website build does not constitute a new review.