Who we are
Emberway is provided by Drawbridge Automations LLC, doing business as Emberway ("Emberway", "we"). Emberway is a relationship engagement platform used by organizations to coordinate outreach by their staff and volunteers.
Who is responsible for the data
Organizations own the records they load into Emberway. For that data, the organization is the controller and Emberway processes it only on the organization's behalf and instructions. Each organization is responsible for having a lawful basis to collect and upload the data it puts into Emberway. For the account information of the team members who use Emberway, Emberway is responsible.
Data we process
On behalf of each organization: contact information (names, emails, phone numbers, addresses), engagement history, responses submitted through engagement portals, and fields the organization chooses to import from spreadsheets or connected systems such as their CRM. For team members (staff and representatives): account email, role, phone number for notifications, and activity within the product. We also keep standard security and usage records, such as login timestamps and change history, so accounts stay secure and organizations can audit changes to their own data.
CRM connections
Emberway connects to the CRM and fundraising systems your organization chooses to connect. It reads the records and field definitions needed for the imports the organization requests. If the organization sets it up, Emberway can also update specific fields in those systems (for example, when someone responds through an engagement portal). Access credentials are stored encrypted and can be revoked at any time from the connected system or from Emberway.
Email and contacts
Team members can choose to connect a Google or Microsoft account. Emberway can then read their saved contacts and the people they've emailed, so they can pick who to import: only the people they choose are added. If they also connect their mailbox, Emberway reads the emails exchanged with a specific person when they view that person: sender, recipients, subject, date, and a short preview, plus the full message when they open it. This mail is saved so it loads quickly, is visible only to the team member who connected the mailbox, and is deleted when they disconnect. Emberway never sends, changes, or deletes anything in a mailbox, and does not access calendars.
Google user data
When a team member connects a Google account, Emberway receives Google user data only for the features they turn on:
- From Google People (contacts): names, email addresses, phone numbers, and related contact fields for the saved contacts and "other contacts" (people they've emailed) that they choose to import.
- From Gmail (optional, separate consent): for a person they are viewing, message sender, recipients, subject, date, a short preview, and the full message when they open it.
Emberway does not request or use Google Drive, Calendar, send, modify, or delete permissions. Emberway never sends, changes, or deletes anything in a Google mailbox or Google Contacts.
We use this Google user data only to provide and improve those user-facing features for that team member and their organization (importing chosen contacts into relationship records, and showing email history with a specific person). We do not use Google user data for advertising, lending, credit decisions, or sale or transfer to data brokers or information resellers.
Raw Google user data (including Gmail content) is visible only to the team member who connected the account. Mail retrieved from Gmail is cached so it loads quickly, and that cache is deleted when they disconnect Google or Gmail. Emberway does not transfer raw Google API data (including Gmail content or People API contact dumps) to third-party AI providers. Once a contact is imported into an Emberway relationship record, that record is treated like other organization data under this policy.
Emberway's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Protection: Google connection credentials are stored encrypted. Google user data is encrypted in transit and at rest with the rest of the organization's Emberway data. Retention and deletion follow the Leaving Emberway & deletion section, and mailbox cache deletion on disconnect as described above. Organizations and members can disconnect Google at any time from Emberway or from their Google account permissions.
Notifications
Emberway sends team members reminders and updates by email and, if they opt in, by SMS or WhatsApp. These messages can include the name of the person they're working with. Messages go to team members. If an organization turns on automatic sending and a rep opts in, a workflow can also email people in the organization's records directly. Replies sent over WhatsApp are saved so they can update the relationship.
If a team member opts in to SMS, they consent to receive text messages from Emberway at the number they provide. Message frequency varies. Msg and data rates may apply. Reply STOP to opt out and HELP for help.
AI features
Some features use AI to write summaries, suggest next steps, match people with reps, and help build engagement portals, scoring, and workflows. To do this, Emberway sends the relevant Emberway record details (such as name, stage, notes, and history) to our AI provider, Anthropic. Raw Google API data (including Gmail content and contact dumps pulled from Google) is not sent to AI. Once a team member imports a contact into Emberway, that relationship record may be used by AI features like other organization records. Customer data is not used to train or improve AI models, and under our agreement with our AI provider, it does not use this data to train its models. AI output can be inaccurate or incomplete. It is decision support, and team members should review it before relying on it.
Home value lookups
If an organization uses home value lookups, Emberway sends a record's street address to a property data service to get estimated home values. Organizations can choose to show reps a range instead of the exact figure.
How we use it
We use this information solely to provide, secure, and improve Emberway: to sign people in, to store and display the organization's records, to send the messages the organization or a team member requests, and to power the optional AI features described above. Google user data is limited further, as described under Google user data. We do not sell personal information, and we do not use organizational content for advertising.
Service providers
Emberway uses these subprocessors to run the service. Each receives only what it needs to perform its function:
- Supabase: database and sign in
- Vercel: hosting
- Anthropic: AI features
- AgentMail: email provider
- Resend: email delivery
- Stripe: payment processing
- Twilio: SMS and WhatsApp messages
- Zillapi: property data
- The CRM and fundraising systems your organization chooses to connect: the records and updates the organization sets up
- Google and Microsoft: only when a team member connects their account
What we don't do
We do not sell personal data. We do not use organizational data for advertising. We do not process payments or store financial account credentials. For Google user data specifically, we do not use that data for advertising, for lending or credit decisions, or for sale or transfer to data brokers or information resellers, and we adhere to Google's Limited Use requirements as stated under Google user data.
Security
Each organization's data is kept separate from every other organization's, and is encrypted in transit and at rest. Connection credentials are held in an encrypted vault. Every change to a relationship is recorded in a history log. If we confirm a security breach affecting an organization's data, we will notify that organization without undue delay. Passwords are stored only as a secure hash. Access within an organization is controlled by role, and sign in and account recovery are limited by rate. No system is perfectly secure. We design for least access by default.
Leaving Emberway & deletion
We keep an organization's data for as long as it uses Emberway. The organization may request an export or deletion of its data at any time by emailing barrett@emberway.ai, and we will act on verified requests promptly. After an organization cancels, it can export its data as CSV for 30 days. If it does not request earlier deletion, we delete the organization's data within 30 days after that export window closes.
Your rights
Team members can access and correct their account information in Emberway. Deletion requests for organization data go through the organization. Individuals can contact us about personal information we hold about them.
Children
Emberway is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected personal information from a child under 13, we will delete it.
Data processing addendum
A data processing addendum is available to organizations on request. Contact us at the address under Notices.
Changes
If this policy changes materially, we will update the effective date above and give organizations reasonable notice.
Notices
Drawbridge Automations LLC, doing business as Emberway, 59 Orland St, Portland, ME 04103, barrett@emberway.ai.
Questions
Contact barrett@emberway.ai with privacy questions or requests.