Privacy Policy

Last updated: 10-10-2026

This policy explains what information Emboss collects and how we use it. It is provided for transparency and is not legal advice.

1. Introduction

Emboss is operated by Three Poplars LLC, doing business as "Emboss AI". This policy covers our website, API, and applications (the "Service").

2. Information we collect

3. How we use information

We use information to: provide and operate the Service; detect and fill your forms; bill you and prevent abuse; secure, monitor, and debug the Service; improve our product; and send you service and account communications.

4. How your form content is processed

To detect and fill fields, your forms and any supporting documents, including page images, text and file names, are sent to third-party AI service providers that process them on our behalf to deliver the Service. We do not authorize these providers to use Your Content to train their models beyond what is necessary to provide the Service to us. When you send the A2A agent a request in plain words, the request's text and the names of any attached files are also sent to these providers to work out what you asked for and to plan requests that ask for several jobs.

When Emboss detects the fields of a blank form, it keeps that form's layout without any link to your account: the field names, positions and types, the text printed beside each box, and the form's title. It reuses the layout when anyone uploads the same blank form. The layout describes the form, not the person filling it, and it is kept after your form is deleted.

When you ask Emboss to fax a document, the assembled PDF and the destination number you provide are passed to a fax carrier that transmits it over the telephone network. The carrier fetches the document once through a link that expires within an hour. Emboss keeps its staged copy for up to 24 hours after the fax is delivered or fails; a fax refused before it is sent keeps no copy. The receipt shows the destination number only in masked form. The fax record keeps the full number and the internet address the request came from for 90 days, for abuse limits, refunds and disputes, and then masks them too. The carrier's handling of transmission records is governed by its own terms.

After documents are deleted, Emboss keeps a record of each file without the file: what kind of file it was, its size, page count and fingerprint, when it was created, and which process produced or used it. This record holds no file names, no field values and no document content.

When a form is deleted, Emboss keeps a record that it was deleted: when, and whether it was deleted on the website, through the API or through a connector, with the API key used if there was one. The deletion record itself holds no document content.

Outputs of a free utility are deleted sixty to seventy minutes after they are created, for every caller.

5. Service providers

We share information with third-party service providers only as needed for them to perform their function on our behalf. These include a third-party payment processor, stablecoin payment providers, third-party AI service providers, a transactional email provider, a fax carrier, a bot-check provider, third-party analytics, error-monitoring, and advertising-measurement providers, and cloud hosting and storage providers. Our subprocessors page lists what each kind of provider handles and where. We do not sell your personal information.

If you connect Emboss to a third-party app such as Claude, that app can see and download every form in your account and act on any of them within the permission you grant on the consent screen: reading your forms, or also creating, filling and deleting forms and sending faxes billed to your account. It keeps that access until you disconnect it from your dashboard.

6. Cookies and tracking

We use essential cookies, such as those needed to keep you signed in. Our product analytics may set an analytics cookie to measure traffic and recognize returning visitors; for visitors in the EEA, UK, and Switzerland, analytics storage is disabled by default and this measurement is cookieless. While we run ad campaigns, an advertising-measurement cookie may be set to attribute signups to our ads; for visitors in the EEA, UK, and Switzerland, advertising storage is disabled by default.

7. Data retention and deletion

We retain your account and content data while your account is active and as needed to provide the Service and meet our legal and billing obligations. You may request deletion of your account or content by emailing contact@getemboss.ai. We will delete or anonymize your data within a reasonable period after your request, though residual copies may persist for a limited time in routine backups.

Ephemeral processing. Ephemeral processing: source and output documents are deleted 60 to 70 minutes after the last activity on a form. It is the default for pay-per-job callers with no account and a setting for account holders. What is kept and what is deleted is listed on our security page.

Pay-per-call requests without an account. When an agent asks the pay-per-call API for a price, or pays for a job, without an account, we keep a fingerprint of its request so the payer can get the result back if the answer is lost: for about an hour when no payment follows, and for 24 hours once the job is paid for. The fingerprint is a one-way code computed from the documents and settings sent; it cannot be turned back into the document. The documents sent with a price that is never paid are deleted when the price expires, an hour after the request. A paid read keeps the values it read with the job for those 24 hours.

Plain-language requests to the A2A agent. When the A2A agent asks you a question about a request you sent in plain words, the request's words and any attached files are kept with the task for up to 24 hours while it waits for your answer, then deleted. They are deleted as soon as the task ends, and you can cancel a waiting task at any time.

8. Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, and to know how it is used. California residents have additional rights under the CCPA/CPRA, including the right to know and the right to opt out of the sale of personal information; and we do not sell personal information. To exercise any of these rights, email contact@getemboss.ai.

9. Security

We protect your information with encryption in transit, encryption at rest for stored documents, hashed password storage, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's privacy

The Service is not directed to children under 13 (or under 16 where applicable), and we do not knowingly collect their personal information.

11. International users

We operate from the United States. By using the Service, you understand your information will be processed in the United States.

12. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above, and for material changes we will provide reasonable notice.

13. Contact

Questions about your privacy? Contact us at contact@getemboss.ai.