Privacy policy

1. Data controller and contact #

Embra is currently operated by Hoàng Xuân, an individual based in Vietnam, as the controller of the account, workspace and billing data described in this policy. Embra has not yet been incorporated as a legal entity. When it is, this policy will be updated as described in section 18. The operator's public profile: github.com/hxuan190.

2. Scope and Embra's roles #

This policy applies to people who sign in to the console, use the CLI, API or MCP, customers who run apps on Embra, people invited to a workspace or billing account, and people who submit abuse reports. Embra holds two kinds of data, in two different roles:

Out of scope: the waitlist has its own data processing notice (in Vietnamese). The conditions of use are in the Terms of Service (in Vietnamese).

Embra does not sell or rent personal data and does not share data with third parties for advertising. Embra does not ask for data such as national ID numbers, biometric data, location or passwords. Some data Embra holds, such as activity history, IP addresses at CLI sign-in and bank transfer descriptions, may be considered sensitive personal data under Decree 356/2025/ND-CP (Article 4(1)(k) and (l)). Embra limits who can access this data as described in section 8.

3. Account and workspace data #

The "Legal basis" column refers to Law 91/2025/QH15: performance of a contract (Article 19(1)(d): processing needed to provide the service you signed up for; GDPR Art. 6(1)(b)), protection of lawful rights and interests against infringement (Article 19(1)(a), such as abuse prevention and security; comparable to legitimate interests, GDPR Art. 6(1)(f)), legal obligation (Article 19(1)(đ); GDPR Art. 6(1)(c)), or your consent (Article 9; GDPR Art. 6(1)(a)).

Details

• If GitHub does not return an email that is both primary and verified, or that email already belongs to another Embra account, Embra uses your GitHub noreply address (id+login@users.noreply.github.com).
• The creation date of your GitHub account is read once to decide trial eligibility and is not stored.
• The GitHub or Google token received at sign-in, and the user token used during GitHub App installation, are used only in that step to read the information needed and are then discarded, never stored.
• CLI sign-in has a "country" field in the database, but Embra currently has no IP geolocation source, so the field is always empty.
• Trial workspaces are named after your GitHub login.
• Embra needs an email address and a sign-in identity to provide the service. Without them, Embra cannot create an account for you.

4. Billing #

• You pay by VietQR bank transfer to Embra's TPBank account. SePay reads that account's transactions and reports them to Embra.
• Embra does not write transfer descriptions, payer names or bank references to logs, activity history or Telegram alerts. Payer name, amount and invoice number do appear in billing emails sent via Resend (section 9).
• Embra never receives card numbers, bank login credentials or your account balance.

5. Data inside your apps #

For the data in this section Embra is a processor: Embra stores and processes it to build, run, back up, restore and export your apps at your request, and for no other purpose. The legal basis is performance of the contract with you. If your app stores personal data of its end users, you are responsible to them.

Source code and builds

• When you connect a repository, Embra's GitHub App requests a token that can only read the contents of that repository. To list repositories when you pick one, Embra uses a token that can only read basic metadata of the repositories you granted to the GitHub App. These tokens live at most 1 hour and are not stored.
• Embra stores the repository name, branch, root directory, commit SHA and image digest of each build. It does not store commit author names, emails or commit messages.
• Directly uploaded source is kept for at most 7 days (24 hours if not used by any build).
• The build cache (derived from your code) is kept for up to 14 days after its last use, even after the environment is deleted.
• Built images (containing your code) are stored in a private registry on Embra's server and are currently not deleted automatically.
• Build logs are kept for 30 days after the build finishes.

Databases, files and secrets

• Each environment has its own Postgres database. Databases and bucket files are stored on Embra's servers in Vietnam. For backups see section 6.
• Secrets (secret environment variables) are encrypted with AES-GCM before storage.
• Forks for AI agents: when you or your token create a fork, Embra creates a point-in-time copy of the production database, with columns masked according to the fork masking rules, for an AI agent to experiment on. A fork lives at most 24 hours. Fork data goes to the AI client you choose to connect through MCP.
• Data import: a dump you upload for loading into a database is kept on the control server until the import completes (24 hours if unused). Afterwards Embra keeps only a summary of table names and row counts imported.

Logs

• Embra stores what your app writes to stdout/stderr (web, worker, cron) so you can search it later. Logs contain whatever your app prints, so do not print passwords, tokens, API keys or unnecessary personal data.
• Embra's edge also writes one line per request to your app: method, path (without query string), protocol, status code, duration and response size. This line contains no IP address, headers, cookies or request body. Under heavy traffic Embra records only a sample plus a summary line each minute.
• The log store keeps at most 30 days and has a size cap: when it is nearly full, the oldest day is deleted first, so logs may disappear sooner. You can search the last 1 to 30 days depending on your plan (pricing).
• If your app logs faster than 256 KiB per second, the excess is not stored and Embra writes a notice line in the log.
• Raw log files on the server (used for live log viewing) are deleted when you delete the environment, or 30 days after the last write of a removed container.

Metrics

• Embra measures CPU, memory, out-of-memory events and restarts, HTTP request counts by status class (2xx, 4xx, 5xx…), response time and Postgres disk usage. Metrics contain no URLs, IP addresses, headers or request bodies.
• Metrics are kept for 30 days. The window you can view depends on your plan, as with logs.

Export

An owner or admin can export an environment: the export contains a database dump, the app image, configuration (secret names only, no values) and, if selected, bucket files. The download link is signed and deleted automatically after 24 hours.

6. Backups #

App databases

• Each environment's Postgres is backed up continuously (WAL) with a full backup every week. Embra keeps the 2 most recent full backups plus the WAL between them, so you can restore to a point in time within roughly the last 1 to 2 weeks. These backups are stored on Embra's servers in Vietnam and copied about every minute to Cloudfly object storage in Hanoi.
• After a point-in-time restore, the previous database is kept for another 72 hours so you can switch back.
• At Cloudfly, backup files that have expired or been replaced are moved to a separate area and deleted automatically after 7 days.
• When you delete an environment, its backups are deleted both on the server and at Cloudfly, including that separate area. The Cloudfly copy is deleted within 7 days at most (section 11).

Bucket files

Bucket files currently have no backup. Keep the originals of important files elsewhere.

Embra's control database

The control database holds the data in sections 3 and 4 (accounts, emails, activity history, billing, transfer descriptions, CLI sign-in IPs, sent emails, abuse reports). Since 2026-11-13 this database is backed up every hour: each copy is encrypted on the server and then copied to Cloudfly object storage in Hanoi. The decryption key is not on the server, and Cloudfly does not have it either. Each copy is locked for 7 days: during that time nobody can delete or change it, Embra included. After that it is deleted automatically, no later than 10 days after it was made.

7. Cookies, browser storage and IP addresses #

Console cookies

These cookies are strictly necessary for the console and are all set with Secure, SameSite=Lax and the __Host- prefix.

Cookies on your app's domain

Embra's edge may set cookies on your app's domain (*.onembra.com or your custom domain), so visitors to your app may receive them too:

Browser storage and external resources

• The console uses no advertising or tracking cookies and loads no third-party analytics.
• The console keeps a few preferences in your browser's localStorage: diagram layout and language. The path to return to after sign-in is kept in sessionStorage and is lost when the tab closes. None of this is sent to Embra.
• The console shows avatars loaded directly from avatars.githubusercontent.com, so GitHub receives your browser's IP address when the image loads.

IP addresses

• Embra's edge uses IP addresses in memory (not written to disk) for rate and connection limiting.
• The edge request log line contains no IP (section 5). However, when an app returns an error (for example 502 because it is not running), the edge writes an error line to the server's system journal, which may include the caller's IP, hostname and path with query string. Only the operator can read this journal. This journal has no time-based retention; the oldest lines are deleted when the journal reaches its size limit on the server.
• Embra's control server does not write your IP to its logs. Exceptions: CLI sign-in stores the IP as in section 3; abuse reports store only a one-way HMAC of the reporter's IP (IPv6 by /64 prefix), never the IP itself.
• End-user requests pass through Embra's edge to your app. Your app receives their IP address in the X-Forwarded-For header; what your app stores is your decision.

The embra.cloud website

This website is served through GitHub Pages, so GitHub receives visitors' IP addresses under GitHub's own policy. To count page views, Embra self-hosts Plausible at stats.embra.cloud, which sets no cookies and stores no IPs, as described in the waitlist notice.

8. Who can access data #

Within your workspace

"In person" means a web session, or a token freshly issued through an approved CLI sign-in.

Partner (agency) billing accounts

If your workspace is attached to a partner's billing account, that account's owner and billing-role members can see the workspace's name, plan and amounts, read the consolidated invoices and receive billing emails. Members of a billing account can see each other's emails. Apart from this, other workspaces cannot read your data.

Embra's operator

Currently only the operator named in section 1 has operational access. The operator looks at data when providing support you asked for, reconciling payments, handling abuse reports, handling incidents, or when required by law. There are three access paths, with different levels of visibility:

1. Operator tokens via the API. These tokens require a stated reason. Each time such a token reads logs, log history, metrics, build logs, a database URL, an export, an undo preview, a fork access key or billing information, your workspace's activity history shows an entry with the reason (reads of the same kind within 10 minutes are grouped). If that entry cannot be written, Embra refuses the read. Reads of activity history, the member list or secret names with an operator token are not recorded.
2. Admin commands on the server (embrad admin). These read the control database directly without a token, for example to list members, unmatched transactions (including transfer descriptions), billing account members and abuse reports. This is routine support and reconciliation work. These reads do not appear in your activity history. Sent-email content is masked in this tool unless the operator explicitly asks to reveal it.
3. Direct server or database access when handling infrastructure incidents. This also does not appear in your activity history.

9. Processors and recipients #

The parties below receive or process part of your data when you use Embra. Apart from them, the people in section 8 and destinations you choose yourself (for example an AI client receiving fork data), Embra provides data to others only when required by law. List last updated 2026-11-05.

If Embra adds or changes a party above, Embra updates this page before the change takes effect and gives notice as described in section 18.

Emails Embra sends via Resend

Embra sends the emails below. They are mandatory notices about security, access, data loss and billing, so there is no unsubscribe option. Embra sends no marketing email.

Email content may include workspace, project and environment names, payer name, amounts, invoice numbers, Embra's receiving bank account number and refund references. Emails never contain data from inside your apps.

10. International transfers #

Stays in Vietnam: the control database (primary copy), apps, app databases and files, local backups, logs and metrics.

Leaves Vietnam:

• Transactional email via Resend (United States; sending infrastructure in Japan).
• Sign-in data via GitHub and Google; your IP when your browser loads avatars from GitHub; email you send to hello@embra.cloud via Gmail.
• Operational alerts via Telegram (IDs and amounts only, as in section 9).
• App domain names sent to the certificate authority; DNS queries via Cloudflare.
• Waitlist data and website statistics in Amsterdam, Netherlands.

For each recipient, Embra relies on the terms of service and standard data processing terms that the recipient publishes. For example, Resend's DPA includes Standard Contractual Clauses (SCCs) and a commitment to give notice of sub-processor changes. Under Article 20 of Law 91/2025/QH15, Embra must prepare a cross-border personal data transfer impact assessment and file it with the competent authority. Embra is preparing this assessment and will file it within the statutory deadline.

11. Retention and deletion #

The table shows periods under the system's default configuration. "No automatic deletion yet" means the system does not currently delete that data on its own; it is kept until you ask for deletion and Embra deletes it manually, except what must be kept by law.

When you delete an environment

Embra deletes its Postgres database and volume, buckets, custom domains, uploaded source, log history, raw log files and build logs. Secret values are deleted; only names and versions are kept. This runs in the background and usually finishes within minutes.

Database backups:

• On the server: usually deleted within about 1 minute. Embra deletes this copy only after it has recorded the deletion request at the secondary storage location; if that location is temporarily unreachable, the server copy is kept until the request can be recorded.
• At the secondary storage location (Cloudfly object storage in Hanoi, section 6): deleted by a background queue that retries until done. This usually takes minutes to a few hours, and no longer than 7 days. If a fault prevents deleting this copy within 7 days, Embra tells the owner why and when it expects to finish.

From the moment you delete, these backups are no longer used for restores. What remains after deletion: metrics (up to 30 days), images, build cache (up to 14 days), build records and activity history.

If you need confirmation that data has been deleted, send a request as described in section 13. Embra checks and replies by email: what was deleted, when, and what is still kept and why.

When an owner deletes a workspace

All of the workspace's tokens and sessions are revoked immediately and every environment is deleted as above, including the backup copies at Cloudfly (within 7 days at most). What is kept: members' accounts, the workspace name, the member list, invitations (invited emails), the GitHub App connection (GitHub account name), activity history, the operation journal, build records and billing records (kept for the period required by accounting and tax law). To delete more, send a request as described in section 13.

When a trial expires

The trial lasts 7 days. About 3 days before it ends, the workspace's activity history shows a warning and Embra emails the owner; about 24 hours before, Embra sends another email. When it expires you can no longer sign in or export, and the system automatically deletes the whole workspace and all its environments as above, usually within 10 minutes, then emails the owner. Deleting the backup copy at Cloudfly may finish after that email, within 7 days at most as above. Export anything you want to keep before the trial expires.

Exceptions: the workspace is not deleted automatically if you have transferred money (even an underpayment) for a plan that has not been activated yet, or if the workspace has a suspended environment.

When suspended for abuse

Apps are taken off the Internet and stopped, and the workspace becomes read-only, but data and backups are preserved. Embra does not automatically delete data of a suspended workspace.

Account deletion

The console does not yet offer self-service account deletion. Send a request as described in section 13; the operator deletes or anonymises your account data and tells you what must be kept (for example billing records) and why. Copies in control database backups cannot be deleted individually; they are deleted automatically no later than 10 days after they were made (table above). If the control database ever has to be restored from a backup, Embra deletes again the data you asked to delete before the system goes back into service.

12. Your rights #

Under Article 4 of Law 91/2025/QH15 you have the right to:

• Be informed about the processing of your personal data (this policy).
• Access your data and ask for incorrect data to be corrected.
• Obtain a copy of your data (data portability). You can take your app data yourself with an export; Embra sends you your account and billing data on request.
• Ask for deletion, including deletion of your account.
• Give, refuse or withdraw consent for processing based on consent.
• Ask for processing to be restricted, and object to processing.
• Ask for measures to protect your personal data.
• Complain, denounce, sue and claim compensation as provided by law.

For processing needed to perform the contract or required by law (Article 19), the rights to withdraw consent and to restrict processing do not apply (Law 91/2025/QH15, Article 10(1)). For example, Embra needs an email address and sign-in identity to provide the service, and must keep billing records. When Embra cannot carry out a request, it tells you why.

You can complain to the personal data protection authority under the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention, A05) or through the National Personal Data Protection Portal. If you are in the European Union or the United Kingdom, you can also lodge a complaint with your local data protection supervisory authority.

13. How to exercise your rights #

1. Email hello@embra.cloud from the email address linked to your Embra account, stating your request (access, correction, copy, deletion, withdrawal of consent, restriction, objection) and the workspace concerned. If you write from another address, Embra may ask further questions to verify that you own the account.
2. Embra responds within 2 working days of receiving the request.
3. Embra completes the request within the periods set by Article 5 of Decree 356/2025/ND-CP:

If more time is needed, Embra extends the period at most once, by no more than the original period, and tells you why.

Some things you can do yourself in the console without a request: export an environment, delete an environment, remove members, revoke tokens, delete the workspace (owner).

If you are an end user of an app running on Embra, contact the app's owner, who is the controller of your data. Embra helps the app owner carry out your request.

14. Automated decisions #

When you first sign in with GitHub, the system automatically decides whether to grant a trial: it grants one only if your GitHub account was created at least 30 days ago. The purpose is to limit freshly created accounts used in bulk to abuse free resources. The system reads only your GitHub account's creation date, uses no other data and does not store that date.

If you are refused, you can ask the operator for a human review by emailing hello@embra.cloud. If approved, Embra records an exemption containing your GitHub login and ID, the reason and who granted it.

15. Security #

• Session cookies are stored only as HMACs and tokens only as SHA-256 hashes; Embra does not store the original values. Console cookies are set with Secure and SameSite=Lax, with a separate anti-CSRF cookie.
• App secrets are encrypted with AES-GCM before storage.
• Each environment runs in its own network with its own Postgres.
• The console and API are served over HTTPS; apps on *.onembra.com and custom domains get HTTPS certificates automatically. Plain-HTTP requests to apps are redirected to HTTPS.
• Workspace permissions are role-based, and dangerous actions require a person (section 8). Reads with operator tokens are recorded in the activity history, except as noted in section 8.

No method of protection is completely secure. If you suspect a token has leaked, revoke it in the console immediately and tell Embra.

16. Incidents and breach notification #

When Embra discovers that personal data has been leaked, accessed without authorisation or lost, Embra:

• records the incident in writing and takes remedial measures;
• notifies the personal data protection authority (Department A05, Ministry of Public Security) no later than 72 hours after discovery, under Article 23 of Law 91/2025/QH15 using the form in Decree 356/2025/ND-CP; if the system is attacked in a way that puts consumer information at risk, notifies the competent state authority within 24 hours under Article 19 of Law 19/2023/QH15;
• notifies affected people by email: what happened, which data is affected, possible consequences, what Embra has done and what you should do;
• if the incident affects data inside your apps, notifies the workspace owner so you can meet your own obligations towards your end users.

17. Google user data #

"Sign in with Google" is offered only to people a workspace owner or admin has invited by email.

• Scopes: openid email profile only.
• What Embra keeps: your Google account ID (sub), your verified email address and your name. The access token from Google is used once to read these fields and is never stored.
• Use: solely to sign you in to the workspace that invited you. The workspace's owners and admins see your name and email in the member list; the invited email also appears in the workspace's activity history, which every member and token of that workspace can read.
• No other use: Embra does not use Google user data for advertising, does not sell it, and does not transfer it to others except as needed for security and abuse investigation, or as required by law.
• Deletion: email hello@embra.cloud from the invited address and Embra deletes or anonymises your account data.

Embra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

18. Changes and version history #

When the content changes, Embra updates the "Version" line at the top of the page, adds an entry to the history below and updates this translation. Changes that are less favourable to you (collecting more data, adding recipients, keeping data longer, using it for a new purpose) are announced by email to workspace owners before they take effect.

Version history

1. 2026-11-13Added control database backups: hourly, encrypted on the server, copied to Cloudfly in Hanoi (Cloudfly cannot decrypt them), each copy locked for 7 days and deleted automatically no later than 10 days after it was made. Cloudfly now also receives these encrypted copies. Section 6, the recipients table, the retention table and the account deletion paragraph updated to match.
2. 2026-11-13Corrected how long backups take to delete when an environment or workspace is deleted: the Cloudfly copy within 7 days at most, usually minutes to a few hours (the page previously said deletion "usually finishes within minutes" for everything, which was wrong); the server copy usually within about 1 minute. Added: expired or replaced backup files at Cloudfly are deleted automatically after 7 days; confirmation of deletion by email on request.
3. 2026-11-13Filled in the publication date, the status of the cross-border transfer impact assessment (being prepared) and the retention of billing records (per accounting and tax law). No change to how Embra processes data.
4. 2026-11-05Added Cloudfly: off-server copy of app database backups in Hanoi. Backup section updated to match.
5. 2026-11-01Full rewrite: legal basis per purpose, full English translation, processor table with locations, Resend, international transfers, retention table, deadlines for exercising rights, automated decisions, breach notification. Corrected: CLI sign-in does not store country; default payer name; who can see the member list; operator access through admin commands; deleting staging and preview environments with tokens. A 2026-10-31 draft (adding Resend) was never published and is merged into this version.
6. 2026-10-27First published version.