Privacy Policy

1.1 Information you provide

• Registration data: name, email address, and password.
• Profile information: profile picture, job title, company or organization.
• Billing data: payment information securely processed via Stripe. Emille does not store credit card numbers.
• Generated content: notes, tasks, projects, files, CRM contacts, financial transactions, and any other data you enter into the platform.
• Communications: support messages, comments, and feedback you send us.

1.2 Informacion recopilada automaticamente

• Usage data: pages visited, features used, frequency and duration of sessions.
• Device data: browser type, operating system, screen resolution, and device identifiers.
• Connection data: IP address, internet service provider, and general location (country/city).
• Cookies and similar technologies: we use essential cookies for platform operation and analytical cookies to improve the experience.

1.3 Third-party information

• Authentication services: if you log in with Google or other providers, we receive your name, email, and profile picture.
• Integrations: data from services you voluntarily connect (Google Drive, calendar, etc.).

We use your information exclusively for the following purposes:

• Service provision: operate, maintain, and improve the Emille platform and all its functionalities (Drive, CRM, Finance, Tasks, Notes, Projects, Calendar, AI).
• Personalizacion: tailor the experience to your preferences, including AI assistant recommendations.
• Comunicacion: send you system notifications, security alerts, product updates, and reminders you have configured.
• Facturacion: process payments, manage subscriptions, and send receipts.
• Security: detect, prevent, and investigate fraudulent activities, abuse, or security threats.
• Product improvement: analyze aggregated and anonymized usage patterns to develop new features and improve existing ones.
• Support: responding to your support requests and resolving technical issues.
• Legal compliance: comply with applicable legal, regulatory, and tax obligations.

Emille integrates artificial intelligence features to enhance your productivity. It's important that you understand how your data is handled in this context:

• Contextual processing: el asistente de IA puede acceder al contenido de tu workspace (notas, tareas, archivos) unicamente para proporcionarte respuestas y sugerencias relevantes dentro de tu sesion.
• No training with your data: your data is never used to train third-party artificial intelligence models. Your information is yours.
• AI Providers: we use third-party AI services (such as Anthropic and OpenAI) that process data in real-time. These providers are subject to strict confidentiality agreements and do not retain your data.
• User control: you can opt out of using AI features without affecting access to other platform functionalities.

Emille connects to Google Workspace (Calendar, Drive, Docs, Sheets, Slides and Gmail) only with your explicit consent, and only through the permissions you approve on the Google consent screen. Our use of data received from Google APIs is governed by the Google API Services User Data Policy, including its Limited Use requirements.

4.1 Artificial intelligence and Google data

• No model training: we do not use, transfer, or sell Google user data — raw, aggregated, or derived — to create, train, or improve foundational or generalized artificial intelligence or machine learning models, whether our own or those of any third party.
• Processing only at your request: when you ask the assistant to work with a Google document, spreadsheet, presentation or calendar event, that content is sent to our AI providers solely to produce your answer in that session, and only for the user-facing feature you requested.
• Providers under contract: our AI providers are contractually bound not to retain, review, or train on data sent through their APIs. We do not send Google user data to any model that is trained on customer inputs.
• No advertising or profiling: we never use Google user data for advertising, ad targeting, credit scoring, lending, or to build user profiles for third parties, and we never sell it.
• No human reading: no Emille employee reads your Google data, except with your explicit consent, when strictly necessary for security purposes or to investigate abuse, or when required by applicable law.

4.2 Permissions we request

We request only the minimum permissions each feature needs, and each one is used solely to provide that feature:

• calendar, calendar.events -> read and manage your calendar events, so you can see and schedule meetings inside Emille.
• drive.file -> access only the files you create with Emille or explicitly open through the file picker. We do not have access to the rest of your Drive.
• documents, spreadsheets, presentations -> create and edit the documents, spreadsheets and presentations you work on within Emille.
• gmail.send -> send email on your behalf when you explicitly ask for it. This is a send-only permission.

We do not request restricted scopes: we cannot read your inbox, and we cannot browse your Drive beyond the files you open with us.

4.3 Revoking access

You can disconnect Google at any time from Settings → Connections in Emille, or from myaccount.google.com/permissions. When you revoke access we delete the stored tokens and stop all synchronization; any data derived from Google that we still hold is deleted within 30 days.

• Cifrado en transito: all communications between your browser and our servers are protected with TLS 1.3 (HTTPS).
• Encryption at rest: your data is stored encrypted on secure servers provided by Supabase (PostgreSQL) and Amazon Web Services (S3).
• Autenticacion segura: we implement JWT token-based authentication, with support for multi-factor authentication (MFA).
• Access control: we apply Row Level Security policies in the database to ensure that you only access your own data and that of your authorized workspaces.
• Backups: we perform daily automatic database backups with a 30-day retention period.
• Infrastructure: our services are hosted in data centers with SOC 2, ISO 27001 certification and GDPR compliance.
• Files: files uploaded to Drive are stored on Amazon S3 with temporary pre-signed URLs, ensuring that only authorized users can download them.

We do not sell, rent, or commercialize your personal data. We only share information in the following limited cases:

• Service providers: we share strictly necessary data with providers who help us operate the platform (Stripe for payments, AWS for storage, Supabase for database, AI providers for processing).
• Within your organization: los datos de workspaces compartidos son visibles para los miembros del workspace segun los permisos y roles configurados por el administrador.
• Obligacion legal: we may disclose information if required by law, court order, or valid legal process.
• Protection of rights: we may share information when necessary to protect the rights, property, or safety of Emille, our users, or others.
• With your consent: in any other case, we will request your explicit consent before sharing your data.

• Active account: we retain your data as long as your account is active and you have a current subscription.
• Trash: files moved to the Drive trash are automatically deleted after 30 days.
• Account Cancellation: upon requesting the deletion of your account, all your personal data and content will be permanently deleted within 30 days, except for information we are required to retain due to legal or tax obligations.
• Billing Data: we retain transaction records for the period required by law (generally 5 years for tax purposes).
• Security logs: access and security logs are retained for a maximum of 90 days.

You have the following rights regarding your personal data, in compliance with applicable legislation (including GDPR, LFPDPPP, and similar laws):

• Access: you can request a copy of all personal data we hold about you.
• Rectificacion: you can correct inaccurate or incomplete data directly from your profile or by requesting it from support.
• Eliminacion: you can request the deletion of your account and all associated data.
• Portability: you can export your data in standard formats (CSV, JSON) from the platform.
• Oposicion: you can object to the processing of your data for specific purposes, such as marketing communications.
• Revocacion: you can revoke third-party integrations and access permissions at any time from the settings.
• Restriccion: you can request that we limit the use of your data while a dispute is being resolved.

To exercise any of these rights, contact us at privacy@emille.ai. We will respond within a maximum of 30 days.

Essential cookies

Necessary for the basic functioning of the platform: authentication, session preferences, and security. They cannot be disabled.

Cookies analiticas

They help us understand how the platform is used to improve the experience. We use tools like Vercel Analytics. You can opt out.

Local storage

Utilizamos localStorage y sessionStorage del navegador para mantener tu sesion, preferencias de interfaz (tema, vista del Drive, workspace seleccionado) y cache de datos para mejorar el rendimiento.

Emille is not directed at children under 16. We do not intentionally collect information from minors. If we discover that we have collected data from a minor, we will delete it immediately. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@emille.ai.

Your data may be processed and stored on servers located in the United States and other jurisdictions. When we transfer data outside your country of residence, we ensure that adequate safeguards are in place, including standard contractual clauses and compliance with applicable regulatory frameworks (GDPR, Privacy Shield, etc.).

In the event of a security breach affecting your personal data, we commit to notifying you by email and through a notice on the platform within 72 hours of discovering the incident. The notification will include the nature of the incident, the affected data, the measures taken, and recommendations to protect you.

We may update this privacy policy periodically to reflect changes in our practices, the platform, or applicable legislation. We will notify you of significant changes by email or a prominent notice on the platform at least 30 days before they take effect. Your continued use of Emille after such changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests related to this privacy policy or the handling of your data, you can contact us via:

• Email: privacy@emille.ai
• In-platform support: Settings Section -> Support

We commit to responding to all requests within 30 business days.