Privacy Policy

Effective September 2026 · Drawbridge Automations LLC, doing business as Emberway

Who we are

Emberway is provided by Drawbridge Automations LLC, doing business as Emberway (“Emberway”, “we”). Emberway is a relationship-engagement platform used by organizations to coordinate outreach by their staff and volunteers.

Who is responsible for the data

Organizations own the records they load into Emberway. For that data, the organization is the controller and Emberway processes it only on the organization's behalf and instructions. Each organization is responsible for having a lawful basis to collect and upload the data it puts into Emberway. For the account information of the team members who use Emberway, Emberway is responsible.

Data we process

On behalf of each organization: contact information (names, emails, phone numbers, addresses), engagement history, responses submitted through engagement portals, and fields the organization chooses to import from spreadsheets or connected systems such as their CRM. For team members (staff and representatives): account email, role, phone number for notifications, and activity within the product.

CRM connections

When an organization connects a CRM (such as Attio or Insightly), Emberway reads the records and field definitions needed for the imports the organization requests. If the organization sets it up, Emberway can also update specific fields in the CRM — for example, when someone responds through an engagement portal. Access credentials are stored encrypted and can be revoked at any time from the CRM or from Emberway.

Email and contacts

Team members can choose to connect a Google or Microsoft account. Emberway can then read their saved contacts and the people they've emailed, so they can pick who to import — only the people they choose are added. If they also connect their mailbox, Emberway reads the emails exchanged with a specific person when they view that person: sender, recipients, subject, date, and a short preview, plus the full message when they open it. This mail is saved so it loads quickly, is visible only to the team member who connected the mailbox, and is deleted when they disconnect. Emberway never sends, changes, or deletes anything in a mailbox, and does not access calendars.

Google user data

When a team member connects a Google account, Emberway receives Google user data only for the features they turn on:

Emberway does not request or use Google Drive, Calendar, send, modify, or delete permissions. Emberway never sends, changes, or deletes anything in a Google mailbox or Google Contacts.

We use this Google user data only to provide and improve those user-facing features for that team member and their organization (importing chosen contacts into relationship records, and showing email history with a specific person). We do not use Google user data for advertising, lending, credit decisions, or sale or transfer to data brokers or information resellers.

Raw Google user data (including Gmail content) is visible only to the team member who connected the account. Mail retrieved from Gmail is cached so it loads quickly, and that cache is deleted when they disconnect Google or Gmail. Emberway does not transfer raw Google API data (including Gmail content or People API contact dumps) to third-party AI providers. Once a contact is imported into an Emberway relationship record, that record is treated like other organization data under this policy.

Emberway’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Protection: Google connection credentials are stored encrypted. Google user data is encrypted in transit and at rest with the rest of the organization’s Emberway data. Retention and deletion follow the Leaving Emberway & deletion section, and mailbox cache deletion on disconnect as described above. Organizations and members can disconnect Google at any time from Emberway or from their Google account permissions.

Notifications

Emberway sends team members reminders and updates by email and, if they opt in, by WhatsApp. These messages can include the name of the person they're working with. Messages go to team members. If an organization turns on auto-send and a rep opts in, a workflow can also email people in the organization's records directly. Replies sent over WhatsApp are saved so they can update the relationship.

AI features

Some features use AI to write summaries, suggest next steps, match people with reps, and help build engagement portals, scoring, and workflows. To do this, Emberway sends the relevant Emberway record details — such as name, stage, notes, and history — to our AI provider, Anthropic. Raw Google API data (including Gmail content and contact dumps pulled from Google) is not sent to AI. Once a team member imports a contact into Emberway, that relationship record may be used by AI features like other organization records. Customer data is not used to train or improve AI models, and under our agreement with our AI provider, it does not use this data to train its models.

Home value lookups

If an organization uses home-value lookups, Emberway sends a record's street address to a property-data service to get estimated home values. Organizations can choose to show reps a range instead of the exact figure.

Service providers

Emberway uses these subprocessors to run the service:

What we don't do

We do not sell personal data. We do not use organizational data for advertising. We do not process payments or store financial account credentials. For Google user data specifically, we do not use that data for advertising, for lending or credit decisions, or for sale or transfer to data brokers or information resellers, and we adhere to Google’s Limited Use requirements as stated under Google user data.

Security

Each organization's data is kept separate from every other organization's, and is encrypted in transit and at rest. Connection credentials are held in an encrypted vault. Every change to a relationship is recorded in a history log. If we confirm a security breach affecting an organization's data, we will notify that organization without undue delay.

Leaving Emberway & deletion

After an organization cancels, it can export its data as CSV for 30 days. We delete the organization's data within 30 days after that export window closes. Organizations can also request deletion of their data at any time.

Questions

Contact barrett@emberway.ai with privacy questions or requests.