Privacy Policy

Who We Are

Emberline Holdings Company LLC ("Emberline," "we," "us," or "our") is a Wyoming Close Limited Liability Company. We operate the Emberline Reading Oasis, TMC Prep, IMAT Prep, Vent House, and related digital properties accessible at emberlinegroup.org, books.emberlinegroup.org, tmcprep.emberlineworld.com, and associated subdomains (collectively, the "Services").

This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have regarding your personal data.

Our principal place of business is in San Antonio, Texas. You may contact our Privacy Officer at [email protected].

Information We Collect

Information You Provide Directly

Information Collected Automatically

Information We Do Not Collect

• We do not collect Social Security numbers or government ID numbers
• We do not collect precise geolocation data
• We do not collect biometric data
• We do not collect sensitive health information (outside Vent House clinical intake, which has its own HIPAA-compliant policy)
• We do not knowingly collect any personal information from children under 13 without verifiable parental consent

Children's Privacy (COPPA)

The Emberline Reading Oasis is designed for readers of all ages, including young children. We take children's privacy with the highest seriousness and comply fully with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and the FTC's COPPA Rule, 16 C.F.R. Part 312.

Age Determination

During account registration, we ask whether the account is for a child under 13. If yes, we require a parent or legal guardian email address to provide verifiable parental consent before we activate the child account or collect any personal information from the child.

What We Collect from Children Under 13

With verifiable parental consent, we collect only: (a) a display name chosen by the parent, and (b) reading progress data necessary to provide the reading service. We do not collect email addresses directly from children under 13.

Parental Rights Under COPPA

• Review: You may request to review the personal information we have collected from your child
• Delete: You may request deletion of your child's information at any time
• Refuse Further Collection: You may withdraw consent and refuse further collection of your child's information
• No Conditioning: We do not condition participation on a child providing more personal information than is reasonably necessary

To exercise any of these rights, contact us at [email protected] or [email protected]. We will respond within 72 hours.

No Behavioral Advertising to Children

We do not serve behavioral advertising to users under 13 under any circumstances. We do not share children's data with any advertising networks.

Operator Disclosure

If you are a school, educational institution, or app operator providing Emberline services to children, you may serve as an agent providing parental consent on behalf of parents for school use only. Contact us at [email protected] to establish this relationship.

How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Services: Creating and managing your account, delivering the reading experience, processing book submissions, managing competitions
• Personalization: AI-generated welcome messages, book recommendations, reading progress tracking — using only data you have provided to us
• Communications: Transactional emails (account confirmation, submission updates, competition notifications), and newsletter if you subscribe
• Safety and Moderation: Content review pipeline, flagging system, preventing fraud and abuse
• Legal Compliance: Complying with applicable law, court orders, and legal process
• Analytics: Understanding how the Services are used to improve them — using aggregated, anonymized data only

What We Do Not Do With Your Data

• We do not sell your personal information to third parties — ever
• We do not share your data with advertisers for targeting purposes
• We do not use your data to train AI models sold to third parties
• We do not use children's data for any purpose other than providing the reading service

Anthropic's Claude AI: We use Claude (Anthropic, PBC) to power personalization features (welcome messages, book recommendations). Text you provide may be processed by Anthropic's API. Anthropic's privacy policy governs their processing. We do not send children's personal data to Claude's API — only genre preferences and reading level.

Information Sharing

We share personal information only in these limited circumstances:

• Service Providers: Supabase (database and authentication), Stripe (payments), Resend (email delivery), ElevenLabs (audiobook synthesis), Anthropic (AI personalization). Each is bound by a data processing agreement.
• Legal Requirements: If required by law, court order, or governmental authority — we will notify you to the extent permitted by law
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website
• With Your Consent: We may share information with your explicit consent for purposes not listed here
• Public Profile: If you set your profile to public, your display name, bio, and public gallery submissions are visible to other users

We never sell personal information. We never share personal information with advertisers for targeting purposes. These are hard commitments, not policies that vary by jurisdiction.

Data Retention

We retain your personal information for as long as your account is active, or as needed to provide you the Services. Specifically:

To request deletion of your account and all associated data, email [email protected]. We will complete deletion within 30 days.

Security

We implement industry-standard security measures to protect your personal information:

• All data transmitted between your device and our servers is encrypted via TLS 1.2 or higher
• Passwords are hashed using bcrypt — we never store plaintext passwords
• Database access is controlled via Row-Level Security (RLS) policies — users can only access their own data
• All files uploaded to the platform are stored in access-controlled private storage buckets
• Authentication tokens are short-lived and rotated regularly
• We conduct regular security reviews of our infrastructure

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach affecting your rights, we will notify you within 72 hours of discovery, as required by applicable law.

Your Rights

Regardless of where you live, you have the following rights with respect to your personal information:

To exercise any of these rights, email [email protected]. We will respond within 30 days. We do not charge a fee and will not discriminate against you for exercising your rights.

California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: The categories and specific pieces of personal information we collect, the sources, business purposes, and third parties we share with
• Right to Delete: Request deletion of personal information we have collected about you
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising — this right is already fully honored
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes other than those disclosed in this policy
• Non-Discrimination: We will not discriminate against you for exercising any CCPA rights

To submit a CCPA request: email [email protected] with "CCPA Request" in the subject line. We will respond within 45 days. We may request verification of your identity before processing the request.

Authorized Agent: You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization signed by you.

Categories of Personal Information Collected (past 12 months): Identifiers (name, email); Internet activity (page views, session data); Commercial information (purchase history); Inferences drawn from the above (reading preferences). We have not sold any personal information in the preceding 12 months.

Texas Residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024:

• Right to Access: Confirm whether we process your personal data and access that data
• Right to Correct: Correct inaccuracies in your personal data
• Right to Delete: Delete personal data you have provided or that we have obtained about you
• Right to Data Portability: Obtain a portable copy of your personal data
• Right to Opt-Out: Opt out of processing for targeted advertising, sale of personal data, and profiling. We do not conduct these activities — this right is fully honored as a matter of policy.
• Right to Appeal: If we decline to act on your request, you may appeal that decision. We will respond to appeals within 60 days.

To submit a TDPSA request: email [email protected] with "TDPSA Request" in the subject line.

European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is processed in accordance with the General Data Protection Regulation (GDPR).

Legal Basis for Processing

• Contract: Processing necessary to provide the Services you have requested (account creation, reading features)
• Legitimate Interests: Security, fraud prevention, improving our Services (balanced against your rights)
• Consent: Marketing emails, optional features — which you may withdraw at any time
• Legal Obligation: Compliance with applicable law

International Transfers

Your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for such transfers where required.

Data Protection Rights (GDPR Articles 15–22)

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your local supervisory authority.

Our GDPR contact: [email protected]

Advertising & Social Media

Emberline does not serve advertising within its products. Emberline's platforms are ad-free by design and as a matter of brand commitment.

Our Social Media Presence

We maintain accounts on TikTok, Instagram, Pinterest, and other platforms to promote our products and share content. When you interact with our social media content:

• Each platform's own privacy policy governs how they use your data
• We may see aggregate analytics about post performance but not individual user data beyond what you publicly share
• Boosted/promoted posts on social platforms are labeled with "Paid Partnership" or "Sponsored" disclosures as required by each platform and the FTC

Paid Social Advertising — FTC Disclosures

When we run paid advertising on social media, we comply with FTC Endorsement Guidelines (16 C.F.R. Part 255). All paid promotions include clear disclosures. We do not pay influencers or third parties to endorse our products without clear disclosure of that relationship.

Children and Advertising

We do not use behavioral advertising targeting toward children under 13 on any platform. On TikTok, we comply with TikTok's policies prohibiting behavioral advertising to users under 16. On Instagram/Meta, we comply with Meta's policies restricting advertising to minors.

Remarketing / Retargeting

We do not currently use website-based retargeting pixels that track users across third-party sites. If we implement this in the future, this policy will be updated and you will be given the opportunity to opt out via our cookie consent tool.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate our Services. You may manage your cookie preferences via our cookie consent banner.

Supabase sets session authentication cookies that are strictly necessary. These cannot be disabled without preventing login.

Third-Party Services

We use the following third-party service providers to operate our Services. Each has agreed to process your data only on our behalf and in accordance with our instructions:

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Effective" date at the top of this document
• We will notify registered users via email at least 30 days before the change takes effect
• For changes affecting children's data, we will obtain new parental consent where required by COPPA
• Continued use of the Services after the effective date constitutes acceptance of the updated policy

Prior versions of this policy are archived and available upon request.

Contact Us

For privacy questions, requests, or concerns, contact our Privacy Officer: