LexVibe

Privacy Policy

Embals · Last updated: 2026-08-02

Last updated: 2026-08-02

Introduction and Data Controller

This Privacy Policy explains how Embals ("Embals", "we", "us" or "our") processes personal data in connection with our website (the "Service"). It applies to visitors and users in the European Union and the United States, and reflects our obligations under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy Directive, and, for U.S. residents, the California Consumer Privacy Act as amended by the CPRA and the comprehensive state privacy laws listed at the end of the relevant sections.

Data Controller: Embals Registered name and address: [to complete: registered legal name and registered address of the controller] Privacy contact: marcosnovo@gmail.com

For any question about this Policy or to exercise your rights, you may contact us at the email address above.

Personal Data We Collect

We operate a website and keep data collection to a minimum. We do not operate user accounts or login methods, we do not collect email addresses or contact details through the Service, we do not process payments, and we do not access device permissions.

The only category of personal data we process is:

  • Technical and usage data: information generated automatically when you access the website, such as IP address, browser type and version, device and operating system information, referring pages, and interaction data (pages viewed, timestamps). This data is limited and used to deliver and secure the website.

We do not knowingly collect special categories of data (Article 9 GDPR) and we do not collect data from children. Our Service is not directed to minors under the age of 16 (or the lower age of digital consent set by an EU Member State, and 13 under COPPA in the United States).

We process technical and usage data for the following purposes:

  • Providing and operating the website — delivering requested pages and ensuring the Service functions correctly. Legal basis: performance of a contract or steps taken at your request (Article 6(1)(b) GDPR).
  • Security, integrity and abuse prevention — protecting the Service against fraud, misuse, technical faults and unauthorized access. Legal basis: our legitimate interest in keeping the Service secure and available (Article 6(1)(f) GDPR).
  • Aggregate, privacy-friendly usage measurement — understanding overall traffic and performance without identifying individuals. Legal basis: our legitimate interest in maintaining and improving the Service (Article 6(1)(f) GDPR); where required by applicable ePrivacy rules, your consent through the consent banner.

Where we rely on legitimate interest, you have the right to object under Article 21 GDPR. Any non-essential cookies or similar technologies are described in the consent banner presented on the website, where you can accept, refuse or adjust your choices; strictly necessary technologies do not require consent.

Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations (Article 13(2)(a) GDPR).

  • Technical and usage data is kept for the period necessary for security, troubleshooting and aggregate measurement, after which it is deleted or anonymized.
  • Server and security logs are retained for a limited period appropriate to their security purpose.

Where a specific statutory retention period applies, we keep the relevant data for that legally required period. When data is no longer needed, we delete it or irreversibly anonymize it.

Recipients and Processors

We do not sell or share your personal data and we do not disclose it to third parties for their own purposes. We rely on the following categories of service providers acting as processors on our behalf, under Article 28 GDPR data processing agreements:

  • Supabase — hosting and backend infrastructure for the website.
  • Plausible — privacy-friendly, aggregate website analytics that does not rely on advertising identifiers or cross-site tracking.
  • Email form provider — processing of any message you voluntarily submit through a contact form, where applicable.

These processors act only on our documented instructions and are bound by confidentiality and security obligations.

International data transfers (Articles 44–49 GDPR). Where a processor stores or processes data outside the European Economic Area, we ensure an adequate level of protection through an adequacy decision of the European Commission or, in its absence, appropriate safeguards such as the Standard Contractual Clauses adopted by the Commission, together with supplementary measures where necessary. You may request information about the safeguards in place at the contact address above.

International Data Transfers and Safeguards

Embals relies on the following processors to operate its Web service: Supabase (database and hosting infrastructure), Plausible (privacy-focused, cookieless usage analytics), and an email form provider. Where any of these processors stores or processes data outside the European Economic Area (EEA), such transfers are carried out only under the safeguards required by Chapter V of the GDPR (Articles 44–49).

In practice, this means transfers occur either (i) to a country covered by a European Commission adequacy decision under Article 45, or (ii) on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c), supplemented where necessary by additional technical and organisational measures following a transfer impact assessment. You may request further information about the specific safeguards applicable to a given processor, or a copy of the relevant clauses, by contacting us at marcosnovo@gmail.com.

Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. Given that we process only technical and usage data, these measures include encryption of data in transit (TLS), access controls limiting access to authorised personnel, use of reputable infrastructure providers (Supabase) that maintain their own security certifications, and analytics that are privacy-preserving and do not rely on cookies or cross-site identifiers (Plausible).

No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. We review our measures periodically and require our processors, by contract, to maintain equivalent safeguards.

Notification of Security Breaches

In the event of a personal data breach, Embals will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR, unless the breach is unlikely to result in a risk to your rights and freedoms.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also communicate it to you without undue delay, in clear and plain language, as required by Article 34 of the GDPR, describing the nature of the breach, its likely consequences and the measures taken to address it. For users in the United States, we will additionally comply with any applicable state breach-notification laws.

Your Rights by Jurisdiction and How to Exercise Them

Users in the European Union / EEA (GDPR, Articles 15–22). You have the right to: access your personal data (Art. 15); rectify inaccurate data (Art. 16); erase your data (Art. 17); restrict processing (Art. 18); data portability, i.e. to receive the data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible (Art. 20); and object to processing carried out on the basis of legitimate interest (Art. 21). Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects (Art. 22); we do not carry out such decision-making.

Users in California (CCPA/CPRA, Cal. Civ. Code §1798.100 et seq.). You have the right to know what personal information we collect and how we use it, the right to delete personal information, and the right to correct inaccurate personal information. In the twelve months preceding the effective date of this policy, the only category of personal information we have collected is internet or other electronic network activity / technical and usage data (e.g. aggregated, cookieless analytics via Plausible). We have not sold and have not shared personal information for cross-context behavioural advertising, we do not use advertising identifiers, and we do not engage in cross-app or cross-site tracking. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" opt-out mechanism is required or offered. You may also exercise these rights free from discrimination.

Users in other U.S. states (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Oregon OCPA, Montana MTCDPA, Florida FDBR, Iowa ICDPA, Tennessee TIPA, Delaware DPDPA, Nebraska NDPA, New Hampshire NHCDPA, New Jersey NJDPA, Minnesota MCDPA, Maryland MODPA). You have the rights to access, correct, delete and obtain a portable copy of your personal data, and to opt out of the sale of personal data and of targeted advertising. We do not sell personal data, do not conduct targeted advertising, and do not carry out profiling with legal or similarly significant effects; accordingly, those opt-out rights do not apply to any processing we perform.

Children. Our Web service is not directed to children. We do not knowingly collect personal data from children under 16 in the EU (or the lower age set by an applicable Member State, down to 13) or from children under 13 in the United States (COPPA). If we learn that we have collected such data, we will delete it.

How to exercise your rights. Send a request to marcosnovo@gmail.com. We will respond within the timeframes set by applicable law (one month under the GDPR, extendable by two further months for complex requests; 45 days under U.S. state laws, extendable as permitted). We may need to verify your identity before acting on a request. Authorised agents may submit requests on your behalf where the applicable law so allows.

Complaints to the Competent Supervisory Authority

EU / EEA users. Without prejudice to any other remedy, you have the right under Article 77 of the GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement — for example, the Agencia Española de Protección de Datos (AEPD) in Spain or the CNIL in France. You may also seek a judicial remedy under Articles 78–79 of the GDPR. We would appreciate the opportunity to address your concerns directly at marcosnovo@gmail.com before you do so.

California users. You may file a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General regarding our processing of your personal information.

Other U.S. state users. You may contact the Attorney General of your state of residence to raise concerns about our compliance with the applicable state privacy law.

Changes to This Policy and Effective Date

We may update this Privacy Policy to reflect changes in our services, technical practices, or applicable law. The version in force is identified by the effective date shown at the top of this document. The current version is effective as of 2026-08-02.

When we make material changes—such as introducing a new purpose of processing, a new legal basis, or a change affecting your rights—we will publish the updated policy on this website before the change takes effect and, where required by law, provide more prominent notice. We encourage you to review this policy periodically. Your continued use of Embals after the effective date of an updated version constitutes acknowledgment of the revised policy, except where your consent is legally required, in which case we will obtain it before relying on the new processing.

We retain prior versions of this policy for our records so that the terms applicable at any given time can be identified.

Contact

For any question regarding this Privacy Policy or the processing of your personal data, and to exercise your rights, you may contact the data controller:

  • Data controller: Embals
  • Registered name and address: [to complete: legal name and registered address of the controller]
  • Privacy contact: marcosnovo@gmail.com

Exercising your rights (EU/EEA). Under the GDPR (Articles 15–22), you may request access, rectification, erasure, restriction of processing, objection, and data portability by contacting us at the address above. We respond within one month of receipt, extendable by two further months where necessary given the complexity or number of requests, and we will inform you of any such extension. If you consider that our processing infringes data protection law, you have the right (GDPR Article 77) to lodge a complaint with the supervisory authority of your Member State of residence, place of work, or place of the alleged infringement (for example, the AEPD in Spain or the CNIL in France), without prejudice to any other remedy.

Exercising your rights (United States – California and other state laws). California residents may exercise their rights to know, delete, and correct their personal information under the CCPA/CPRA, and residents of other U.S. states with applicable privacy laws may exercise the equivalent rights granted to them, by contacting us at marcosnovo@gmail.com. Embals does not sell or share personal information as those terms are defined under the CCPA/CPRA, does not use cross-context behavioral advertising, and does not track users across other apps or websites; accordingly, no "Do Not Sell or Share My Personal Information" mechanism is required. We will not discriminate against you for exercising your rights. Where our verification of a request is necessary, we may ask for information sufficient to confirm your identity, used solely for that purpose. California residents may also contact the California Privacy Protection Agency (CPPA) or the California Attorney General regarding their rights.

⚖️ This document was generated 100% by AI against current regulations and has not been reviewed by a human lawyer. It does not constitute legal advice; for specific cases, consult a qualified lawyer.

This document is written against the following frameworks. Each one links to its official text so you can check it yourself.