Privacy Policy
This Privacy Policy forms part of the Empacer™ ("Empacer") Terms and Conditions and applies to your use of the website at https://www.empacer.com and any other websites, apps, or services through which Empacer is made available to you by Empacer Ltd. ("Empacer Ltd.", "we", "us", "our") and sold to users by the Sellers described in Section 1 (together, the "Service" or "Website").
Empacer is an agentic AI workspace built for small and medium-sized business ("SMB") owners and their teams. Empacer is developed, owned and operated by Empacer Ltd. and is distributed in the United States by Empacer Sky Corp. This Privacy Policy explains what information we collect, how it's used, how it's shared with the third-party AI providers and services that power the product, and what rights and responsibilities apply to you.
By using Empacer, you confirm that any request or instruction you give the AI is authorized by you, and that you have the right to submit any information, including information about your own customers or clients, for processing through the product.
To use the service on the Website, we may ask you to enter information about your age, email address, name and ask other onboarding questions. We also automatically collect from your device: language settings, IP address, time zone, type and model of a device, device settings, operating system. We need this data to provide our services, analyze how our customers use the service and to measure ads.
For improving our service and serving ads, we use third party solutions. As a result, we may process data using solutions developed by Amazon Web Services, Meta, Google, TikTok, Hotjar, Amplitude, Apple, PayPal, FreshDesk, Solidgate, ActiveCampaign. Therefore, some of the data is stored and processed on servers of such third parties. This enables us to: (1) analyze different interactions (how often users make subscriptions, what is the average time spent by users on the service); (2) serve ads (and are able to show them only to a particular group of users, for example, to subscribers).
Consequently, we, in particular, better understand in what of our features and content you see the most value and are able to focus on them to enhance your experience and increase the quality of our products.
TABLE OF CONTENTS
1. Who is responsible for your personal data
3. Your Responsibility for Data About Your Own Customers
6. Third-Party AI Model Providers
8. Actions Empacer Takes On Your Behalf
10. Connected Apps and Intermediary Services
11. Generated Content and Generation Records
12. Data Retention and Deletion
15. International Data Transfers
16. Cookies and Similar Technologies
Who is responsible for your personal data
Empacer Ltd., a company registered under the laws of the Republic of Cyprus with registration number HE 497961, having its registered office at 6 Vasili Vrionidi Str, 5th floor, Limassol, 3095, Cyprus ("Empacer Ltd."), develops, owns and operates the Service and is the controller of your personal data - that is, of the data about you as our user - and the "business" responsible for it under U.S. state privacy laws, except as described below.
Subscriptions bought through our Website, web funnels or apps (other than through the Apple App Store or Google Play) are sold to you by one of the following companies (each a "Seller"):
- Empacer Sky Corp., a corporation incorporated under the laws of the State of Delaware, United States, with registration number 10797891 and registered address at 16192 Coastal Highway, Lewes, County of Sussex, Delaware 19958, United States, our authorized distributor in the United States;
- Empacer Ltd.; and
- Yangtrace Ltd., a company incorporated in Hong Kong with registration number 81329823 and registered address at Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong, an authorized distributor of the Service.
Before you pay, you accept our Terms and Conditions, which name every company that may bill you. The Seller of your first payment, and its country, is shown at checkout, where you agree that your saved card may be stored and charged for your subscription, including renewals, by any of these Sellers. The Seller of each charge is identified, together with the Empacer brand, on your bank or card statement and named in the receipt for that charge. If you subscribe through the Apple App Store or Google Play, the Seller is the Empacer company that publishes the app in that store.
Each Seller is a separate controller of the records of the charges it bills (such as the transaction reference, amount, date, card brand and last four digits, billing country and postal code, and any refund or chargeback), which it uses only to perform its sales contract with you, to meet card network and payment provider rules, for tax and accounting, to comply with the law, and to handle disputes and legal claims. Empacer Ltd. keeps and processes these records on behalf of each other Seller. You can contact us at privacy@empacer.com about data held by any of these companies.
Where you submit data about your own customers, clients or staff, you remain the controller of that data and Empacer Ltd. acts as your processor (see Section 3). No Seller has access to that data.
Information We Collect
- Account information: name, email, business details
- Job application data: we collect your resume and contact details solely for the purpose of evaluating your applications
- Business context: information you provide about your business - services, pricing, schedules, marketing materials, and similar operational data - which Empacer stores as ongoing "memory" so you don't have to re-explain it each session
- Content you submit: documents, images, messages, and records you upload or paste into chats and projects, which may include information about your own customers or clients (for example, contact details, invoices, or references to payment or tax information)
- Text inputs: since Empacer is voice-first, this includes voice input, which we convert to text; we do not keep the audio
- Generated content: the posts, images, drafts and other material Empacer produces at your request, which is stored in your account (see Section 11)
- Generation records: technical metadata about each generation request - a content hash, the prompt, the result of our safety check and the provenance-marking status of the output (see Section 11)
- Usage data: chat and project history, approvals/declines of AI actions, feature usage, and device/log data
- Connected app data: if you connect apps such as your email, calendar, Google Drive, social media, booking or review accounts, the access credentials for those apps and the information Empacer reads from them or sends to them to carry out your tasks (see Section 10)
- Payment information: your subscription and purchase history and limited billing details (for example, the last four digits of your card). Payments are handled by our payment providers on the merchant account of the Seller of each charge for subscriptions bought through our Website, web funnels or apps (other than through the Apple App Store or Google Play) (see Section 1); we do not receive or store your full card number
- Cookies and similar technologies: information collected through cookies, pixels and similar tools on the Website and in the product (see Section 16)
Your Responsibility for Data About Your Own Customers
If you submit personal data belonging to your customers, clients, employees, or other third parties, including sensitive information such as payment card references, tax identification numbers, or personal documents, you are solely responsible for:
- Having a valid legal basis and any consents required from those individuals before sharing their data with Empacer;
- Complying with applicable data protection laws (such as U.S. state privacy laws, GDPR or UK GDPR) with respect to that data.
With respect to this third-party data, Empacer Ltd. acts only as a data processor and service provider, handling it solely to carry out the tasks you request and in line with our Data Processing Agreement.
Legal Bases for Processing
Because Empacer Ltd. is established in the European Union, the GDPR applies to its processing of your personal data wherever you are located. We rely on the following legal bases: performance of our contract with you, to provide and support the Service and to carry out the actions you approve, and to disclose to the Seller of a charge the data it needs to bill you and to handle refunds and chargebacks; our legitimate interests, to secure the Service, prevent misuse, keep the generation records described in Section 11, handle payments, disputes and each Seller's tax obligations and understand how the Service is used; your consent, where we ask for it, for example for analytics and advertising cookies and, where the law requires it, for marketing emails, which you can withdraw at any time; and compliance with a legal obligation, where the law requires us to keep or disclose information.
How We Use Information
We use the information above to:
- Operate Empacer's core features - understanding requests, routing tasks to the right AI specialist, and generating drafts, replies, posts, or analysis;
- Maintain business context ("memory") across sessions;
- Carry out approved actions on your behalf, inside and outside the product (see Section 8);
- Bill subscriptions bought through our Website, web funnels or apps (other than through the Apple App Store or Google Play) through the Seller of each charge, handle refunds and chargebacks, and keep records of your acceptance of the Terms and Conditions and of your consent to recurring charges (including the version you accepted and technical logs), so that we can show them if a charge is disputed;
- Send you service messages about your account and, where the law allows, emails about new features and offers - you can unsubscribe from marketing emails at any time using the link in each email;
- Measure how our ads perform and show Empacer ads to people who may be interested, using the cookies and similar technologies described in Section 16;
- Maintain and improve the security and reliability of the service.
We do not sell your personal data for money, and we do not use the content of your chats or business data to train our own AI models or those of our providers. We do not give the content of your chats, your business data or data from your connected apps to advertisers. Some of our advertising cookies may count as "sharing" under U.S. state privacy laws - see Section 14 for your choices.
Sellers of your subscription. Empacer Ltd. shares with the Seller of each charge (Empacer Sky Corp. or Yangtrace Ltd., see Section 1) only the data that Seller needs to bill you, to handle refunds and chargebacks, and to meet its tax and legal obligations: the records of that charge and, where needed to issue a refund or defend a chargeback, records of your use of and access to the Service. Your name and email address are shared with a Seller only where needed for a specific dispute, request or claim. No Seller receives the content of your chats, your business data, data from your connected apps or data about your own customers. Each Seller may use the data it receives only for these purposes and may not sell it or use it for marketing. Our relationship with each Seller is governed by a data processing agreement.
Third-Party AI Model Providers
Empacer is built on top of third-party large language model ("LLM") providers, currently Anthropic (Claude), Google (Gemini) and OpenAI, some of which we access through OpenRouter, a model-routing service. To generate responses, portions of your inputs are processed by these providers under business-grade agreements (data processing agreements) that require them to:
- not retain your data beyond what is needed to process the request, and
- not use your data to train or improve their own models.
These commitments go beyond the standard public/consumer terms that apply to individual users of general AI chat tools - our agreements with these providers are negotiated business-to-business specifically to protect Empacer users and their customers' data.
To convert your voice input into text, we use Soniox, a speech-to-text provider, which processes the audio on our behalf as our service provider under a data processing agreement. As described in Section 2, we do not keep the audio.
Content Restrictions
Because Empacer is built on third-party models, it inherits their content restrictions: if a request falls outside what the underlying provider allows, Empacer will decline it in the same way the underlying model would.
In addition, and independently of those providers, Empacer does not generate identity documents, passports, other government-issued identification or currency, and does not generate photorealistic images of identifiable individuals, including public figures. These restrictions apply at system level and cannot be switched off in your settings or bypassed by the way a request is worded.
Actions Empacer Takes On Your Behalf
Empacer can:
- Work inside the product - draft content, analyze data, prepare documents, and similar tasks, without leaving Empacer.
- Act outside the product, with your approval - for example, sending a message, reply, or post to your customers through messaging apps, email, or social platforms.
Before any external action, Empacer shows a confirmation prompt with the choice to Approve, Decline, or Edit. No message is sent, no post is published, and no external action is taken without this explicit approval - unless you've separately turned on Autonomous Mode (Section 9).
Autonomous Mode
If you repeatedly approve the same recurring type of action, Empacer may offer to automate it going forward ("Autonomous Mode") so you no longer have to approve each instance. Turning this on requires a separate, explicit opt-in, after we show you a disclosure explaining that:
- Empacer is an AI system and can make mistakes;
- once enabled, that type of action will be taken automatically, without further review;
- by enabling it, you accept responsibility for actions taken under Autonomous Mode.
You can review or turn off Autonomous Mode at any time in your settings.
Connected Apps and Intermediary Services
When Empacer sends information outside the product - to a messaging platform, email provider, or social network - it relies on Composio, a third-party integration service based in the United States, to deliver it. Composio acts as our service provider under a data processing agreement and may use this information only to provide its service to us. Composio does not store the content of what is sent or retrieved, such as messages, emails, or documents. It keeps a technical record of each action, including the type of action, the time, whether it succeeded, and internal identifiers for your connected account, for security and troubleshooting for up to 12 months, after which the record is deleted.
Connecting an app. You decide which apps to connect - for example Instagram, Facebook, LinkedIn, your email, calendar and Google Drive, booking and review platforms, or SMS through Twilio. When you connect an app, you sign in with that app's provider and approve the permissions shown on its screen. The access credentials the provider issues (such as OAuth tokens) are stored by Composio in encrypted form and are used only to carry out tasks you ask for or approve.
What we do with data from connected apps. Empacer reads information from a connected app only when a task needs it - for example, to check your calendar before suggesting a booking time, or to draft a reply to a new review. We do not sell this information, we do not use it for advertising, and we do not use it to train AI models. Each app's provider handles your data in its own service under its own terms and privacy policy.
Disconnecting an app. You can disconnect an app at any time in your settings. When you disconnect it or delete your account, we delete the stored access credentials for that app and ask the app's provider to revoke them, so Empacer can no longer reach it. You can also remove Empacer's access in the app's own security settings, for example for Google at myaccount.google.com/connections.
Google user data. Empacer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the Empacer features you use, we do not use it for advertising, and we do not use it to develop or train general-purpose AI or machine-learning models.
A current list of the service providers that process personal data for us, including Composio and our AI model providers, is available in Annex 1 to our Data Processing Agreement or on request at privacy@empacer.com.
Generated Content and Generation Records
Generated content. Posts, images and other material Empacer produces at your request are stored in your account so you can find, reuse and edit them. You can delete individual items - a single image, a single chat, or a whole project - at any time, without deleting your account. Deletion removes the item from our active systems immediately; copies held in routine backups are overwritten in the ordinary course of the backup cycle.
Generation records. Separately from the content itself, we keep a short internal record of each generation request containing a content hash, the prompt, the result of our safety check and the provenance-marking status of the output. We keep this record as controller, in our legitimate interests, to detect misuse of the Service and to establish, exercise or defend legal claims - for example if someone later disputes what was generated. These records are kept for 90 days and are then deleted. They are not shared with other customers, are not used for advertising, and are not used to train any model. Deleting content from your account does not delete this record before that period expires.
Data Retention and Deletion
Your business and customer data is retained for as long as the related chat, project, or account remains active, so Empacer can maintain useful context. When you delete a chat, a project, or your account, the associated data is deleted from our systems. You do not have to delete everything at once: individual items, including single images and single conversations, can be deleted separately. When you delete your account, we delete the associated data from our active systems within 30 days.
Two things outlive the deletion of an item: the generation records described in Section 11, which are kept for their stated period, and copies held in routine backups, which are overwritten in the ordinary course of the backup cycle. We may also keep information for longer where the law requires it, in which case we isolate it and use it only for that purpose.
Some information follows its own timeline:
- access credentials for connected apps are deleted when you disconnect the app or delete your account (see Section 10);
- billing and transaction records are kept by the Seller of each charge for as long as tax and accounting laws require and card network rules require, in principle for no longer than seven years after the end of the tax year of the charge; support correspondence about a charge may be kept as part of those records for the same period, even if you ask us to delete your other data;
- if you unsubscribe from marketing emails, we keep your email address on a suppression list so that we do not email you again;
- information collected through cookies and similar technologies is kept for the periods set out in our Cookie Notice (see Section 16).
Security
We are responsible for the security of data within Empacer's own systems — including encryption, access controls, and monitoring for unauthorized access. No system can guarantee absolute security, but we take reasonable, industry-standard measures to protect your information. If a security incident affects your personal data, we will tell you and the relevant authorities where the law requires us to.
Your Rights
Depending on where you're located (e.g., under U.S. state privacy laws, GDPR in the EU, or UK GDPR), you may have rights to access, correct, delete, or export your data, and to object to or restrict certain processing, and to withdraw consent where our processing is based on it. To exercise these rights, contact us at privacy@empacer.com, including for data held by any Seller.
You can exercise some of these rights yourself inside the product, by deleting individual items, conversations or projects, or your whole account.
Where you have given us data about your own customers, requests from those individuals are handled by you as the controller. If one of them contacts us directly, we will tell you and, where appropriate, direct them to you.
Automated decisions. Empacer prepares drafts, analysis and suggested actions for you to review, and external actions need your approval unless you have turned on Autonomous Mode (see Sections 8 and 9). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Additional information for U.S. residents. Depending on the state you live in, you may have the right to know what personal information we collect about you and how we use and disclose it; to access, correct or delete it; to get a copy in a portable format; and to opt out of the sale or sharing of your personal information and of targeted advertising. We will not treat you differently for using these rights.
For these laws, Empacer Ltd. is the "business" for your personal information, and each Seller is a separate business only for the records of the charges it bills. Disclosures to a Seller are made to perform your purchase contract with it and are not a "sale" or "sharing" of your personal information.
We do not sell personal information for money. We do use advertising cookies and pixels from providers such as Meta, Google and TikTok to measure our ads and to show Empacer ads to people who may be interested (see Section 16). Under some state laws, including California's, this can count as "selling" or "sharing" personal information. You can opt out using the "Your Privacy Choices" link on the Website, or by turning on Global Privacy Control in your browser, which we treat as an opt-out request. We do not knowingly sell or share the personal information of anyone under 16.
To make a request, email privacy@empacer.com. We will need to confirm your identity before we act on it, and you can ask an authorised agent to make a request for you. If we refuse your request, you can appeal by replying to our answer; if you are not satisfied with the outcome, you can contact your state Attorney General. For data you have given us about your own customers, Empacer Ltd. acts as your service provider (see Section 3).
Additional information for users in the EEA and the UK. If you are not satisfied with how we have handled your data, you also have the right to complain to the data protection authority in the country where you live or work, or, in the UK, to the Information Commissioner's Office. Empacer Ltd. is supervised by the Commissioner for Personal Data Protection of the Republic of Cyprus.
International Data Transfers
Empacer Ltd. is established in Cyprus, and our Service data is hosted by Amazon Web Services in the United States. Data about the charges a Seller bills is made available to that Seller: Empacer Sky Corp. in the United States and Yangtrace Ltd. in Hong Kong. Some of the providers we rely on to deliver the Service, including our AI model providers and the intermediary service described in Section 10, are located mainly in the United States. If you use the Service from outside the United States, your data will be transferred to the United States, where data protection laws may differ from those in your country. For these transfers we use the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where UK data protection law applies, and we assess the laws of the receiving country. For service providers certified under it, we may also rely on the EU-U.S. Data Privacy Framework. Before personal information of residents of Québec is communicated outside Québec, we carry out the assessment required by Québec law. You can ask us for a copy of the safeguards that apply by writing to privacy@empacer.com.
Cookies and Similar Technologies
We use cookies, pixels, SDKs, local storage and similar technologies on the Website and in the product. Some are set by us, and some by the providers whose tools we use, including Google, Meta, TikTok, Hotjar and Amplitude. We use them for three purposes:
- Strictly necessary: to sign you in, keep the Service secure, prevent fraud, process payments and remember your cookie choices. These are always on, because the Service cannot work without them;
- Analytics: to understand how the Website and the product are used - for example, which pages and features people use and where they get stuck. Some of these tools can record how you move around a page;
- Advertising: to measure our ad campaigns and to show Empacer ads to people who may be interested, including people similar to our existing users.
Your choices. You can turn off advertising technologies through "Cookie settings" or the "Your Privacy Choices" link on the Website, and we treat a Global Privacy Control signal from your browser as an opt-out where the law requires. Our Service does not respond to other "Do Not Track" browser signals. If you are in the EEA or the UK, we use analytics and advertising technologies only after you agree to them in our cookie banner; refusing is as easy as accepting, and you can change your choice at any time. You can also block or delete cookies in your browser settings, but some parts of the Service may then stop working.
Children's Privacy
Empacer is built for business owners and their teams and is not directed at children. We do not knowingly collect personal data from individuals under 18.
Changes to This Policy
We may update this Privacy Policy from time to time. We'll notify you of material changes through the product or by email.
Date of Last Revision: November 6, 2026
Contact Us
Empacer Ltd. (controller), 6 Vasili Vrionidi Str, 5th floor, Limassol, 3095, Cyprus, registration number: HE 497961
Empacer Sky Corp. (Seller in the United States), 16192 Coastal Highway, Lewes, County of Sussex, Delaware 19958, United States, registration number: 10797891
Yangtrace Ltd. (Seller), Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong, registration number: 81329823
Email: privacy@empacer.com
© Empacer Ltd. 2026. All rights reserved. Empacer is distributed in the United States by Empacer Sky Corp. under license from Empacer Ltd.