Privacy Policy

1. Scope and who is responsible

This Privacy Policy applies to emberfare.com, EMBERFARE email alerts and newsletters, EMBERFARE-owned social publishing integrations, and the EMBERFARE YouTube Publisher used to publish content to EMBERFARE's YouTube channel.

For processing described in this notice, EMBERFARE is the controller, business, or organization responsible for the personal information where those concepts apply. Privacy requests can be sent to [email protected].

This notice is designed as a global baseline. Specific rights and duties depend on where you live and whether a particular law applies to EMBERFARE, including the EU GDPR, UK GDPR and PECR, Canadian privacy and anti-spam laws, and applicable United States state and federal privacy laws.

2. Personal information we process

We do not ask you to provide sensitive categories of personal information for normal use of EMBERFARE. Please do not send sensitive information unless it is necessary for a specific request.

3. Why we use information and our legal bases

We use personal information to operate and secure EMBERFARE; remember privacy choices; display and improve flight-deal content; measure product performance; understand campaign effectiveness; provide requested newsletters and alerts; process unsubscribe and privacy requests; prevent abuse; maintain records required by law; and operate authorized publishing integrations.

Where the EU GDPR or UK GDPR applies, our legal bases depend on the activity:

• Consent for optional analytics, optional marketing technologies and direct email marketing where consent is required. Consent can be withdrawn at any time.
• Performance of a contract or steps at your request where processing is necessary to provide a feature or service you specifically request.
• Legitimate interests for proportionate security, fraud prevention, service reliability, basic operational logging and improving EMBERFARE where those interests are not overridden by your rights.
• Legal obligation where we must retain or disclose information to comply with applicable law, regulation, court order or valid legal process.

4. Cookies, analytics and advertising measurement

Essential storage is on by default. It includes the first-party consent cookie used to remember your privacy choices. Optional storage starts denied.

Google Analytics 4 / Google tags. EMBERFARE uses Google measurement tools to understand visits and product usage. Analytics storage remains denied until you allow Analytics. Google Consent Mode may send limited, cookieless consent-state or measurement signals while storage is denied, depending on Google's implementation. We do not intentionally send free-text form contents to analytics.

Meta Pixel. The Meta Pixel is not requested by EMBERFARE until you allow Marketing. If enabled, Meta may receive online identifiers, browser/device information, page/campaign context and event data for campaign measurement, attribution and advertising purposes.

You can change these choices at any time using Privacy & cookies. Rejecting optional technologies does not block access to the core EMBERFARE site.

EMBERFARE does not sell personal information for money. Where applicable law treats optional advertising-related disclosures as a “sale,” “sharing,” or use for targeted advertising, disabling Marketing is the primary on-site method to opt out of that optional processing.

5. Email alerts and newsletters

Email subscriptions are opt-in. Depending on the production configuration, we may use confirmation/double-opt-in before activating a subscription. We keep consent and lifecycle records so that we can prove a request, prevent accidental re-subscription and honor unsubscribe, bounce and complaint states.

Every marketing email we send is intended to provide a clear unsubscribe method. Unsubscribe requests are processed without unnecessary delay. We do not require you to create an account to unsubscribe.

For Canadian recipients, we apply consent, sender-identification and unsubscribe requirements where Canada's Anti-Spam Legislation (CASL) applies. For United States commercial email, we apply applicable CAN-SPAM requirements, including honoring valid opt-out requests.

6. Service providers, affiliate links and external sites

We may use providers that host infrastructure, deliver email, provide analytics, measure advertising, protect the service, or support other operational functions. They may process personal information on our behalf or under their own terms depending on the service.

EMBERFARE also links to booking, airline, charter, tour-operator and affiliate partners. A booking link may include route, date, deal, campaign or referral parameters needed to open the relevant offer and attribute a referral. Once you follow an external link, the destination's own privacy policy and terms apply to its collection and use of information.

Examples of third-party services used by or linked from EMBERFARE may include Google services, Meta, Aviasales/Travelpayouts, airlines, tour operators and email-delivery providers. The exact provider set can change as the service evolves.

7. YouTube API Services and Google user data

The EMBERFARE YouTube Publisher uses YouTube API Services to upload EMBERFARE video content to an authorized YouTube channel. The application requests the minimum upload authorization needed for that function (the youtube.upload scope) and does not request your YouTube password.

For this integration we may store OAuth authorization tokens and limited YouTube API data, such as the authorized channel context, video/upload identifiers, status and response metadata, only as needed to perform, verify and maintain the publishing function. We do not use authorized YouTube data for unrelated advertising, profiling or sale.

Use of YouTube API Services is also subject to the YouTube Terms of Service and Google's Privacy Policy.

You can revoke EMBERFARE YouTube Publisher access at any time through Google Security — third-party access. When authorization is revoked, Authorized Data tied to that authorization is deleted as soon as practicable and within the period required by YouTube API Services policies, unless retention is required by law.

8. When information may be disclosed

We disclose personal information only as needed for the purposes described above: to service providers acting for us; to analytics or marketing providers when the relevant optional processing is enabled; to an external site when you choose to follow its link; to professional advisers where necessary; in a business reorganization subject to appropriate safeguards; or when required to comply with law, protect rights, investigate abuse or defend legal claims.

We do not permit service providers acting solely on our behalf to use personal information for their own unrelated purposes.

9. International transfers

EMBERFARE is available internationally and some providers may process information in countries other than the country where you live. Where European or UK data-transfer rules apply, we use an available lawful transfer mechanism, such as an adequacy decision, appropriate contractual safeguards (including standard contractual clauses where applicable), or another mechanism permitted by law.

10. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including security, dispute handling, legal compliance and demonstrating consent.

• The EMBERFARE consent-choice cookie is currently configured for up to approximately 180 days and is replaced when you update your choice.
• Newsletter information is kept while a subscription is active and, after unsubscribe, only to the extent needed to honor the suppression request, demonstrate consent/compliance, resolve complaints or satisfy legal obligations.
• Operational and security logs are retained for limited periods based on security and troubleshooting needs.
• YouTube OAuth tokens are kept only while the authorization is active and needed for the publisher. Authorized YouTube data is removed after revocation in accordance with YouTube API Services policies.

When information is no longer needed, we delete, anonymize or securely dispose of it where reasonably practicable.

11. Security

We use reasonable administrative, technical and organizational safeguards designed to protect personal information, including restricted access, transport encryption for public services, separation of production secrets from public code and data minimization. No online service can guarantee absolute security.

12. Your privacy rights

Rights vary by jurisdiction and may be subject to exceptions. We do not discriminate against you for exercising a legally protected privacy right.

EEA and United Kingdom

Where the GDPR or UK GDPR applies, you may have rights to access, rectify, erase, restrict or object to processing, receive data portability, and withdraw consent at any time without affecting processing that was lawful before withdrawal. You may also complain to the competent supervisory authority. UK residents may complain to the Information Commissioner's Office (ICO).

Your right to object: where we rely on legitimate interests, you may object to that processing based on your particular situation. You may object to direct marketing at any time.

California and other U.S. states

Where an applicable U.S. state privacy law applies to EMBERFARE, you may have rights to know/access personal information, request deletion or correction, obtain a portable copy, and opt out of processing defined by that law as sale, sharing, targeted advertising or certain profiling. California law may also provide a right to limit certain uses of sensitive personal information and a right to non-discrimination. We do not use sensitive personal information for the normal EMBERFARE experience.

Canada

Where Canadian private-sector privacy law applies, you may request access to personal information we hold about you, challenge its accuracy and request correction, ask about its use or disclosure, withdraw consent subject to legal or contractual restrictions, and challenge our privacy practices.

How to exercise rights

Email [email protected] with the subject Privacy request. Describe the request and the email address or context involved. We may need to verify your identity proportionately before disclosing or deleting information. Authorized agents may submit requests where applicable law permits them.

13. Children

EMBERFARE is a general-audience travel-deals service and is not directed to children. We do not knowingly solicit personal information from children under 16. If we learn that personal information was collected from a child in circumstances requiring parental consent and that consent was not obtained, we will take reasonable steps to delete it.

14. Changes to this policy

We may update this policy when our product, providers or legal obligations change. The current version will remain available at https://emberfare.com/privacy/ with the updated date. If a change materially affects a consent-based use of personal information, we will seek new consent where required.