Datenschutzerklärung

Was sich geändert hat

Diese Fassung nennt die Claude-API von Anthropic statt Google Cloud Translation für die Übersetzung von Texten. Die übermittelten Daten und alle übrigen Verarbeitungen bleiben unverändert. Eine Datenschutzbestätigung ist keine Einwilligung in optionale Verarbeitung.

Wesentliche Punkte

Die genannte Gesellschaft ist verantwortlich für Konto, Profil, selbst angegebenes Geburtsdatum, Aktivität, Inhalte, Standort, Käufe, technische Daten und Korrespondenz. Quellen sind Sie, Ihr Gerät, gewählte Anbieter und andere Nutzer. Vollständige Store-Kartendaten benötigen wir nicht. Vermeiden Sie sensible Angaben in öffentlichen Notizen, Fotos und allgemeinen Formularen. Daten anderer Personen brauchen eine eigene rechtmäßige Grundlage.

Angeforderte Konto-, Sammel- und Kauffunktionen beruhen soweit nötig auf Vertragserfüllung; Buchhaltung und Rechteanfragen können gesetzlichen Pflichten dienen. Zuverlässigkeit, Missbrauchsschutz und Streitbearbeitung können auf geprüften berechtigten Interessen beruhen. Optionale Messung und einwilligungspflichtige Werbung beruhen auf Einwilligung. Die Bestätigung dieser Richtlinie ist keine pauschale Einwilligung. Ablehnung einer optionalen Wahl blockiert keine unabhängigen Kernfunktionen.

Öffentliche Profile und People-Erinnerungen können Namen, Fotos, Markierungen und Aktivität zeigen. Besitzen Sie die Premium-Ausgabe eines Passes, können Personen, die Ihren Pass öffnen, sehen, dass er Premium ist. Was Sie bezahlt haben, der Store und das Datum bleiben privat. Die Erklärung des Uploaders belegt keine verifizierte Einwilligung der abgebildeten Person. Manche alten Medienlinks können nach einer Sichtbarkeitsänderung für bereits bekannte Linkinhaber weiter funktionieren; die Umstellung ist unvollständig. Kontaktieren Sie uns für konkrete Beschränkung oder Löschung. Frühere unabhängige Kopien lassen sich nicht immer zurückholen.

Vordergrundstandort unterstützt Sammlung, Karten, Nähe und Länderfortschritt. Optionale Hintergrundhinweise funktionieren nur unter iOS; Android überwacht derzeit keinen Standort im Hintergrund. Berechtigungen sind widerrufbar. TrueDepth-Geometrie unterstützter Apple-Geräte ist vorübergehend und wird nicht zur Identifizierung oder Profilbildung gespeichert; ein hochgeladenes gerendertes AR-Foto bleibt personenbezogen.

Website-Analyse und Google-Ads-Messung haben getrennte, standardmäßig ausgeschaltete Wahlmöglichkeiten. Einstellungen gelten bis 180 Tage, lokale Zuordnung bis 90 Tage. Widerruf stoppt künftige unterstützte Erhebung. Verhaltensanalyse der aktualisierten App ist optional und kontobezogen; notwendige reduzierte Diagnosen sind getrennt. Die App nutzt eigene Firebase-Ereignisse, keine Analytics- oder Crashlytics-SDKs.

Relevante Anbieter sind Firebase/Google Cloud, Apple/Google-Stores, OpenFreeMap/Geocoding, hCaptcha, E-Mail, optionale Google-Messung, zulässige KI/Übersetzung und Buch-/Musikkataloge. Wir verkaufen keine personenbezogenen Daten. Externe Bilder und Links geben Anfrageinformationen an deren Hosts weiter. Hauptdatenbank und Hauptspeicher liegen in Europa; das macht nicht jede Anbieterverarbeitung europäisch. Erforderliche Übermittlungsgarantien gelten weiterhin.

Löschung umfasst 30 Tage Schonfrist und geplante Bereinigung. Aktualisierte Regeln sehen 30 Tage für Routinediagnosen, 90 für App-Ereignisse und Server-Übersetzungscache, 420 für Website-Ereignisse vor. Undatierte Altbestände und Aufbewahrungssperren brauchen Prüfung. Wöchentliche Datenbanksicherungen bleiben 30 Tage, gelöschte Storage-Objekte sieben. Minimale Buchhaltungs-, Anspruchs-, Vermögenswiederherstellungs- oder Empfängerdaten können zweckgebunden verbleiben.

Verlangen Sie Auskunft, Berichtigung, Löschung, Einschränkung, anwendbare Datenübertragbarkeit oder Widerspruch. Wir antworten normalerweise binnen eines Monats und kündigen begründete Verlängerungen in diesem Monat an. Sie können Einwilligung widerrufen und sich bei der CNPD beschweren. Aktualisierte optionale App-Analyse ist unter 16 oder bei unbekanntem Alter nicht verfügbar; neue KI-Anfragen können 18 und Anbieterschutz verlangen. Angegebenes Geburtsdatum und PIN verifizieren keine Sorgeberechtigung.

Vollständiger englischer Text

Version 2026-10-15. Effective 15 October 2026. This policy explains data sources and purposes, controls in the coordinated app 1.6.59 and server rollout, and the limits of legacy records and media. References to the updated app mean version 1.6.59; they do not imply that earlier installed versions already have those controls. App-store availability and activation of revised server controls can occur at different times. Server improvements apply after their deployment. Your legal rights remain effective throughout the rollout. Reading or acknowledging this policy is separate from consent to optional processing.

1. Controller, scope and contact

Emblem: Digital Souvenirs S.à r.l.-S, RCS B294391, 19 Rue de l'Industrie, L-8069 Bertrange, Luxembourg, controls the personal data described here. Contact danielmichels@emblemdigitalsouvenirs.com for privacy questions, rights requests or a security concern. Do not send passwords, authentication codes, full payment-card details or unnecessary identity documents.

This policy covers the Emblem app, https://emblemdigitalsouvenirs.com/, cultural passports, account and community features, forms, purchases, campaigns and support. Separate notices may explain a particular creator project, campaign or experimental feature before its use. An external store, sign-in provider, venue or linked website can process data under its own responsibility and notice.

Reading or acknowledging this policy does not grant blanket consent. We use the relevant lawful basis for each purpose. Optional analytics, marketing and permissions have their own choices.

2. Data and its sources

We receive data from you, your device, the providers you choose to sign in or pay with, people who interact with you, and information submitted through support or moderation. Relevant categories are:

Category — Examples and source

Account and profile — Name, username, email, sign-in identifier, date of birth, avatar, nationality or country information, language, preferences, membership and legal-notice records. You provide these, or a chosen sign-in provider supplies permitted account details.

Activity and relationships — Collection records, passport progress, quiz results, ratings, reactions, followers, following, bonds, saved or hidden items and feature settings. These arise from actions in the service.

Submitted content — Posts, photos, private passport identity photographs, People memories, notes, tags, comments and feature-specific music, book, cuisine or language information. Another user may identify or tag you or include your image. The uploader is the source of that contribution.

Location — Precise coordinates for supported location features; country or place information derived from location; collection or proximity checks and related anti-fraud evidence. Device permissions control access.

Payments and rewards — Store transaction references, product, purchase and renewal status, amounts or credit entitlement, refunds, campaign participation and redemption information. We receive these from you, the store or the responsible fulfilment provider.

Technical and safety records — App/build version, platform, device/browser details, service-request information including IP address, operational diagnostics, error class, permitted error code and software stack locations, abuse checks, reports and moderation records. Older diagnostic records can contain bounded error text and context until their expiry or removal.

Optional measurement — Website visitor and session identifiers, pages, referrer, campaign parameters, store-link attribution, device/performance measurements and approximate location; opted-in app behaviour events.

Correspondence — Form submissions, contact details, project applications, support messages, feedback and reports. If an email gift feature is enabled and used, the sender supplies the recipient's email address and gift details.

We do not need your full store-payment card number. Do not put sensitive information in public notes, photos, tags or general support forms. A photo can itself identify a person even if it contains no precise coordinates. Some uploads can contain image metadata; metadata removal is verified for the People capture path and must not be assumed for every upload path.

3. Purposes and lawful bases

The following mapping applies subject to the conditions of the relevant law:

Purpose — Relevant data — Basis

Create and operate the account and requested features — Account, sign-in, preferences, collection, submitted content, relationships and service messages — Performance of the user contract where objectively necessary; legitimate interests for ancillary administration that is not necessary to perform that contract

Handle images, tags or notes concerning somebody other than the submitting user — Identifiable image, name, tag/account reference and relevant note/source — A separately valid basis for that person's data, such as valid consent or a necessary legitimate interest after an appropriate rights/child-interest assessment. The uploader's agreement does not make the depicted or tagged person a party to that contract. Required image/publication permissions and any additional condition for special-category data must also be satisfied.

Verify collection, provide a requested nearby feature and maintain location-derived progress — Relevant location, collection evidence and derived country/place records — Performance of the requested service where necessary; consent for optional background access and other consent-dependent processing

Fulfil purchases, memberships, refunds and requested rewards — Transaction, entitlement and fulfilment records — Performance of the contract; legal obligations for required accounting and tax records

Protect accounts, prevent fraud, investigate reports, operate moderation and diagnose failures — Necessary technical, diagnostic, transaction, content and report records — Legitimate interests in protecting people, enforcing valid rules and maintaining a reliable service; legal obligation when applicable

Measure optional website/app behaviour and conversion journeys — Consented identifiers and measurement events — Consent; optional advertising conversion measurement is disclosed separately from necessary operation

Send optional marketing — Contact details and marketing preferences — Consent where required; a permitted existing-customer exception only where its conditions and an easy opt-out are met

Answer enquiries, organise requested projects and handle rights or legal claims — Correspondence, necessary project/account details and evidence — Steps requested before a contract or contract performance; legal obligation for rights requests; legitimate interests in answering non-contract enquiries and establishing or defending legal claims

Our legitimate interests are service reliability, prevention of misuse, protection of affected people and resolution of enquiries or disputes. We assess necessity and balance these interests against your rights, with particular attention to children and private content. You may object as explained below. We do not use “legitimate interests” as a substitute for required cookie or optional-feature consent.

Required account or order information is identified when collected. Without it, we may be unable to create an account, authenticate you, fulfil an order or investigate that request. Denying an optional permission or measurement choice does not prevent unrelated core features. Consent can be withdrawn without affecting the lawfulness of processing before withdrawal.

4. Public content, tags and privacy controls

Choose the audience before sharing. Public profiles and activity can show country or nationality, visited-country information, collection, social connections and other enabled profile/activity details. A private-account or visibility control affects the fields and audience supported by that control; it is not a promise that every record, necessary provider copy or previously shared item becomes private.

People memories are a public feature. They may include a photo, a creator, a tagged person's name, account identifier or avatar, and a note. By accepting the Terms, a publisher confirms for every People memory they publish that they have the permission or other lawful basis needed for identifiable people, tags and notes; the app does not ask again for each photo. That confirmation does not establish consent by a tagged person and is not verified identity or subject permission. Before publishing identifiable people, obtain the permission or other lawful justification required for that image, audience and use, especially for children. Do not disclose somebody's location or personal circumstances through a tag or note without an appropriate basis.

If another user includes you and you did not agree, use the reporting tool or contact us with the content identifier. You do not need an account to contact us. We will assess your image, privacy and data-protection rights. Information about its source is available where applicable; third-party data must receive the notice required by law, rather than being treated as covered by the uploader's agreement.

We must restrict our own processing according to the selected audience and applicable rights. Some legacy media links may still allow access to somebody who already holds the link after a visibility change. Not every legacy media path has completed the same protection and link-revocation migration. Do not rely on a visibility switch alone to revoke a previously issued media link; contact us for a specific restriction or removal request. We assess and address such requests and the underlying access-control issue. A public item can nevertheless have been copied by somebody else. Changing visibility or deleting an item cannot guarantee retrieval of their prior independent copy. Necessary technical caching or backup delays are distinct from indefinite public access; a cached or bearer URL must not be treated as an authorised substitute for a revoked audience setting.

5. Location and background alerts

Foreground location supports maps, collection verification, nearby Emblems, country-visit progress and location-derived account information. It is not used solely for collection verification. Proximity or bond features may use location to carry out the requested interaction; their data must be limited to the stated purpose and retention period.

On iOS only, a separate optional nearby-Emblem feature can request background permission and use region monitoring for alerts. Android does not monitor location in the background in the current implementation. Device settings and the feature preference control this access. Enabling ordinary foreground access does not require enabling background access.

Without location, affected collection or nearby functions may not work. You can still use features that do not require it. We do not sell individual movement histories or provide them in routine partner reporting. Map tiles are supplied by OpenFreeMap and device geocoding can use the platform's provider; such requests can disclose request information needed to deliver maps or place results.

6. Camera, microphones, photos, AR and TrueDepth

Camera access begins when you open a capture feature. Microphone or photo-library access is requested for features that need it. You can deny or revoke these permissions in device settings; the affected capture or selection feature then cannot work, while unrelated features remain available.

On supported Apple devices, face-worn AR effects use Apple's ARKit and TrueDepth camera. During the face-filter view, ARKit supplies a face anchor and mesh coordinates. Emblem uses them transiently to align and scale the selected effect. The current implementation does not store or transmit that geometry as a separate record, use it to identify or authenticate you, or use it for advertising, analytics, profiling or data mining. It does not directly serialize raw camera pixel buffers, save the live feed, or read TrueDepth depth maps, facial-expression blend shapes, named landmarks, Face ID identity data, face identifiers or AR-anchor identifiers for those purposes. Face-session alignment data remains in memory and is discarded when the session ends.

When you select Use Photo, Emblem produces a rendered image containing your camera photo and the effect. A temporary local copy can be uploaded to Firebase Storage as a supported post cover. The selected photo can be visible according to the post's audience. Google receives that rendered image for storage, not a separate underlying TrueDepth geometry record. A photograph of a face remains personal data even when no geometry is retained.

Temporary captures are cleaned up on successful upload, discard, replacement or leaving the relevant page. An app or operating-system interruption can delay cleanup until a later app or OS operation. The uploaded image remains with the post until removal, replacement or deletion, subject to necessary retention and backup limits. Deletion requests can need retry after a network or provider failure. These limitations must not be used to preserve public access to a removed image.

7. Optional measurement, cookies and diagnostics

Essential storage supports functions such as your language choice, consent preference, session or security controls. It is distinct from optional measurement. Website optional analytics can use first-party visitor/session identifiers and Google Analytics; the consented conversion feature can use Google Ads conversion measurement and store-link attribution. Permitted page routes, the referring site's origin, controlled campaign fields, device/performance information and request-derived approximate location can be included. First-party website measurement removes query strings, fragments and supported private-route identifiers; it does not collect contact-form prose, raw error messages or full stack traces. Google tags receive explicit reduced page/referrer values, but also process the browser request information needed to operate their service.

Choose analytics and Google Ads conversion measurement independently through the website consent control, or reject all optional tracking. Advertising measurement is not automatically enabled by an analytics choice, including a historic analytics choice. Advertising personalisation remains disabled. The persistent Cookie preferences control lets you revisit the choices. Reopening it does not itself change your choice. Withdrawing permission stops future optional collection, clears the supported first-party measurement identifiers and cookies, and can reload the page to stop an already loaded Google tag. We cannot erase a third party's prior records merely by clearing browser cookies; contact us for an applicable deletion request. The consent preference is stored for up to 180 days before a fresh choice is required. Local campaign attribution is retained for up to 90 days. First-party attribution stores or appends advertising click identifiers only when analytics and advertising choices both permit that use; withdrawing advertising permission removes those identifiers even if analytics remains enabled.

In the updated app, behaviour analytics is optional, disabled by default and tied to the signed-in account. A prior choice by another account or an unattributable old device-wide preference is not carried forward. Signed-out collection is off. It uses custom events sent to Firebase services when enabled; the current app does not use the Firebase Analytics or Crashlytics SDK. Use the app's analytics setting to change the choice. The updated app has a separate necessary diagnostic path that can send the signed-in user's account identifier, error class, a permitted diagnostic code, software stack locations, version/build/platform and time to the service for reliability and safety. It discards arbitrary exception prose, local file paths, private URLs and free-form context. The fingerprint is derived from those reduced diagnostic fields. Older records can contain bounded error text, stacks or context until their expiry or removal. Turning off optional behaviour analytics does not turn off that necessary diagnostic processing. It must remain limited to those purposes and avoid unnecessary sensitive content.

8. Providers and disclosures

We do not sell personal data. Emblem does not upload app-user email addresses, identifiers, location, purchases or activity to advertising audiences, cross-company advertising measurement or data brokers. Optional consented website measurement is a separate practice described above. We disclose relevant data to providers needed for the requested service, acting under the appropriate contractual and legal conditions:

Provider or category — Purpose and relevant data

Google Firebase and Google Cloud — Authentication, databases, uploaded media, notifications, hosting/functions and service diagnostics. Apple/Google sign-in supplies permitted account data when chosen.

Apple App Store and Google Play — Billing, transaction validation, renewals, refunds and restoration. Store transaction references and entitlement status are processed by Emblem.

OpenFreeMap and platform geocoding — Map tiles, location/place results and the request information needed to supply them.

Google Analytics and Google Ads — Optional website analytics and conversion measurement, when enabled through the applicable choice.

hCaptcha — Abuse-prevention checks on supported forms and the technical information needed for that check.

Email providers — Requested support/service correspondence and, if enabled and used, a gift invitation containing sender display name, recipient address and claim link. Supported gift invitations use Gmail SMTP.

Anthropic and Google AI/translation services — Feature-specific classification, descriptions or locality checks for cuisine, music and books, and requested text translation or pronunciation support. Submitted text/metadata and country/language context can be sent where the feature is enabled for eligible users. Cuisine and music classification, descriptions and locality checks, and text translation, use Anthropic's Claude API under its commercial terms; those terms do not mean that no provider processing, safety screening or lawful retention occurs. For a translation, the text you ask to translate (such as a post, caption, comment or bio) is sent with the target language. Server translation is distinct from the legacy direct mobile Google romanisation route. Older app versions can send the phrase and language with the device network request to that direct route. The updated app does not issue new requests through that route while its agreement coverage is unverified; local phrase, Latin-text and cached fallbacks remain available. The website chat also uses Anthropic's Claude API. It sends the messages you type, the answers you choose, and the page you are on with its language, so that it can write its replies. Before sending, it removes email addresses and phone numbers in international format that you type. We don't send your name or contact details to it.

Catalogue and external media services — Book or song search queries can be sent from our server to Google Books, Open Library or Apple's iTunes catalogue, and supported track links can be checked against Spotify. These services return public metadata, links or images. Loading an externally hosted cover/image or opening a link can disclose your device's request information to that host. A catalogue lookup does not send the same fields as a classification request.

We do not intentionally send the account UID or email in the supported cuisine/music classification requests. Do not enter private or sensitive text into a feature that sends the requested text to an external provider. You may ask us for information about the relevant provider, destination, retention and applicable safeguards through the contact address above.

We can disclose necessary evidence to authorities when lawfully required, to protect rights or safety, or in a legitimate business transfer with the required safeguards and notice. We do not disclose a full profile where a limited record suffices. Routine partner reports use aggregate project/campaign measures. A named reward or project can need particular fulfilment details; identify the recipient and purpose before that disclosure.

A separately offered experimental payment, wallet or blockchain feature requires an advance notice naming the payment and chain providers, fields made public, custody arrangements and irreversible-record limits before information is sent. Where an earlier enabled feature created a custodial wallet, its address, encrypted recovery material and necessary account linkage can remain in restricted recovery records while needed to preserve the holder's assets, handle outstanding transactions and complete safe closure or recovery. Necessary legal records may remain after closure for their applicable period; unrelated profile and correspondence fields are removed. This policy does not silently authorise uploading a person's photo or location to a public chain.

9. International processing

Our current production Firestore database uses the European `eur3` region and our main Storage bucket uses the EU location. Some providers operate outside Luxembourg and the European Economic Area. Firebase Authentication and other services can use regional or global infrastructure. The location of our database and bucket does not establish the location of every provider operation, support activity or transfer.

Where a transfer requires safeguards, we use an applicable adequacy decision, standard contractual clauses with the necessary assessment and supplementary measures, or another valid mechanism for that particular transfer. Contact us to ask about the relevant destination and receive information or a copy of applicable safeguards, with appropriate redactions. We do not assume a provider is covered by an adequacy mechanism without checking the relevant entity and service.

10. Retention and deletion

Account and content records are held while needed to supply your active account and chosen features. Remove content through supported controls or request account deletion in settings. The current account-deletion process uses a 30-day grace period, during which signing in can cancel the request. After it ends, a scheduled process deletes or anonymises the active account and associated data; the next run or a retry can delay completion. A data-rights request is assessed separately and is not automatically postponed by the grace period.

Deletion is not a promise that every transaction or every independent copy vanishes immediately. We can retain the minimum information necessary for required accounting, tax, store reconciliation, prevention of a specific fraud, a current dispute, legal claims or another documented legal obligation. Required Luxembourg accounting records generally have a ten-year retention period from the relevant financial-year end. This does not justify retaining every profile, photo, precise location or unrelated technical record for ten years. Retained records must be separated from ordinary public/profile use and must not recreate a deleted account.

Detailed first-party website measurement events are scheduled for deletion after 420 days. The updated retention process schedules app behaviour events and server text-translation-cache entries for deletion after 90 days, and routine app diagnostic records after 30 days, subject to a documented legal or incident hold. A scheduled run or retry can delay removal; records missing an authoritative creation date require a separate assessment. The server does not reuse text-translation results after that cache lifetime; its in-memory request cache expires within five minutes or the earlier underlying expiry. Device translation/pronunciation caches and stored catalogue-language information are separate categories: they can remain locally or with the catalogue until cleared, replaced or no longer needed for their feature. A server-cache deadline does not erase those separate copies.

Support and application records are kept while the enquiry or project is being handled, then only to resolve an outstanding commitment, complaint or applicable claim. Private legal-notice receipts demonstrate the applicable agreement or notice while the account is held; routine account deletion removes that private receipt history. Any separate evidence retained for a specific outstanding claim must be necessary, restricted and governed by its own applicable period. Moderation and security evidence is kept for the investigation, challenge and any necessary legal or safety proceedings; closed cases require periodic retention review. The period depends on the category, resolution event, relevant legal period and documented hold, rather than indefinite ordinary use. Once the purpose and applicable claim or legal period ends, the records are deleted or irreversibly anonymised. An unresolved case can justify only necessary evidence, with periodic review.

Our production Firestore backup schedule is weekly, with a 30-day retention period for each backup. A database record removed from active use can remain in a preceding backup until that backup expires. Our main Storage bucket keeps a deleted object recoverable for seven days under its soft-delete policy. These recovery periods are separate from the account's 30-day deletion grace period and from any documented category-specific retention. Recovery copies are restricted to recovery and necessary security purposes. A restore is not authorised for ordinary service use until applicable deletion requests and restrictions have been checked and reapplied. These checks may require manual work; we do not promise automatic erasure across every recovery copy. Other providers can have their own disclosed backup or deletion cycles; we will explain a relevant delay or exception when answering your request.

We cannot promise removal of somebody else's independent lawful copy, but must take the steps within our responsibility and notify recipients where the law requires. Accepted gifts and delivered messages may remain in the selected recipient's Emblem account after the sender deletes their account. This can include the shared message and photo and their necessary object references; it is a recipient copy within Emblem, not an independent external copy or an accounting record. We remove unnecessary sender profile linkage and assess any request affecting that content under applicable privacy, image, erasure and recipient rights. Wallet recovery records, transaction verification references and recipient copies can still be personal data even after other profile fields are removed.

11. Security

We use controls such as restricted account/database access, encrypted transport, protected administration, abuse prevention and provider security measures. The purpose is to reduce unauthorised access, alteration or loss. No system is risk-free. Publicly available URLs, cache behaviour and visibility changes require the same attention as database permissions; a policy statement does not make an exposed image private.

Report a concern at our contact address with enough information to locate it, without exploiting it or sending unnecessary personal data. We investigate relevant incidents and make legally required notifications.

12. Your rights and response times

Subject to the relevant conditions and exceptions, you may request access and a copy, correction, erasure, restriction, portability or object to processing. Portability applies to the data and automated processing covered by that right; it does not require disclosure of another person's protected information. Contact us to request the applicable copy or structured export; account deletion is a separate control.

You may withdraw consent at any time through the relevant control or by contacting us. You may object to legitimate-interest processing for reasons relating to your situation. Direct-marketing objections are honoured for that marketing. A necessary service or legal record can have a different lawful basis; we will explain it rather than treating all processing as optional.

We respond without undue delay and normally within one month. A permitted extension of up to two further months requires notice within the first month, with the reason. If we cannot act on a request, we explain the reasons and the available complaint or court route. Requests are ordinarily free; any lawful exceptional refusal or charge must be justified. Identity checks are limited to what is reasonably necessary and proportionate to prevent disclosure to the wrong person.

Contact danielmichels@emblemdigitalsouvenirs.com. You can complain to Luxembourg's Commission nationale pour la protection des données (CNPD) at https://cnpd.public.lu/ or another competent supervisory authority. Contacting Emblem first is helpful but is not a condition of that right.

13. Automated controls

Collection, purchase, eligibility and anti-abuse checks can be automated. Feature-specific AI can assist classification and language functions. Those uses must not be confused with verified identity or a guarantee that generated information is correct. We do not use TrueDepth geometry for identification or profiling.

If an automated check wrongly restricts you, contact us with the relevant account, transaction or content reference for review. Any solely automated decision producing a legal or similarly significant effect requires the separate lawful conditions, notice and safeguards that apply; this policy is not a blanket authorisation for such decisions.

14. Children

Registration is not offered to children under 13. A 13-year service floor is distinct from contractual capacity and from the age at which a child can give their own valid consent. In Luxembourg, consent-dependent online services for a child under 16 require appropriate authorisation by the holder of parental responsibility. Other jurisdictions can differ.

In updated app and server controls, optional app behaviour analytics is unavailable when the server-held date of birth shows an age below 16 or when age cannot be established. The date of birth is self-declared and is not verified identity. We do not currently offer a guardian-consent exception for that analytics feature. Any other consent-dependent child feature must have the appropriate age or verified guardian safeguards before it is enabled. A checkbox or local content-filter PIN is not guardian verification.

External AI features can have stricter eligibility and provider conditions than ordinary account registration. Updated server controls reject new model requests from under-18 or unknown-age accounts where the necessary guardian or supplier conditions have not been established. A provider can remain disabled while its eligibility and contractual scope are checked; account ownership by Emblem is not itself proof of that scope. Ordinary access to public catalogue information is distinct from sending a new request to a model. Age eligibility alone does not establish that the provider has approved the product's scope.

Contact us if a child has registered improperly or appears in content without the necessary permission. We will assess removal, account action and the applicable rights promptly, with a child's interests in mind.

15. Website chat

Every page of our website has a chat that answers questions about Emblem. It is an AI assistant (Claude, by Anthropic) and is labelled as one. Please don't type personal or sensitive information in it.

What we keep. The conversation stays in your browser while the tab is open. We don't store chat transcripts on our servers. To prevent abuse, we count the messages sent from each IP address, under a keyed hash of the address that changes every day, and delete the counts within 48 hours.

Basis. Answering you is a step you ask for before a possible contract (Art. 6(1)(b) GDPR). Abuse prevention is our legitimate interest (Art. 6(1)(f) GDPR).

Talking to us. If you ask us to contact you, we receive your name, organisation, email and place, your answers, a short summary and the conversation. We receive them only when you ask us to contact you. We use them to reply to you and to prepare your project. If no project follows, we delete them within 12 months.

16. Changes and version history

We update this policy when processing, providers, law or controls change. We publish the version and effective date, describe material changes and give an appropriate additional notice. A new notice cannot retrospectively create consent that was never obtained. A new purpose that requires consent is offered with a separate valid choice before it starts.

The preceding version was 2026-10-14, effective 14 October 2026, before text translation moved to Anthropic's Claude API; it remains available at https://emblemdigitalsouvenirs.com/legal/2026-10-14/privacy.en.html. Earlier versions remain available too: 2026-10-12, effective 12 October 2026, which added the website chat (https://emblemdigitalsouvenirs.com/legal/2026-10-12/privacy.en.html); 2026-10-08, effective 8 October 2026, which named Anthropic for the cuisine and music checks (https://emblemdigitalsouvenirs.com/legal/2026-10-08/privacy.en.html); and 2026-09-30, effective 30 September 2026, which named OpenAI for those checks (https://emblemdigitalsouvenirs.com/legal/2026-09-30/privacy.en.html). The website privacy policy before that was dated 30 August 2026; the app's old summary was dated 20 July 2024. The published version and effective date identify the applicable notice. The preceding public HTML responses are preserved in the archive linked with this policy. You can also request the version relevant to your account or order. Localized summaries accompany the full English policy; they are explicitly identified as summaries, not complete translations.

Contact: danielmichels@emblemdigitalsouvenirs.com.

Vorherige öffentliche Fassung

Das Archiv bewahrt die vor dieser Aktualisierung erfasste öffentliche HTML-Antwort. Es ist eine historische Kopie und beschreibt nicht die aktuelle Verarbeitung.