Política de Privacidade

O que mudou

Esta versão adiciona as visitas ao vivo ao Portal e a praça da Expo: as pessoas na mesma sala veem em tempo real seu nome de usuário, seu avatar e os movimentos dele. Não há texto livre, sua localização física não é compartilhada e nada é guardado depois que você sai. Os demais tratamentos se mantêm inalterados. Reconhecer a política não significa consentir em tratamentos opcionais.

Pontos principais

A sociedade indicada controla conta, perfil, data de nascimento declarada, atividade, conteúdos, localização, compras, registros técnicos e correspondência. As fontes são o usuário, dispositivo, fornecedores escolhidos e outros usuários. Não precisamos dos dados completos do cartão da loja. Evite informação sensível em notas, fotos e formulários públicos. Dados de outras pessoas precisam de justificativa jurídica própria.

Funções pedidas de conta, coleção e compra usam o contrato quando necessário; contabilidade e pedidos de direitos podem usar obrigações legais. Confiabilidade, prevenção de abusos e litígios podem usar interesses legítimos avaliados. Medição opcional e marketing dependente de consentimento usam consentimento. Reconhecer esta política não dá consentimento geral. Recusar uma opção não impede funções essenciais independentes.

Perfis públicos e memórias People podem mostrar nomes, fotos, identificações e atividade. Se você tiver a edição premium de um passaporte, quem abrir o seu passaporte pode ver que é premium. O valor pago, a loja e a data permanecem privados. A declaração do autor não verifica consentimento da pessoa mostrada. Alguns antigos links de mídia podem permanecer utilizáveis por quem já os tem após alteração de visibilidade; a migração não está completa. Entre em contato conosco para uma restrição ou remoção concreta. Cópias independentes anteriores nem sempre se recuperam. Em uma visita ao vivo ao Portal ou na praça da Expo, as pessoas na sala veem em tempo real seu nome de usuário, seu avatar e os movimentos dele; nada é guardado depois que você sai.

Localização em primeiro plano suporta coleção, mapas, proximidade e progresso por países. Alertas opcionais em segundo plano só funcionam em iOS; Android atualmente não monitora localização em segundo plano. Permissões podem ser revogadas. A geometria do rastreamento facial da câmera frontal (ARKit) é temporária e não guardada para identidade ou perfis; uma fotografia AR renderizada que você envie continua dado pessoal.

Analítica do site e medição Google Ads têm escolhas separadas, desativadas por padrão: preferências até 180 dias, atribuição local até 90. Retirar consentimento interrompe coleta futura suportada. Analítica comportamental do aplicativo atualizada é opcional e específica da conta; diagnósticos necessários reduzidos são separados. O aplicativo usa eventos Firebase próprios, sem SDK Analytics ou Crashlytics. Um administrador pode verificar se o aplicativo ainda está instalado em um aparelho que recebe suas notificações; nada aparece nele.

Fornecedores pertinentes incluem Firebase/Google Cloud, lojas Apple/Google, OpenFreeMap/geocodificação, hCaptcha, email, medição Google opcional, IA/tradução elegíveis e catálogos de livros/música. Não vendemos dados pessoais. Capas externas e links revelam informação de pedidos aos seus anfitriões. Base e armazenamento principais são europeus; isso não torna todo tratamento dos fornecedores europeu. As salvaguardas de transferência aplicáveis continuam necessárias. Em contas de 18 anos ou mais, o Claude da Anthropic verifica novas publicações, comentários, fotos de comida e perfis em busca de possíveis violações das regras; uma pessoa analisa tudo o que ele sinaliza, e verificações sem resultado são apagadas após 90 dias.

A exclusão inclui 30 dias de tolerância e limpeza agendada. Regras atualizadas preveem 30 dias para diagnósticos normais, 90 para eventos do aplicativo e cache de tradução do servidor, 420 para eventos web. Registros antigos sem data e retenções justificadas exigem revisão. Cópias semanais da base duram 30 dias; objetos Storage excluídos, sete. Podem subsistir registros mínimos contábeis, de reclamações, recuperação de ativos ou cópias de destinatários segundo necessidade.

Peça acesso, retificação, apagamento, limitação, portabilidade aplicável ou oposição. Respondemos normalmente em um mês; uma extensão justificada é comunicada nesse mês. Você pode retirar consentimento e reclamar à CNPD. Analítica opcional atualizada não está disponível abaixo de 16 anos ou com idade desconhecida; novos pedidos IA podem exigir 18 e salvaguardas do fornecedor. Data declarada e PIN não verificam autorização parental.

Texto integral em inglês

Version 2026-10-20. Effective 20 October 2026. This policy explains data sources and purposes, controls in the coordinated app 1.6.59 and server rollout, and the limits of legacy records and media. References to the updated app mean version 1.6.59; they do not imply that earlier installed versions already have those controls. App-store availability and activation of revised server controls can occur at different times. Server improvements apply after their deployment. Your legal rights remain effective throughout the rollout. Reading or acknowledging this policy is separate from consent to optional processing.

1. Controller, scope and contact

Emblem: Digital Souvenirs S.à r.l.-S, RCS B294391, 19 Rue de l'Industrie, L-8069 Bertrange, Luxembourg, controls the personal data described here. Contact danielmichels@emblemdigitalsouvenirs.com for privacy questions, rights requests or a security concern. Do not send passwords, authentication codes, full payment-card details or unnecessary identity documents.

This policy covers the Emblem app, https://emblemdigitalsouvenirs.com/, cultural passports, account and community features, forms, purchases, campaigns and support. Separate notices may explain a particular creator project, campaign or experimental feature before its use. An external store, sign-in provider, venue or linked website can process data under its own responsibility and notice.

Reading or acknowledging this policy does not grant blanket consent. We use the relevant lawful basis for each purpose. Optional analytics, marketing and permissions have their own choices.

2. Data and its sources

We receive data from you, your device, the providers you choose to sign in or pay with, people who interact with you, and information submitted through support or moderation. Relevant categories are:

Category — Examples and source

Account and profile — Name, username, email, sign-in identifier, date of birth, avatar, nationality or country information, language, preferences, membership and legal-notice records. You provide these, or a chosen sign-in provider supplies permitted account details.

Activity and relationships — Collection records, passport progress, quiz results, ratings, reactions, followers, following, bonds, saved or hidden items, live Portal presence while you are in a room (your avatar's look, position and chosen actions) and feature settings. These arise from actions in the service.

Submitted content — Posts, photos, private passport identity photographs, People memories, notes, tags, comments and feature-specific music, book, cuisine or language information. Another user may identify or tag you or include your image. The uploader is the source of that contribution.

Location — Precise coordinates for supported location features; country or place information derived from location; collection or proximity checks and related anti-fraud evidence. Device permissions control access.

Payments and rewards — Store transaction references, product, purchase and renewal status, amounts or credit entitlement, refunds, campaign participation and redemption information. We receive these from you, the store or the responsible fulfilment provider.

Technical and safety records — App/build version, platform, device/browser details, notification tokens and app install-check results, service-request information including IP address, operational diagnostics, error class, permitted error code and software stack locations, abuse checks, reports and moderation records. Older diagnostic records can contain bounded error text and context until their expiry or removal.

Optional measurement — Website visitor and session identifiers, pages, referrer, campaign parameters, store-link attribution, device/performance measurements and approximate location; opted-in app behaviour events.

Correspondence — Form submissions, contact details, project applications, support messages, feedback and reports. If an email gift feature is enabled and used, the sender supplies the recipient's email address and gift details.

We do not need your full store-payment card number. Do not put sensitive information in public notes, photos, tags or general support forms. A photo can itself identify a person even if it contains no precise coordinates. Some uploads can contain image metadata; metadata removal is verified for the People capture path and must not be assumed for every upload path.

3. Purposes and lawful bases

The following mapping applies subject to the conditions of the relevant law:

Purpose — Relevant data — Basis

Create and operate the account and requested features — Account, sign-in, preferences, collection, submitted content, relationships and service messages — Performance of the user contract where objectively necessary; legitimate interests for ancillary administration that is not necessary to perform that contract

Handle images, tags or notes concerning somebody other than the submitting user — Identifiable image, name, tag/account reference and relevant note/source — A separately valid basis for that person's data, such as valid consent or a necessary legitimate interest after an appropriate rights/child-interest assessment. The uploader's agreement does not make the depicted or tagged person a party to that contract. Required image/publication permissions and any additional condition for special-category data must also be satisfied.

Verify collection, provide a requested nearby feature and maintain location-derived progress — Relevant location, collection evidence and derived country/place records — Performance of the requested service where necessary; consent for optional background access and other consent-dependent processing

Fulfil purchases, memberships, refunds and requested rewards — Transaction, entitlement and fulfilment records — Performance of the contract; legal obligations for required accounting and tax records

Protect accounts, prevent fraud, investigate reports, operate moderation and diagnose failures — Necessary technical, diagnostic, transaction, content and report records — Legitimate interests in protecting people, enforcing valid rules and maintaining a reliable service; legal obligation when applicable

Measure optional website/app behaviour and conversion journeys — Consented identifiers and measurement events — Consent; optional advertising conversion measurement is disclosed separately from necessary operation

Send optional marketing — Contact details and marketing preferences — Consent where required; a permitted existing-customer exception only where its conditions and an easy opt-out are met

Answer enquiries, organise requested projects and handle rights or legal claims — Correspondence, necessary project/account details and evidence — Steps requested before a contract or contract performance; legal obligation for rights requests; legitimate interests in answering non-contract enquiries and establishing or defending legal claims

Our legitimate interests are service reliability, prevention of misuse, protection of affected people and resolution of enquiries or disputes. We assess necessity and balance these interests against your rights, with particular attention to children and private content. You may object as explained below. We do not use “legitimate interests” as a substitute for required cookie or optional-feature consent.

Required account or order information is identified when collected. Without it, we may be unable to create an account, authenticate you, fulfil an order or investigate that request. Denying an optional permission or measurement choice does not prevent unrelated core features. Consent can be withdrawn without affecting the lawfulness of processing before withdrawal.

4. Public content, tags and privacy controls

Choose the audience before sharing. Public profiles and activity can show country or nationality, visited-country information, collection, social connections and other enabled profile/activity details. A private-account or visibility control affects the fields and audience supported by that control; it is not a promise that every record, necessary provider copy or previously shared item becomes private.

People memories are a public feature. They may include a photo, a creator, a tagged person's name, account identifier or avatar, and a note. By accepting the Terms, a publisher confirms for every People memory they publish that they have the permission or other lawful basis needed for identifiable people, tags and notes; the app does not ask again for each photo. That confirmation does not establish consent by a tagged person and is not verified identity or subject permission. Before publishing identifiable people, obtain the permission or other lawful justification required for that image, audience and use, especially for children. Do not disclose somebody's location or personal circumstances through a tag or note without an appropriate basis.

Live Portal visits and the Expo plaza. When you join someone's Portal live or the Expo plaza, the other people in that room see, in real time, your username, your avatar's look, where your avatar stands and moves in the Portal, and the dances, gestures and ready-made phrases you choose. There is no free text, and your physical location is not shared. Two people share a room only when each one's Portal visit setting allows the other and neither has blocked the other; parental controls limit Everyone to People I follow. A new block removes you both from a room you share, and every name tag offers Report and Block. We process this to provide the feature you choose to join.

If another user includes you and you did not agree, use the reporting tool or contact us with the content identifier. You do not need an account to contact us. We will assess your image, privacy and data-protection rights. Information about its source is available where applicable; third-party data must receive the notice required by law, rather than being treated as covered by the uploader's agreement.

We must restrict our own processing according to the selected audience and applicable rights. Some legacy media links may still allow access to somebody who already holds the link after a visibility change. Not every legacy media path has completed the same protection and link-revocation migration. Do not rely on a visibility switch alone to revoke a previously issued media link; contact us for a specific restriction or removal request. We assess and address such requests and the underlying access-control issue. A public item can nevertheless have been copied by somebody else. Changing visibility or deleting an item cannot guarantee retrieval of their prior independent copy. Necessary technical caching or backup delays are distinct from indefinite public access; a cached or bearer URL must not be treated as an authorised substitute for a revoked audience setting.

5. Location and background alerts

Foreground location supports maps, collection verification, nearby Emblems, country-visit progress and location-derived account information. It is not used solely for collection verification. Proximity or bond features may use location to carry out the requested interaction; their data must be limited to the stated purpose and retention period.

On iOS only, a separate optional nearby-Emblem feature can request background permission and use region monitoring for alerts. Android does not monitor location in the background in the current implementation. Device settings and the feature preference control this access. Enabling ordinary foreground access does not require enabling background access.

Without location, affected collection or nearby functions may not work. You can still use features that do not require it. We do not sell individual movement histories or provide them in routine partner reporting. Map tiles are supplied by OpenFreeMap and device geocoding can use the platform's provider; such requests can disclose request information needed to deliver maps or place results.

6. Camera, microphones, photos, AR and face tracking

Camera access begins when you open a capture feature. Microphone or photo-library access is requested for features that need it. You can deny or revoke these permissions in device settings; the affected capture or selection feature then cannot work, while unrelated features remain available.

On supported Apple devices, face-worn AR effects use the front camera's face tracking (ARKit). During the face-filter view, ARKit supplies a face anchor and mesh coordinates. Emblem uses them transiently to align and scale the selected effect. The current implementation does not store or transmit that geometry as a separate record, use it to identify or authenticate you, or use it for advertising, analytics, profiling or data mining. It does not directly serialize raw camera pixel buffers, save the live feed, or read depth maps, facial-expression blend shapes, named landmarks, Face ID identity data, face identifiers or AR-anchor identifiers for those purposes. Face-session alignment data remains in memory and is discarded when the session ends.

When you select Use Photo, Emblem produces a rendered image containing your camera photo and the effect. A temporary local copy can be uploaded to Firebase Storage as a supported post cover. The selected photo can be visible according to the post's audience. Google receives that rendered image for storage, not a separate underlying face-tracking geometry record. A photograph of a face remains personal data even when no geometry is retained.

Temporary captures are cleaned up on successful upload, discard, replacement or leaving the relevant page. An app or operating-system interruption can delay cleanup until a later app or OS operation. The uploaded image remains with the post until removal, replacement or deletion, subject to necessary retention and backup limits. Deletion requests can need retry after a network or provider failure. These limitations must not be used to preserve public access to a removed image.

7. Optional measurement, cookies and diagnostics

Essential storage supports functions such as your language choice, consent preference, session or security controls. It is distinct from optional measurement. Website optional analytics can use first-party visitor/session identifiers and Google Analytics; the consented conversion feature can use Google Ads conversion measurement and store-link attribution. Permitted page routes, the referring site's origin, controlled campaign fields, device/performance information and request-derived approximate location can be included. First-party website measurement removes query strings, fragments and supported private-route identifiers; it does not collect contact-form prose, raw error messages or full stack traces. Google tags receive explicit reduced page/referrer values, but also process the browser request information needed to operate their service.

Choose analytics and Google Ads conversion measurement independently through the website consent control, or reject all optional tracking. Advertising measurement is not automatically enabled by an analytics choice, including a historic analytics choice. Advertising personalisation remains disabled. The persistent Cookie preferences control lets you revisit the choices. Reopening it does not itself change your choice. Withdrawing permission stops future optional collection, clears the supported first-party measurement identifiers and cookies, and can reload the page to stop an already loaded Google tag. We cannot erase a third party's prior records merely by clearing browser cookies; contact us for an applicable deletion request. The consent preference is stored for up to 180 days before a fresh choice is required. Local campaign attribution is retained for up to 90 days. First-party attribution stores or appends advertising click identifiers only when analytics and advertising choices both permit that use; withdrawing advertising permission removes those identifiers even if analytics remains enabled.

In the updated app, behaviour analytics is optional, disabled by default and tied to the signed-in account. A prior choice by another account or an unattributable old device-wide preference is not carried forward. Signed-out collection is off. It uses custom events sent to Firebase services when enabled; the current app does not use the Firebase Analytics or Crashlytics SDK. Use the app's analytics setting to change the choice. When you have turned it on, Emblem administrators can also see those events, such as app opens and the screens visited, in your account's record for support and to improve the service. The updated app has a separate necessary diagnostic path that can send the signed-in user's account identifier, error class, a permitted diagnostic code, software stack locations, version/build/platform and time to the service for reliability and safety. It discards arbitrary exception prose, local file paths, private URLs and free-form context. The fingerprint is derived from those reduced diagnostic fields. Older records can contain bounded error text, stacks or context until their expiry or removal. Turning off optional behaviour analytics does not turn off that necessary diagnostic processing. It must remain limited to those purposes and avoid unnecessary sensitive content.

App install check. An administrator can ask our notification provider whether the Emblem app is still installed on the devices registered to receive your notifications. We send a silent message to each notification token held for your account; it shows nothing and changes nothing on the device. If the provider answers that the app is no longer installed on a device, we record that result and the time of the check with your account and delete the token that no longer works. Accounts without a notification token are not checked. The result is visible only to Emblem administrators, is replaced by the next check and is deleted with the account. We rely on our legitimate interest in accurate records and in not sending notifications to removed apps; you can object as explained below.

8. Providers and disclosures

We do not sell personal data. Emblem does not upload app-user email addresses, identifiers, location, purchases or activity to advertising audiences, cross-company advertising measurement or data brokers. Optional consented website measurement is a separate practice described above. We disclose relevant data to providers needed for the requested service, acting under the appropriate contractual and legal conditions:

Provider or category — Purpose and relevant data

Google Firebase and Google Cloud — Authentication, databases, uploaded media, notifications, hosting/functions and service diagnostics. Apple/Google sign-in supplies permitted account data when chosen.

Apple App Store and Google Play — Billing, transaction validation, renewals, refunds and restoration. Store transaction references and entitlement status are processed by Emblem.

OpenFreeMap and platform geocoding — Map tiles, location/place results and the request information needed to supply them.

Google Analytics and Google Ads — Optional website analytics and conversion measurement, when enabled through the applicable choice.

hCaptcha — Abuse-prevention checks on supported forms and the technical information needed for that check.

Email providers — Requested support/service correspondence and, if enabled and used, a gift invitation containing sender display name, recipient address and claim link. Supported gift invitations use Gmail SMTP.

Anthropic and Google AI/translation services — Feature-specific classification, descriptions or locality checks for cuisine, music and books, and requested text translation or pronunciation support. Submitted text/metadata and country/language context can be sent where the feature is enabled for eligible users. Cuisine and music classification, descriptions and locality checks, and text translation, use Anthropic's Claude API under its commercial terms; those terms do not mean that no provider processing, safety screening or lawful retention occurs. For a translation, the text you ask to translate (such as a post, caption, comment or bio) is sent with the target language. Server translation is distinct from the legacy direct mobile Google romanisation route. Older app versions can send the phrase and language with the device network request to that direct route. The updated app does not issue new requests through that route while its agreement coverage is unverified; local phrase, Latin-text and cached fallbacks remain available. The website chat also uses Anthropic's Claude API. It sends the messages you type, the answers you choose, and the page you are on with its language, so that it can write its replies. Before sending, it removes email addresses and phone numbers in international format that you type. We don't send your name or contact details to it. Automated moderation of content from accounts aged 18 or over also uses Anthropic's Claude API; it receives the content's text, photo links and type (section 13).

Catalogue and external media services — Book or song search queries can be sent from our server to Google Books, Open Library or Apple's iTunes catalogue, and supported track links can be checked against Spotify. These services return public metadata, links or images. Loading an externally hosted cover/image or opening a link can disclose your device's request information to that host. A catalogue lookup does not send the same fields as a classification request.

We do not intentionally send the account UID or email in the supported cuisine/music classification requests. Do not enter private or sensitive text into a feature that sends the requested text to an external provider. You may ask us for information about the relevant provider, destination, retention and applicable safeguards through the contact address above.

We can disclose necessary evidence to authorities when lawfully required, to protect rights or safety, or in a legitimate business transfer with the required safeguards and notice. We do not disclose a full profile where a limited record suffices. Routine partner reports use aggregate project/campaign measures. A named reward or project can need particular fulfilment details; identify the recipient and purpose before that disclosure.

A separately offered experimental payment, wallet or blockchain feature requires an advance notice naming the payment and chain providers, fields made public, custody arrangements and irreversible-record limits before information is sent. Where an earlier enabled feature created a custodial wallet, its address, encrypted recovery material and necessary account linkage can remain in restricted recovery records while needed to preserve the holder's assets, handle outstanding transactions and complete safe closure or recovery. Necessary legal records may remain after closure for their applicable period; unrelated profile and correspondence fields are removed. This policy does not silently authorise uploading a person's photo or location to a public chain.

9. International processing

Our current production Firestore database uses the European `eur3` region and our main Storage bucket uses the EU location. Live Portal presence uses Firebase Realtime Database in the `europe-west1` (Belgium) region. Some providers operate outside Luxembourg and the European Economic Area. Firebase Authentication and other services can use regional or global infrastructure. The location of our database and bucket does not establish the location of every provider operation, support activity or transfer.

Where a transfer requires safeguards, we use an applicable adequacy decision, standard contractual clauses with the necessary assessment and supplementary measures, or another valid mechanism for that particular transfer. Contact us to ask about the relevant destination and receive information or a copy of applicable safeguards, with appropriate redactions. We do not assume a provider is covered by an adequacy mechanism without checking the relevant entity and service.

10. Retention and deletion

Account and content records are held while needed to supply your active account and chosen features. Remove content through supported controls or request account deletion in settings. The current account-deletion process uses a 30-day grace period, during which signing in can cancel the request. After it ends, a scheduled process deletes or anonymises the active account and associated data; the next run or a retry can delay completion. A data-rights request is assessed separately and is not automatically postponed by the grace period.

Deletion is not a promise that every transaction or every independent copy vanishes immediately. We can retain the minimum information necessary for required accounting, tax, store reconciliation, prevention of a specific fraud, a current dispute, legal claims or another documented legal obligation. Required Luxembourg accounting records generally have a ten-year retention period from the relevant financial-year end. This does not justify retaining every profile, photo, precise location or unrelated technical record for ten years. Retained records must be separated from ordinary public/profile use and must not recreate a deleted account.

Detailed first-party website measurement events are scheduled for deletion after 420 days. The updated retention process schedules app behaviour events and server text-translation-cache entries for deletion after 90 days, and routine app diagnostic records after 30 days, subject to a documented legal or incident hold. Automated moderation records that flagged nothing are deleted after 90 days, and its per-account daily counts 30 days after their day (section 13). Live Portal presence is held only while you are in a room: your entry is removed when you leave, close the page, put the app in the background or lose the connection, and a room pass expires after 10 minutes unless renewed while you stay; no history of positions or actions is kept. A scheduled run or retry can delay removal; records missing an authoritative creation date require a separate assessment. The server does not reuse text-translation results after that cache lifetime; its in-memory request cache expires within five minutes or the earlier underlying expiry. Device translation/pronunciation caches and stored catalogue-language information are separate categories: they can remain locally or with the catalogue until cleared, replaced or no longer needed for their feature. A server-cache deadline does not erase those separate copies.

Support and application records are kept while the enquiry or project is being handled, then only to resolve an outstanding commitment, complaint or applicable claim. Private legal-notice receipts demonstrate the applicable agreement or notice while the account is held; routine account deletion removes that private receipt history. Any separate evidence retained for a specific outstanding claim must be necessary, restricted and governed by its own applicable period. Moderation and security evidence is kept for the investigation, challenge and any necessary legal or safety proceedings; closed cases require periodic retention review. The period depends on the category, resolution event, relevant legal period and documented hold, rather than indefinite ordinary use. Once the purpose and applicable claim or legal period ends, the records are deleted or irreversibly anonymised. An unresolved case can justify only necessary evidence, with periodic review.

Our production Firestore backup schedule is weekly, with a 30-day retention period for each backup. A database record removed from active use can remain in a preceding backup until that backup expires. Our main Storage bucket keeps a deleted object recoverable for seven days under its soft-delete policy. These recovery periods are separate from the account's 30-day deletion grace period and from any documented category-specific retention. Recovery copies are restricted to recovery and necessary security purposes. A restore is not authorised for ordinary service use until applicable deletion requests and restrictions have been checked and reapplied. These checks may require manual work; we do not promise automatic erasure across every recovery copy. Other providers can have their own disclosed backup or deletion cycles; we will explain a relevant delay or exception when answering your request.

We cannot promise removal of somebody else's independent lawful copy, but must take the steps within our responsibility and notify recipients where the law requires. Accepted gifts and delivered messages may remain in the selected recipient's Emblem account after the sender deletes their account. This can include the shared message and photo and their necessary object references; it is a recipient copy within Emblem, not an independent external copy or an accounting record. We remove unnecessary sender profile linkage and assess any request affecting that content under applicable privacy, image, erasure and recipient rights. Wallet recovery records, transaction verification references and recipient copies can still be personal data even after other profile fields are removed.

11. Security

We use controls such as restricted account/database access, encrypted transport, protected administration, abuse prevention and provider security measures. The purpose is to reduce unauthorised access, alteration or loss. No system is risk-free. Publicly available URLs, cache behaviour and visibility changes require the same attention as database permissions; a policy statement does not make an exposed image private.

Report a concern at our contact address with enough information to locate it, without exploiting it or sending unnecessary personal data. We investigate relevant incidents and make legally required notifications.

12. Your rights and response times

Subject to the relevant conditions and exceptions, you may request access and a copy, correction, erasure, restriction, portability or object to processing. Portability applies to the data and automated processing covered by that right; it does not require disclosure of another person's protected information. Contact us to request the applicable copy or structured export; account deletion is a separate control.

You may withdraw consent at any time through the relevant control or by contacting us. You may object to legitimate-interest processing for reasons relating to your situation. Direct-marketing objections are honoured for that marketing. A necessary service or legal record can have a different lawful basis; we will explain it rather than treating all processing as optional.

We respond without undue delay and normally within one month. A permitted extension of up to two further months requires notice within the first month, with the reason. If we cannot act on a request, we explain the reasons and the available complaint or court route. Requests are ordinarily free; any lawful exceptional refusal or charge must be justified. Identity checks are limited to what is reasonably necessary and proportionate to prevent disclosure to the wrong person.

Contact danielmichels@emblemdigitalsouvenirs.com. You can complain to Luxembourg's Commission nationale pour la protection des données (CNPD) at https://cnpd.public.lu/ or another competent supervisory authority. Contacting Emblem first is helpful but is not a condition of that right.

13. Automated controls

Collection, purchase, eligibility and anti-abuse checks can be automated. Feature-specific AI can assist classification and language functions. Those uses must not be confused with verified identity or a guarantee that generated information is correct. We do not use face-tracking geometry for identification or profiling.

Automated moderation. To help keep Emblem safe, an automated check can review new or changed posts (caption and photos), comments (on posts, Emblems, gifts and People photos), food and drink photos (the photo, its place and dish name) and profile details (display name, username and profile picture). It runs only for accounts whose date of birth shows that the holder is 18 or older; content from younger accounts, or from accounts whose age is unknown, is not sent. The check uses Anthropic's Claude API (section 8). It receives the text, links to the photos and the type of content, not your account ID, name or email address. It looks for content that may break our rules, such as sexual content, violence, hate, threats, self-harm, insults, spam, other people's personal data or photos that do not show what they claim to show. It does not delete content and does not restrict or close accounts. Anything it flags goes to our moderation queue, where a person reviews it. Only a post or food photo it judges severe can be hidden from others before that review; you still see your own post, and it stays hidden until a person has reviewed it and decided whether to restore it. We keep a record of each check (type of content, a short excerpt, photo links and the result) in a restricted area. A record that did not flag anything, including a check that could not be completed, is deleted after 90 days; a record that flagged content is kept as moderation evidence (section 10). We also count each account's checks per day, to keep a daily limit per account; these counts are deleted 30 days after that day. All of an account's records and counts are deleted with the account. We rely on our legitimate interest in a safe community; you can object, ask about a check, or ask for a person to look again, using the contact in section 12.

If an automated check wrongly restricts you, contact us with the relevant account, transaction or content reference for review. Any solely automated decision producing a legal or similarly significant effect requires the separate lawful conditions, notice and safeguards that apply; this policy is not a blanket authorisation for such decisions.

14. Children

Registration is not offered to children under 13. A 13-year service floor is distinct from contractual capacity and from the age at which a child can give their own valid consent. In Luxembourg, consent-dependent online services for a child under 16 require appropriate authorisation by the holder of parental responsibility. Other jurisdictions can differ.

In updated app and server controls, optional app behaviour analytics is unavailable when the server-held date of birth shows an age below 16 or when age cannot be established. The date of birth is self-declared and is not verified identity. We do not currently offer a guardian-consent exception for that analytics feature. Any other consent-dependent child feature must have the appropriate age or verified guardian safeguards before it is enabled. A checkbox or local content-filter PIN is not guardian verification.

External AI features can have stricter eligibility and provider conditions than ordinary account registration. Updated server controls reject new model requests from under-18 or unknown-age accounts where the necessary guardian or supplier conditions have not been established. A provider can remain disabled while its eligibility and contractual scope are checked; account ownership by Emblem is not itself proof of that scope. Ordinary access to public catalogue information is distinct from sending a new request to a model. Age eligibility alone does not establish that the provider has approved the product's scope. Content from under-18 or unknown-age accounts is not sent for automated moderation; people moderate it, for example after a report.

Contact us if a child has registered improperly or appears in content without the necessary permission. We will assess removal, account action and the applicable rights promptly, with a child's interests in mind.

15. Website chat

Every page of our website has a chat that answers questions about Emblem. It is an AI assistant (Claude, by Anthropic) and is labelled as one. Please don't type personal or sensitive information in it.

What we keep. The conversation stays in your browser while the tab is open. We don't store chat transcripts on our servers. To prevent abuse, we count the messages sent from each IP address, under a keyed hash of the address that changes every day, and delete the counts within 48 hours.

Basis. Answering you is a step you ask for before a possible contract (Art. 6(1)(b) GDPR). Abuse prevention is our legitimate interest (Art. 6(1)(f) GDPR).

Talking to us. If you ask us to contact you, we receive your name, organisation, email and place, your answers, a short summary and the conversation. We receive them only when you ask us to contact you. We use them to reply to you and to prepare your project. If no project follows, we delete them within 12 months.

16. Changes and version history

We update this policy when processing, providers, law or controls change. We publish the version and effective date, describe material changes and give an appropriate additional notice. A new notice cannot retrospectively create consent that was never obtained. A new purpose that requires consent is offered with a separate valid choice before it starts.

The preceding version was 2026-10-19, effective 19 October 2026, before live Portal visits and the Expo plaza; it remains available at https://emblemdigitalsouvenirs.com/legal/2026-10-19/privacy.en.html. Earlier versions remain available too: 2026-10-18, effective 18 October 2026, before the app install check (https://emblemdigitalsouvenirs.com/legal/2026-10-18/privacy.en.html); 2026-10-15, effective 15 October 2026, before automated moderation (https://emblemdigitalsouvenirs.com/legal/2026-10-15/privacy.en.html); 2026-10-14, effective 14 October 2026, before text translation moved to Anthropic's Claude API (https://emblemdigitalsouvenirs.com/legal/2026-10-14/privacy.en.html); 2026-10-12, effective 12 October 2026, which added the website chat (https://emblemdigitalsouvenirs.com/legal/2026-10-12/privacy.en.html); 2026-10-08, effective 8 October 2026, which named Anthropic for the cuisine and music checks (https://emblemdigitalsouvenirs.com/legal/2026-10-08/privacy.en.html); and 2026-09-30, effective 30 September 2026, which named OpenAI for those checks (https://emblemdigitalsouvenirs.com/legal/2026-09-30/privacy.en.html). The website privacy policy before that was dated 30 August 2026; the app's old summary was dated 20 July 2024. The published version and effective date identify the applicable notice. The preceding public HTML responses are preserved in the archive linked with this policy. You can also request the version relevant to your account or order. Localized summaries accompany the full English policy; they are explicitly identified as summaries, not complete translations.

Contact: danielmichels@emblemdigitalsouvenirs.com.

Versão pública anterior

O arquivo preserva a resposta HTML pública capturada antes desta atualização. É uma cópia histórica e não descreve o tratamento atual.