01Who we are and what this covers
This Privacy Policy explains how PolyEmbed (“PolyEmbed,” “we,” “us”) collects, uses and shares personal information when you use polyembed.io, the PolyEmbed widget embedded on publisher websites, the reader portfolio, the publisher dashboard and our APIs (the “Services”). It is part of our Terms of Service.
It does not cover:
- Publisher websites. The site that embeds our widget is run by an independent publisher with its own privacy practices.
- Polymarket. When you trade, Polymarket receives your orders and wallet details and handles them under the Polymarket Privacy Policy.
- Privy. If you choose “Continue with email,” Privy collects your email and runs your embedded wallet under the Privy Privacy Policy. We receive a Privy user ID and your wallet address, not your keys.
02Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and account data (publishers) | Name, email address, Firebase account ID, company or site name, login timestamps | You, when you sign up; Firebase Authentication |
| Domain and business data (publishers) | Verified domains, DNS or file verification records, widget settings, payout wallet address, payout history | You |
| Wallet and transaction data (readers) | Signer and Polymarket deposit wallet addresses, wallet type, Privy user ID if you use email sign-in, orders, fills, relayer transaction hashes | Your wallet, Privy, Polymarket and public blockchains |
| Internet and device activity | Widget views and clicks, page URL and referrer, browser user agent, random session and anonymous IDs, a salted one-way hash of your IP address | Automatically, from your browser |
| Approximate location (inference) | Whether Polymarket reports trading as restricted for your connection. We do not store your precise location. | Polymarket's location check, run in your browser |
| Consent records | Which terms version a publisher accepted, when, hashed IP and user agent | Automatically, when you accept |
| Communications | Emails and support requests you send us | You |
What we never collect: private keys, recovery phrases, wallet passwords, payment card or bank numbers, or government ID numbers. We do not collect sensitive personal information as defined by U.S. state privacy laws, other than account login credentials that Firebase handles for publishers.
04How we use information
- to run the Services: match markets to articles, show prices, connect wallets, build and relay your signed orders;
- to check trading eligibility and enforce geographic and sanctions restrictions;
- to attribute orders to publishers, reconcile builder fees and pay revenue share;
- to give publishers aggregated performance reports for their own widgets;
- to secure the Services, rate-limit abuse, and detect fraud, wash trading or manipulation;
- to understand usage and improve the product;
- to communicate with publishers about their accounts, payouts and changes to our terms;
- to comply with law, respond to lawful requests, and establish or defend legal claims.
06How long we keep it
We keep personal information only as long as needed for the purposes above:
- Publisher account data: while your account is open, then up to 3 years for legal, tax and dispute purposes.
- Order, attribution and payout records: up to 7 years, to meet accounting and tax obligations.
- Widget usage events: as long as they are useful for analytics, attribution and fraud review, which we aim to keep under 25 months.
- Terms acceptance records: for as long as the agreement they evidence may be relevant.
Data already written to a public blockchain cannot be deleted by anyone.
07Security
We use encryption in transit, access controls, secret management and one-way hashing of IP addresses to protect your information. Our design is non-custodial so that we never hold keys or funds. No system is perfectly secure, and we cannot guarantee the security of information sent over the internet. If a breach affects your personal information, we will notify you and regulators as required by applicable state law.
08Your privacy rights
Residents of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and other states with comprehensive privacy laws may have some or all of these rights, subject to exceptions in the law:
- Know and access the personal information we hold about you and how we use it;
- Correct inaccurate information;
- Delete information we collected (on-chain data excepted);
- Portability, a copy in a usable format;
- Opt out of the sale or sharing of personal information, targeted advertising and profiling. We do not do these, and we honor GPC regardless;
- Non-discrimination for exercising your rights.
How to make a request
Email [email protected]. Readers should send from, or include, the wallet address the request concerns; we may ask you to sign a message with that wallet to prove control. Publishers should write from their account email. You may use an authorized agent, who must provide your signed permission. We will respond within 45 days, or tell you if we need up to 45 more.
Appeals
If we decline your request, you can appeal by replying with “Appeal” in the subject line. We will answer within 60 days. If you are not satisfied, you may contact your state attorney general.
California disclosures
In the past 12 months we collected the categories in Section 2 for the purposes in Section 4 and disclosed them for business purposes to the recipients in Section 5. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing the information of anyone under 16. Under California's “Shine the Light” law, we do not disclose personal information to third parties for their own direct marketing.
Nevada
We do not sell covered information as defined by Nevada law. You may still send an opt-out request to [email protected].
09Children
The Services are for adults 18 and over and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact [email protected] and we will delete it.
10Where data is processed
We are based in the United States, and our service providers process data in the United States and other countries. By using the Services you understand your information will be transferred to and processed in those countries, which may have different data protection laws than where you live.
11Changes to this Policy
We will post any update here with a new effective date. If a change is material, we will give notice on the site or by email to publishers before it takes effect, and we will ask for consent where the law requires it.
12Contact
Privacy questions and requests: [email protected].