Privacy Policy
Last updated: February 16, 2026
1. Data Controller
The controller responsible for data processing on this website is:
2. Scope
This Privacy Policy explains the nature, scope, and purpose of the processing of personal data ("data") in connection with the provision of the EPOS-AI platform.
Legal bases: This Privacy Policy is based on:
- Swiss Federal Act on Data Protection (FADP)
- EU General Data Protection Regulation (GDPR) for EU customers
- UK GDPR and Data Protection Act 2018 for UK customers
3. Data We Collect
3.1 Account Data
Upon registration we collect:
- Email address (for login and communication)
- Name (optional, for billing)
- Password (stored encrypted)
3.2 Payment Data
Payments are processed by Stripe. We do NOT store credit card data on our servers.
The following data is stored for billing purposes:
- Stripe Customer ID
- Subscription ID
- Billing address (if provided)
3.3 Usage Data
During use of the Service we process:
- Your texts and projects (stored on servers in Switzerland)
- Usage statistics (number of API calls, models used)
- Technical logs (IP address, browser, timestamps)
3.4 Cookies and Tracking
We use the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| epos_refresh | Login session: keeps you signed in (strictly necessary) | 30 days |
| epos_admin_token | Internal sign-in for EPOS staff (strictly necessary, never set for customer accounts) | 1 hour |
| epos_attribution | Referral program: links a signup to the referring person (strictly necessary for this feature) | 30 days |
| epos_first_touch | Reach measurement, see section 3.5 (runs independently of your cookie choice) | 30 days |
All four cookies are set server-side (HttpOnly) and cannot be read by JavaScript.
We currently do NOT use Google Analytics or any other third-party tracking tools.
3.5 First Contact (Reach Measurement)
On your very first visit, we note which page and which source led you to us (for example a search engine, a referral link, or an advertising campaign), along with the time and your language setting. We do not store the full referring address, only the originating domain. If you register within 30 days, we link this information to your account so we can see which content actually leads to new customers. We build from this exclusively aggregated daily figures without names, email addresses, or payment details; we use these figures, not your individual data, to improve our content. If you do not register, the raw data is automatically deleted after 31 days. This measurement runs independently of your cookie choice, because it stays exclusively on our own infrastructure and is not shared with any third party.
4. Legal Bases for Processing
| Data Type | Legal Basis (GDPR) |
|---|---|
| Account data, payment data | Art. 6(1)(b) GDPR (contract performance) |
| Usage data, logs | Art. 6(1)(f) GDPR (legitimate interests) |
| Marketing emails | Art. 6(1)(a) GDPR (consent) |
5. Disclosure to Third Parties
5.1 Anthropic (Claude API)
Purpose: Generating AI responses
Recipient: Anthropic PBC, USA
Privacy: anthropic.com/privacy
Commercial API terms and current provider information:
- Anthropic states that commercial API inputs and outputs are not used for model training by default
- Data is encrypted in transit
- EU Standard Contractual Clauses in place
5.2 Stripe (Payment Processing)
Purpose: Processing payments
Recipient: Stripe Payments Europe Ltd., Ireland / Stripe Inc., USA
Privacy: stripe.com/privacy
5.3 Resend (Transactional Emails)
Purpose: Sending transactional emails (registration, password reset, subscription confirmations)
Recipient: Resend, Inc., USA
Data transmitted: Name, email address
Legal basis: Art. 6(1)(b) GDPR (contract performance)
5.4 No Other Recipients
We do NOT share your data with:
- Advertising networks or data brokers
- Social media platforms
- Analytics services (e.g. Google Analytics)
6. Storage Location and Security
6.1 Server Location
Your data is stored on servers in Switzerland.
Hosting: FireStorm ISP GmbH, Kirchenrainstrasse 27, 8632 Tann (ZH), Switzerland, CHE-114.927.665 (Swiss company, servers in Switzerland, Swiss data protection law)
6.2 Security Measures
- Encryption in transit: TLS 1.3 for all data transfers
- Encryption at rest: Database encryption (AES-256)
- Access control: Passwords hashed with bcrypt
- Backups: Daily encrypted backups
- Firewall: Access restricted to necessary ports
6.3 No Absolute Security
7. Retention Periods
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion |
| Projects and texts | Until manual deletion |
| Payment data | 10 years (statutory retention obligation) |
| Logs (IP addresses) | 30 days |
| After account deletion | 30 days (backup retention), then complete deletion |
8. Your Rights
You have the following rights regarding your data:
8.1 Right of Access (Art. 15 GDPR)
You may request information about the data we hold about you.
8.2 Rectification (Art. 16 GDPR)
You may request correction of inaccurate data.
8.3 Erasure (Art. 17 GDPR)
You may request deletion of your data ("right to be forgotten").
8.4 Restriction (Art. 18 GDPR)
You may request restriction of processing.
8.5 Data Portability (Art. 20 GDPR)
You may download your data in a structured format (JSON/CSV).
8.6 Objection (Art. 21 GDPR)
You may object to processing on grounds relating to your particular situation.
8.7 Withdrawal of Consent
Where processing is based on consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
8.8 Complaint to a Supervisory Authority
Switzerland:
Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch/en
UK:
Information Commissioner's Office (ICO)
ico.org.uk
EU:
The supervisory authority of your EU member state
9. Data Processing by Anthropic
9.1 What is transmitted?
- Your text inputs and prompts
- Conversation history within a project
- Technical metadata (model, settings)
9.2 What is NOT transmitted?
- Your name or email address
- Payment information
- Account data
9.3 Anthropic's Privacy Commitments
- No use of your data for AI training (Commercial Terms)
- Deletion after processing (unless otherwise configured)
- SOC 2 Type 2 certified
- GDPR-compliant Standard Contractual Clauses
10. No Training on Your Data
We confirm:
- Your texts are NOT used to train any AI models
- Your texts are NOT sold or shared with third parties
- Your texts are NOT made public
11. Children
Our Service is not directed at persons under 18 years of age. We do not knowingly collect data from minors.
12. Changes to This Policy
We reserve the right to update this Privacy Policy to reflect changes in law or in our Service. Changes will be announced by email. The current version is always available on this page.
13. Contact and Data Requests
For questions about privacy or to exercise your rights, please contact:
We respond within 30 days.
