Privacy Policy
Effective 2026-05-18 · Governing law: State of North Carolina, USA
Draft — pending counsel review. Substantive terms below are binding; minor language may be refined.
1. What we collect
- Account data — email, billing address, payment
method (held by Stripe; we never see your card number).
- Usage data — API requests, response metadata,
meter events for billing. Request bodies are not retained beyond
operational logs (≤ 30 days).
- Operational telemetry — sealed audit envelopes
anchoring each paid operation; cryptographic only, contain no
personal data.
2. What we do with it
- Provide and improve the Service.
- Bill you for usage via Stripe.
- Send transactional email (welcome, receipts, security alerts) via
Resend. We do not market via email without explicit opt-in.
- Detect abuse, fraud, and security incidents.
3. Who we share with
We share data only with the minimum set of vendors required to run
the Service:
- Stripe — payment processing and subscription
management.
- Cloudflare — edge compute and DDoS protection.
- Resend — transactional email delivery.
We do not sell personal information. We do not share data with
advertisers.
4. How long we keep it
- Account data: until you delete your account, then 30 days.
- Operational logs with request bodies: ≤ 30 days.
- Sealed audit envelopes (no personal data): 7 years (regulatory
retention SEC-17a-4 / FINRA-4370 / SOC 2 controls).
- Billing records: 7 years (US tax retention).
5. Your rights
You can access, export, correct, or delete your account data at any
time. Email privacy@epochcoreqcs.com
with your request — we respond within 30 days. EU/UK/California
residents have additional rights under GDPR, UK GDPR, and CCPA; the
process to exercise them is the same.
6. Security
We use industry-standard controls: TLS for data in transit,
encryption at rest for sensitive data, principle-of-least-privilege
access, sealed audit chains for every paid operation, post-quantum-
hybrid signatures (Ed25519 + ML-DSA-87) on every receipt.
7. Children
The Service is not directed to children under 16 and we do not
knowingly collect their data.
8. International transfers
We're a US company; data is processed in the US and in Cloudflare's
global edge network. EU/UK residents: we rely on Standard Contractual
Clauses with our subprocessors.
9. Changes
We'll announce material changes here with the effective date and,
where reasonable, by email.
10. Contact
privacy@epochcoreqcs.com
· EpochCore LLC, Charlotte, NC.