Privacy Policy
This Privacy Policy describes how EpochCore LLC ("EpochCore", "we", the controller for the data described below) handles personal data in connection with the EU AI Act Compliance service. Where EpochCore processes personal data on your behalf as a processor under GDPR Article 28, the DPA governs.
1. What we collect
- Contact data: name, work email, company, role, and details you submit in the compliance-call form.
- Service operational data: envelope request metadata (agent_id, timestamp, decision hash, signature material). Decision payload plaintext is not retained on our infrastructure unless you explicitly enable payload retention.
- Billing data: handled by Stripe (where applicable) or via invoice. EpochCore does not store full card numbers.
- Standard server logs: IP, user agent, request path. Retained for security and abuse-prevention.
2. Lawful basis (GDPR Article 6)
- Consent — for the marketing follow-up checkbox on the call form (Art. 6(1)(a)).
- Contract — to perform our agreement with paying customers (Art. 6(1)(b)).
- Legitimate interests — service operations, security, abuse-prevention (Art. 6(1)(f)).
- Legal obligation — where required (Art. 6(1)(c)).
3. Retention
- Call-form submissions: 90 days from submission, then deleted unless converted to an active pilot or paying customer.
- Envelope metadata: retained for the life of the chain (required for verification).
- Sealed audit records: 7 years from issuance, aligned with SEC Rule 17a-4(f) retention.
- Server logs: 30 days for general logs, longer where security incidents warrant.
4. Recipients and sub-processors
- Cloudflare, Inc. — edge compute, DNS, request termination.
- Resend, Inc. — transactional email (form notifications).
- Stripe, Inc. — payment processing (where credit-card billing is used).
A current sub-processor list is available at dpo@epochcoreqcs.com.
5. International transfers
Personal data may be processed in the United States and other regions where our sub-processors operate. For EEA/UK/Swiss data subjects, we rely on the EU Standard Contractual Clauses (Module 2, controller-to-processor) or, where applicable, the UK International Data Transfer Addendum, as the transfer mechanism. Copies available on request.
6. Your rights (EEA / UK)
You have the right to access, rectify, erase, restrict, port, and object to processing. You also have the right to withdraw consent at any time and to lodge a complaint with your supervisory authority. Exercise rights by emailing dpo@epochcoreqcs.com. We respond within 30 days.
Note: envelope hashes and chain anchors cannot be deleted without invalidating the audit trail for which they were issued; cryptographic blinding alternatives can be discussed on request.
7. Your rights (California — CCPA/CPRA)
If you are a California resident, you have rights to know, delete, correct, and limit use of sensitive personal information. We do not sell or share personal data for cross-context behavioral advertising. Exercise rights via dpo@epochcoreqcs.com.
8. Security
API access is authenticated. Signing keys are operated under FIPS-aligned procedures (Ed25519 + ML-DSA-65, NIST FIPS 204). Report suspected vulnerabilities to security@epochcoreqcs.com.
9. Changes
We may update this Policy. Material changes will be announced via the email on file and reflected in the "Last updated" date above.
10. Contact
EpochCore LLC · Data Protection Officer: dpo@epochcoreqcs.com