Privacy Policy
This Privacy Policy describes how EpochCore LLC ("EpochCore", "we") handles personal data in connection with the Envelope service.
1. What we collect
- Account / contact data: name, work email, company, and any details you enter into the access-request form.
- Operational data: envelope request metadata (agent_id, timestamp, decision hash, signature material). Decision payload plaintext is not retained on our infrastructure unless you explicitly enable payload retention.
- Billing data: handled by our payment processor (Stripe). We do not store full card numbers.
- Standard server logs: IP, user agent, and request path, retained for security and abuse-prevention purposes.
2. What we don't collect
We do not run advertising trackers, third-party analytics that profile individuals, or session replay tools on this site.
3. Why we use it
To operate the service, respond to access requests, bill paid plans, prevent abuse, and meet legal obligations. Envelope hashes and chain anchors are inherently public (that is the product).
4. Retention
- Access-request submissions: 90 days, then deleted unless converted into an active pilot.
- Envelope metadata: retained for the life of the chain; required for verification.
- Server logs: 30 days for general logs, longer where security incidents warrant.
5. Your rights
If you are in the EU/UK (GDPR) or California (CCPA/CPRA), you have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise these rights, email privacy@epochcoreqcs.com. We respond within 30 days. Note: envelope hashes and chain anchors cannot be deleted without invalidating the audit trail for which they were issued; we will discuss appropriate cryptographic blinding on request.
6. Sub-processors
- Cloudflare, Inc. — edge compute, DNS, request termination.
- Resend.com — transactional email (access-request and key-delivery notifications).
- Stripe, Inc. — payment processing.
7. International transfers
Data may be processed in the United States and other regions where our sub-processors operate. Where required, we rely on standard contractual clauses or equivalent transfer mechanisms.
8. Security
API access is authenticated. Signing keys are operated under FIPS-aligned procedures. Report suspected vulnerabilities to security@epochcoreqcs.com.
9. Changes
We may update this Policy. Material changes will be announced via the email on file and reflected in the "Last updated" date above.
10. Contact
EpochCore LLC · privacy@epochcoreqcs.com