Privacy Policy

1. About this policy

This policy explains how Epiow Limited ("we" or "us") collects, uses and protects personal data when you visit epiow.com, create an account or use the Epiow workspace and its apps. We are the controller of this data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU GDPR or other local law also applies, sections 14 and 15 explain what changes.

2. Your workspace data

Data that an organisation, household or person puts into a workspace (for example employee records, payroll schedules, meeting audio, Epiow Minutes transcripts, pupil records or household documents) belongs to the workspace. For that data, the workspace owner is the controller and we process it only on their instructions, under the processing terms at epiow.com/legal/dpa. Before recording, uploading or transcribing any meeting, call or conversation (including via Epiow Minutes or Epiow AI), the workspace customer and User are solely responsible as controller for giving all legally required notices and obtaining all legally required consents from every participant under all applicable one-party and all-party recording, wiretapping and data-protection laws. If you are an employee, meeting participant, pupil or member of someone else's workspace, send requests about workspace data to that workspace's administrator; we assist them as those processing terms require.

3. What we collect

As controller, we collect:

• Account details: name, email address and the workspaces you belong to.
• Workspace details: its name, type, country and the plan it is on.
• Billing details: billing contact, address, VAT number and invoices. Card details go to our payment provider and never reach us.
• Usage and device data: sign-in records, IP address, browser and device type, how the Service is used, and security logs.
• What you send us: support requests, feedback and messages to sales.

4. Why we use it, and our lawful basis

We use personal data for these purposes:

• To provide the Service to you, create and secure your account, and bill you, because it is necessary for our contract with you (UK GDPR Article 6(1)(b)).
• To keep accounting and tax records and answer lawful requests from authorities, because the law requires it (Article 6(1)(c)).
• Because we have legitimate interests that are not overridden by your rights (Article 6(1)(f)): to provide the Service to the Users of an organisation's workspace, run billing and accounts, keep the Service secure, detect and prevent fraud and abuse, fix and improve the Service, market our services to business customers and their contacts, and prepare for or carry out a sale or reorganisation of our business. You can request the balancing test we rely on by emailing legal@epiow.com.
• To send product news to individuals: with your consent, or, where you are an existing customer, about similar services unless you opt out. You can withdraw consent or opt out at any time from the link in each email (Article 6(1)(a) and 6(1)(f)).

5. AI features

When you use Epiow AI or Epiow Minutes, what you submit and the workspace data or audio required to fulfil the request are sent to our AI and speech providers to generate an automated output. We do not use your content to train AI models, and our AI providers may not use it for training. With zero data retention on (Settings, Security), providers keep no request data; with it off, they may keep request data for a limited period solely to detect abuse. All Epiow AI outputs and Epiow Minutes transcripts and summaries are automated decision-support outputs provided "AS IS" without warranty of verbatim accuracy and require human review prior to reliance.

6. Who we share it with

We do not sell personal data. We share it:

• with service providers that host, secure, support or bill for the Service, under written contracts; they are listed at epiow.com/legal/subprocessors;
• with our professional advisers, auditors and insurers;
• with authorities, courts or others where the law requires it or where needed to establish, exercise or defend legal claims;
• with a buyer, investor or successor, or their advisers, if all or part of our business or its assets is sold, financed or reorganised; and
• with anyone else when you ask us to or agree.

7. International transfers

Some providers process data outside the United Kingdom. When data leaves the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum issued by the Information Commissioner, with additional safeguards where needed. You can ask for a copy of the applicable safeguards by emailing legal@epiow.com. We host the Service on Sylphx Cloud, provided by Sylphx Limited. Your data is stored and processed in data centres in the European Union (Germany); encrypted backups are kept in the EU (Netherlands). Traffic is delivered through Cloudflare's global network. We do not promise that data stays in a particular location unless an Enterprise order form we have signed says so. We may change the hosting location or provider on notice under the subprocessor terms.

8. How long we keep it

We keep account data while the account is open, and billing and accounting records for as long as tax law requires. Backups and logs are kept for a limited period and then overwritten or deleted. After a workspace is closed and its export period has passed, we delete or anonymise its data. We may keep data for longer where the law requires it, or where we need it to establish, exercise or defend legal claims or to prevent fraud and abuse.

9. Security

We protect personal data with measures appropriate to the risk, which currently include the following. No system is completely secure, and we cannot guarantee the security of data sent to or stored in the Service.

• encryption of data in transit (TLS);
• separation of each workspace's data from every other workspace's data;
• role-based access control, with access to production data limited to staff who need it; and
• audit logs of administrative actions.

10. Your rights

Under the UK GDPR and the Data Protection Act 2018 (and nothing in our Terms limits your mandatory statutory rights as a data subject under UK law), subject to statutory conditions and exemptions, you have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, where there is no reason for us to keep it;
• restrict how we use your data;
• receive your data in a machine-readable format, or have it sent to another provider;
• withdraw consent where we rely on it; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.

11. Your right to object

You have the right to object at any time to our processing of your personal data based on our legitimate interests, on grounds relating to your situation, and to object to direct marketing, in which case we will stop.

12. Using your rights and complaints

Send all UK GDPR and Data Protection Act 2018 rights requests, privacy enquiries and formal data-protection notices strictly to legal@epiow.com. We may ask you to confirm your identity first. We answer within one month, which we may extend by two further months where a request is complex or one of several, and we will tell you if we do. We carry out reasonable and proportionate searches. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it. If you are unhappy with how we handle your data, you have the statutory right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk, though we invite you to contact legal@epiow.com first so we can address your concern promptly.

13. Children

People must be 18 or over to have an Epiow sign-in. A household or school workspace can include children as members without their own sign-in, managed by a parent, guardian or the school, which is the controller of that data. We do not use children's data for advertising or profiling, and use it only to provide the workspace.

14. If you are in the European Union

If the EU GDPR applies to our processing of your data, you have the same rights as in sections 10 and 11 and the same lawful bases apply. You may also complain to the data protection authority in the EU country where you live or work.

15. If you are in Hong Kong

If the Personal Data (Privacy) Ordinance (Cap. 486) applies, you may ask to access and correct personal data we hold about you, and you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong. Personal Information Collection Statement (PDPO). Data user: Epiow Limited (see section 1). Purposes: providing and securing the Service, billing, support, fraud and abuse prevention, legal compliance, and improving the Service. Supplying the account details we ask for is necessary to open an account; without them we cannot provide the Service. Classes of transferees: our subprocessors (hosting, email delivery, payments and AI inference providers, in each case under written terms), our professional advisers, authorities where the law requires, and a successor to our business. Data may be transferred outside Hong Kong, including to the United Kingdom and the European Union. Send PDPO data access and correction requests strictly to legal@epiow.com; we may charge a reasonable fee for a data access request as the Ordinance permits.

16. Cookies

We use only the cookies the Service needs to keep you signed in and to work, and any other cookie only with your consent. We do not use advertising cookies. Details are at epiow.com/legal/cookies.

17. Changes to this policy

We may update this policy. Material updates assign a new Privacy Policy version and are surfaced in the workspace console alongside the updated date above. If we plan to use your personal data for a materially new purpose, we will notify you beforehand.

18. Contact

Send all privacy enquiries, UK GDPR / Data Protection Act 2018 / ICO requests, PDPO requests and formal legal notices strictly to legal@epiow.com. Routine product operational and billing questions go to hi@epiow.com (frontline support does not interpret privacy or legal clauses and escalates regulatory or legal notices to legal@epiow.com under Legal Hold).