Privacy Policy
DRAFT v1 — FOR ATTORNEY REVIEW ONLY. This document is a working draft prepared for legal counsel and does not constitute legal advice. Do not publish until reviewed and approved by counsel.
Effective date: [EFFECTIVE DATE] Operated by: [LEGAL ENTITY NAME], [REGISTERED ADDRESS] ("EpicMe", "we", "us")
1. Who We Are and What This Policy Covers
EpicMe builds AI "Droids" — professional digital twins of real people. Our customers are typically companies ("Customers") that deploy Droids on behalf of their staff or other individuals (each a "Subject"). Third parties that query a Droid through its API are "API Consumers".
This Privacy Policy explains what personal data we collect, why, on what legal basis, how long we keep it, who we share it with, and what rights you have. It applies to our websites, applications, APIs, and related services (the "Services").
This Policy works alongside two other documents that we reference but do not reproduce here:
- our Master Services Agreement (MSA) — the commercial terms between EpicMe and each Customer; and
- our Data Processing Addendum (DPA) — the data-protection terms that govern our processing on a Customer's behalf, including EU Standard Contractual Clauses.
If anything in this Policy conflicts with the DPA for data we process on a Customer's behalf, the DPA controls.
2. The Most Important Thing: Who Is Responsible for Your Data
This split matters, and it is often gotten wrong, so we state it plainly.
When the Customer is the controller and EpicMe is the processor
For most of the data flowing through our Services — intake answers, uploaded documents, web-research findings, generated profiles, Droid query logs, and everything else that makes up a Subject's Droid — the Customer decides why and how that data is used. In GDPR terms, the Customer is the data controller and EpicMe is the data processor, acting only on the Customer's documented instructions under the DPA.
Practically, this means: if you are a Subject and you have questions about why your employer created a Droid of you, what it is used for, or you want to exercise your privacy rights over Droid data, your first point of contact is usually your Customer (typically your employer). We will assist the Customer in responding, as the DPA requires — and we also provide self-service tools you can use directly (see Section 9).
When EpicMe is an independent controller
EpicMe acts as an independent controller only for a narrow slice of data we need to run our own business:
- Account and contact data — names, emails, and login details of the people who administer accounts;
- Billing data — invoicing and payment records;
- Security and operational logs — records we keep to secure and operate the Services; and
- Anonymized aggregate learning data — the opt-in program described in Section 10, which contains no individual-level data.
For everything else, we are a processor.
3. What We Collect
Depending on how you use the Services, we collect:
- Intake answers: responses about family, schooling, career, decision scenarios, and communication style, provided during Droid creation.
- Documents: CVs, peer evaluations, writing samples, social-media data exports, and data imported from a competitor's AI-clone service ("Bring your clone").
- Consented public-web research findings about the Subject — gathered only after the Subject grants explicit consent, and revocable at any time (see Section 9).
- Droid query logs: questions asked of a Droid via its API, and the answers given.
- Generated profiles: the scores and persona we derive from the inputs above, plus fidelity measurements of how closely the Droid matches the Subject.
- Account and contact data; API keys (stored hashed — we never store them in plain text).
We do not collect data from your device beyond what is strictly necessary to operate the Services (see Section 12 on cookies).
4. Why We Process It, and On What Legal Basis
Where the GDPR applies, every processing purpose needs a legal basis under Article 6. Here is ours:
| Purpose | Data involved | Legal basis (GDPR Art. 6) |
|---|---|---|
| Building and operating a Subject's Droid (profiling, inference, fidelity measurement) | Intake answers, documents, research findings, profiles | Processed on the Customer's instructions under the DPA. The Customer, as controller, establishes its own legal basis — typically consent of the Subject (Art. 6(1)(a)) or its legitimate interests (Art. 6(1)(f)). For web research and social-media exports, we additionally require the Subject's explicit consent before processing. |
| Answering API Consumer queries and logging them | Droid query logs | On the Customer's instructions under the DPA |
| Providing accounts, support, and billing | Account/contact data, billing data | Performance of a contract (Art. 6(1)(b)) |
| Securing the Services (fraud prevention, abuse detection, audit logs) | Security logs, hashed API keys | Legitimate interests (Art. 6(1)(f)) — keeping the Services safe |
| Legal and tax compliance | Billing records | Legal obligation (Art. 6(1)(c)) |
| Anonymized aggregate learning program | K-anonymous aggregates only (Section 10) | Consent (Art. 6(1)(a)) — strictly opt-in |
A candid note on special-category data (GDPR Art. 9)
Droid profiling is quasi-psychometric: intake answers about family, upbringing, and decision-making, combined with AI-generated persona scores, could reveal or come close to revealing sensitive characteristics (for example, health, beliefs, or other special categories under Article 9 GDPR). We do not ask for special-category data, and Customers must not instruct us to process it — but we recognize the profiling process sits near this line. Where any input or output does constitute special-category data, the Customer (as controller) is responsible for establishing an Article 9 condition — in practice, the Subject's explicit consent (Art. 9(2)(a)) — before that processing occurs, and the DPA requires this.
Automated decision-making (GDPR Art. 22)
Droids and their profiles are generated by automated means, including AI models. EpicMe does not use Droids or profiles to make decisions that produce legal or similarly significant effects on any person, and Customers agree in the MSA not to use them that way (for example, as the sole basis for hiring, firing, promotion, credit, or similar decisions). A Droid is a representation, not a verdict. If you believe a Droid or profile has been used to make a significant automated decision about you, contact us and the relevant Customer immediately; you have the right to human review, to express your point of view, and to contest the decision.
5. Data About Other People (Read This Before You Answer Intake Questions)
Intake answers and documents naturally mention people other than the Subject — family members, colleagues, managers, and the authors of peer evaluations. If you provide information about someone else, you are responsible for having the right to share it: tell them, and where required, get their permission. We process this third-party data only as part of the Subject's Droid, on the Customer's instructions; we never use it to build a profile of the third party, contact them, or market to them. Third parties whose data appears in a Droid can contact us or the Customer to request deletion (Section 9).
6. Subprocessors — Who Touches the Data
We use a small number of vetted service providers ("subprocessors") to run the Services. The current list:
| Subprocessor | What it does | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | United States |
| Anthropic | Claude API — AI profiling and Droid inference | United States |
| Vercel | Hosting | United States |
About Anthropic specifically: data sent to the Claude API may be retained by Anthropic for up to approximately 30 days for safety monitoring, after which it is deleted. Anthropic does not use this data to train its models. Because the profiling model we use requires a minimum 30-day retention window on Anthropic's side, we cannot offer a zero-retention configuration for profiling.
Bring your own key (BYOK): a Customer or Subject may supply their own Anthropic API key. In that case, inference traffic runs under their direct agreement with Anthropic rather than ours, and Anthropic's handling of that traffic is governed by their own Anthropic terms.
Each subprocessor is bound by a written agreement with data-protection obligations at least as protective as our DPA. We will notify Customers of subprocessor changes as the DPA provides.
7. International Transfers
EpicMe and its subprocessors are located in the United States, so data originating in the EU/EEA, UK, or Switzerland is transferred to the US. For these transfers we rely on the EU Standard Contractual Clauses (SCCs) (and the UK and Swiss addenda where applicable), which are incorporated into and referenced in our DPA, together with supplementary technical and organizational safeguards described there.
8. How Long We Keep Data
| Data | Retention |
|---|---|
| Droid and its underlying data (intake answers, documents, findings, profiles) | Kept until deleted — by the Subject, the Customer, or account closure |
| Droid query logs | 90 days, then deleted |
| Unreviewed web-research findings | 60 days, then deleted |
| Abandoned, unverified sign-ups | 30 days, then deleted |
| Data sent to Anthropic (Claude API) | Approximately 30 days (Anthropic safety monitoring), then deleted |
Billing records are retained as long as tax and accounting laws require. Security logs are retained only as long as needed for their purpose.
9. Your Rights and How to Use Them
All of the following are built into the product and working today — not just promises on paper:
- Access — see the data we hold about you.
- Deletion — a single "delete everything" action erases the Droid, all intake answers, uploaded files, research findings, generated profiles, query logs, and the account itself. Deletion is immediate and irreversible.
- Export / portability — download your data in JSON format.
- Correction — fix inaccurate data.
- Opt out of anonymized aggregate learning — leave the program described in Section 10 at any time.
- Withdraw consent — revoke your consent for public-web research and/or social-media data exports at any time; withdrawal stops future processing (it does not undo processing that already lawfully occurred).
How to exercise them: use the in-product controls, or email us at [PRIVACY CONTACT EMAIL]. If we process your data as the Customer's processor, we may route your request through the Customer, or assist them in fulfilling it, as the DPA requires — but the self-service tools above work regardless.
If you are in the EU/EEA, you also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, the rights above cover your CCPA/CPRA rights to know, delete, correct, and port. We do not sell your personal information, and we do not share it for cross-context behavioral advertising — so there is nothing to opt out of under "Do Not Sell or Share," but you may contact us to confirm. We will never discriminate against you for exercising any privacy right. Authorized agents may submit requests on a California resident's behalf with proof of authorization.
10. Anonymized Aggregate Learning Program
Separately from running your Droid, we operate an opt-in program to improve our profiling models using aggregate patterns. Important limits:
- Opt-in only — no one is enrolled by default.
- No individual data — the program uses k-anonymous aggregates only: statistics computed across groups large enough that no individual can be singled out or re-identified.
- Opt out anytime — leaving the program stops your data from contributing to future aggregates.
This is the only processing for which EpicMe uses Droid-related data for its own purposes, and it is the "anonymized aggregate learning" for which EpicMe acts as an independent controller (Section 2).
11. Security
We protect data with industry-standard measures, including encryption in transit and at rest, hashed storage of API keys, access controls and least-privilege permissions, audit logging, and vendor security review of all subprocessors. No system is perfectly secure; if a breach affects your personal data, we will notify affected Customers and, where we are the controller, affected individuals and regulators as the law requires.
12. Cookies
We use essential cookies only — those strictly necessary for sign-in, security, and session management. We do not use advertising, analytics, or tracking cookies, and we do not respond differently to "Do Not Track" signals because we do not track you in the first place.
13. Children
The Services are for professionals and are not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor's data has been provided to us, contact us and we will delete it.
14. Changes to This Policy
We may update this Policy from time to time. Material changes will be announced by email or in-product notice before they take effect, with the effective date updated above. Continued use of the Services after the effective date constitutes acceptance; where law requires fresh consent, we will ask for it.
15. Contact
- General privacy inquiries: [PRIVACY CONTACT EMAIL]
- Postal: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]
- Data Protection Officer: [DPO NAME / CONTACT — or state "not required / not appointed" per counsel's determination]
- EU Representative (GDPR Art. 27): [EU REPRESENTATIVE NAME AND ADDRESS]
- UK Representative (if applicable): [UK REPRESENTATIVE NAME AND ADDRESS]
*This document references the EpicMe Master Services Agreement and Data Processing Addendum, which govern the commercial and data-processing relationship with Customers. Capitalized terms used here ("Customer", "Subject", "Droid", "API Consumer") have the meanings given in those documents.*