This text is a draft and is being reviewed by our lawyers. It may change before it takes effect.
In short
We collect what we need to give you an account, run the portals our customers create and bill for them. We do not sell personal data, use it for advertising or use it to train AI models. Each portal keeps its data in the country its owner chose.
Who is responsible
For epicportal.io and the accounts on it, the controller is EPIC ALGORITHMS YAZILIM DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ, Atatürk Mah. Ertuğrul Gazi Sk., Metropol İstanbul Sitesi C1 Blok No: 2b İç Kapı No: 376, Ataşehir / İstanbul, Türkiye. Turkish data subjects find the information Law No. 6698 requires in our KVKK Aydınlatma Metni.
Your portal and your clients
A customer's portal holds data the customer puts into it: their staff, their clients, projects, invoices and messages. For that data the customer is the controller and we act only on their instructions as processor, under the Data Processing Agreement. If you are a client of one of our customers, please contact that company about your data first; we help them answer you.
What we collect
- Account: name, email address, password (stored only as a hash), two-factor settings, and the Google or Microsoft account identifier if you sign in with one.
- Portals you manage: company name, address on epicportal.io, chosen country, plan, trials, members and their roles.
- Billing (when paid plans start): billing contact and address, VAT number, invoices. Card details are handled by our payment provider, never by us.
- Technical: IP address, browser, sign-in events and security logs, kept to protect accounts.
- Cookies: as listed in the Cookie Policy.
- Messages you send us by email.
Why, and on what basis
- To create your account and run the portals you order: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To bill and keep accounting records: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
- To keep accounts and systems secure, prevent abuse and improve the service: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- For analytics cookies on the public site: your consent, which you can withdraw at any time.
Who receives it
Our service providers, listed on the subprocessors page, receive data only as far as they need it for us. We disclose data to authorities only when the law requires it.
Transfers abroad
Account data is stored in Germany. Some providers are in the United States (email delivery, sign-in with Google or Microsoft). Such transfers rest on the European Commission's standard contractual clauses or an adequacy decision and, for data subjects in Turkey, on the safeguards Article 9 of Law No. 6698 requires.
How long we keep it
Account data for as long as the account exists and 30 days after you close it; invoices and accounting records for the period tax law requires (ten years in Turkey); security logs for up to one year; a cancelled portal's data for 30 days, then it is deleted, backups included within a further 30 days.
Your rights
You may ask to see the data we hold about you, have it corrected or deleted, restrict or object to its use, receive it in a portable form, and withdraw consent you gave. Under KVKK Article 11 you have the same rights and may ask to whom it was passed. Write to [email protected]; we answer within 30 days.
Google and Microsoft sign-in
If you choose to sign in with Google or Microsoft we receive only your name, email address and account identifier, through the standard openid, email and profile permissions, to sign you in. Epic Portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar access, when a customer connects a calendar inside their portal, is kept by that portal and never by epicportal.io.
Contact and complaints
Questions about privacy: [email protected]. You may also complain to a data protection authority, in particular the one where you live; in Turkey this is the Personal Data Protection Authority (KVKK).