سياسة الخصوصية

1. Who we are

[LEGAL ENTITY NAME] ("epta") provides the service. For personal data processed to operate the service, epta is the controller unless a customer acts as controller for its own end-customer data. Polar acts as Merchant of Record for payment and tax data.

2. Data we collect

• Account and business details: name, email, company, role, locale, authentication identifiers.
• Billing and transaction data: plan, credits, invoices, tax status, payment-method metadata. Full card details are handled by Polar and its payment processors, not stored by us.
• Service content: messages, knowledge-base documents, prompts, AI outputs, approvals, leads, proposals, channel identifiers and metadata.
• Usage and logs: credit consumption, model used, timestamps, IP address, device/browser, errors and security events.
• Communications: support requests and feedback.
• Cookies and preferences: locale, currency, session and security cookies.

3. Why we use it

• Provide, secure and operate the service.
• Authenticate users and prevent abuse.
• Process subscriptions, credits, invoices and tax through Polar.
• Generate AI replies and route messages to connected channels.
• Provide support and respond to requests.
• Improve reliability, safety and product performance.
• Comply with legal, tax and accounting obligations.
• Send service notices and, with consent where required, marketing.

4. Legal bases

Where GDPR or UK GDPR applies, we rely on performance of a contract, legitimate interests (security, service improvement, fraud prevention), legal obligation (tax and accounting), and consent (optional marketing or non-essential cookies). You may withdraw consent at any time.

5. Processors and recipients

We share data with service providers that help us run epta, including:

• Polar (Merchant of Record, payments, tax, invoices).
• Clerk (authentication).
• Cloudflare (DNS, CDN, Pages static hosting, Tunnel).
• AI model providers such as Google (Gemini), Anthropic (Claude) and OpenAI (GPT models).
• Meta/WhatsApp and other connected channel providers when you connect them.
• Email, support, monitoring and database providers.

These providers process data under their terms and, where required, data-processing agreements. Some processing may occur outside Egypt, including in the EU, UK and US. We use appropriate safeguards for international transfers where required.

6. Retention

We keep account and billing records for as long as needed to provide the service and meet legal, tax and accounting requirements. Message content and AI outputs are retained according to the customer's plan and settings, then deleted or anonymised. Security logs are kept for a limited period. Backup copies may persist until the backup cycle expires.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, object to processing, receive a portable copy, or withdraw consent. You may also lodge a complaint with your local data-protection authority. To exercise a right, email contact@eptaasolutions.com. We may need to verify your identity and may refuse requests where law permits.

8. Cookies

We use essential cookies for authentication, security, locale and currency preferences. We do not use non-essential analytics or advertising cookies without consent. You can control cookies in your browser, but blocking essential cookies may break the service.

9. Children

The service is for businesses and users aged 18 or over. We do not knowingly collect data from children. Contact us if you believe a child has provided data.

10. Changes and contact

We may update this policy and will post the new date. Material changes will be notified where required. Questions: contact@eptaasolutions.com, [REGISTERED ADDRESS], Egypt.