Privacy policy

1. Who we are

Epoxlab, LLC is the data controller for personal data processed across our products. You can reach our privacy contact at hello@epoxlab.com.

2. What we collect

Information you give us

• Account data. Name, email address, and password hash.
• Billing data. Billing address and tax details. Card numbers go directly to Stripe and never touch our servers; we store only the last four digits, card brand, and expiry that Stripe returns.
• Content. Files, video, images, text, and prompts you upload or create in a product.
• Connected accounts. Where you link a third party account such as TikTok, the access tokens and the profile information that platform returns.
• Support messages. What you send us and our replies.

Information we collect automatically

• Usage data. Pages viewed, features used, and actions taken, so we can tell what is working and what is broken.
• Device and log data. IP address, browser and operating system, timestamps, and error traces.
• Cookies. Strictly necessary cookies to keep you signed in, and analytics cookies where you have not opted out.

3. Why we use it

• To provide the product you signed up for, which is the performance of our contract with you.
• To take payment and prevent fraud, which is both contractual and a legitimate interest.
• To support you and answer your messages.
• To improve reliability and diagnose faults, which is a legitimate interest.
• To send service emails you cannot opt out of, such as billing receipts and security notices, and marketing emails you can.
• To meet legal and tax obligations.

We do not sell your personal data, and we do not use your uploaded content to train our own models or anyone else’s.

4. Who we share it with

We use a small number of processors to run the service. Each is bound by contract to process data only on our instructions.

• Stripe for payments and subscription management.
• Supabase for database, authentication, and file storage.
• Vercel and Hetzner for application hosting and background processing.
• Resend for transactional email.
• Model and rendering providers that generate or process media inside our products.
• Analytics and error monitoring to measure usage and catch faults.
• Third party platforms you choose to connect, which receive only the content you schedule or publish to them.

We may also disclose data where the law requires it, or to protect our rights, safety, or property. If we are ever acquired, data may transfer as part of that transaction and you will be told first.

5. International transfers

We are based in the United States and our processors operate in the United States and the European Union. Where personal data leaves the UK or EEA we rely on adequacy decisions or Standard Contractual Clauses.

6. How long we keep it

• Account data for as long as your account is open, then up to 90 days after closure.
• Uploaded content and generated output until you delete it, or up to 90 days after account closure.
• Billing records for seven years, because tax law requires it.
• Logs for up to 12 months.

7. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. California residents have the right to know, delete, correct, and opt out of sale or sharing; we do not sell or share personal data as those terms are defined under the CCPA.

Email hello@epoxlab.com and we will respond within 30 days. We will not treat you differently for exercising a right. If you are in the UK or EEA and are unhappy with our response, you may complain to your local supervisory authority.

8. Security

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access to production systems is limited to the people who need it and protected by multi factor authentication. No system is perfectly secure, and if a breach affects your personal data we will notify you and any regulator as the law requires.

9. Children

Our products are not for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

10. Changes

We will post any update here and change the date at the top. Material changes are also announced by email.

11. Contact

hello@epoxlab.com, or by post to Epoxlab, LLC, [Registered address], [City], [State] [ZIP], United States.