Privacy policy

Effective October 27, 2026. This policy explains what [Legal entity, LLC] collects when you use epk, why, who helps us run it, how long we keep things, and the choices and rights you have. We give everyone the same rights wherever they live.

The short version: we collect what the product needs to work, we never sell your personal information or share it for advertising, and you can see, download, correct or delete it.

What we collect

• Account: name, email, password (stored only as a one-way hash), sign-in sessions, two-step sign-in settings, and which version of our terms you accepted and when you confirmed you're 18 or older.
• Profiles: profile name, handle, city, bio, tags, links, logos and images you add, and your privacy and email settings.
• Your content: photos, video, audio and files you upload, including the metadata inside them (camera, capture time, and location if your camera recorded it), plus galleries, EPKs, pages, collections and shows.
• Work between users: messages, requests, bookings, quotes, invoices, payment confirmations and notes, and the email addresses of people you send things to.
• Payments for our plans: your plan, billing status and a Stripe customer reference. Stripe collects and stores your card; we never see the full card number.
• Activity: what's viewed, downloaded, added to an EPK or shared, and by which profile, used for insights and to keep accounts safe. If you browse privately, others see a count, not your name.
• Technical: IP address, browser or device type, and logs of requests and errors, used for security and fixing problems. On our mobile apps, a push notification token if you allow notifications.
• Connected services: if you connect Google, Dropbox, a calendar, Stripe, Posh, Spotify or YouTube, we store the access tokens (encrypted) and the data you choose to import.
• Support and applications: what you write to us, and what you tell us while waiting for beta approval.

We don't collect government IDs, and we don't knowingly collect information from anyone under 18.

Why we use it

• To provide epk: accounts, storage, delivery, sharing, pages, messaging, bookings and invoices (needed to perform our agreement with you).
• To keep it safe: preventing fraud, abuse and unauthorized access, and keeping backups (our legitimate interest in a secure service, and legal obligations).
• To send email you've chosen in your email settings, and messages about your account, security and billing that we must send.
• To improve the product using aggregated usage, never your content.
• To meet legal duties such as tax records and responding to valid legal requests.

We don't use your photos or content to train AI models, and we don't make automated decisions about you that have legal or similarly significant effects.

Who sees what

• People you share with see what you share, as limited by your settings and the access you grant. Public profile pages and EPKs are visible to anyone, and searchable profiles appear in search for signed-in users. You control this in settings.
• Your team sees the profiles they belong to, according to their role.
• Service providers process data for us under contracts that limit them to providing their service: Cloudflare (file storage, video, network and security), Hetzner (servers and backup copies), Neon (database), Resend (email), Stripe (payments), Anthropic (our internal review tools read error reports and support messages to draft summaries and replies; never your photos), and, only if you connect them, Google, Dropbox, Apple, Spotify and Posh.
• Legal reasons: we disclose information when the law requires it, to protect people from harm, or to defend our rights, and we tell you when the law allows.
• Business changes: if epk is sold or merged, your information moves with it under this policy, and we'll tell you first.

We never sell personal information or share it for cross-context behavioral advertising.

Where it's stored

Our servers, database and files are in the United States, with backup copies in Europe (Hetzner) and the United States. If you're outside the US, your information is transferred to the US. Our providers offer transfer safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

Your choices and rights

You can, at any time:

• See and download your information: Settings, then Privacy and data, then Download my data.
• Correct it: edit your profile and settings, or ask us.
• Delete your account: in Settings on the web or in the app. Deletion happens after a 30-day grace period you can cancel. Work you delivered to others stays in their library.
• Choose your email: per category, in Settings, then Email, or with one click from any email.
• Browse privately, hide your profile from search, and decide who can message you or see your availability and prices.
• Object or restrict: ask us to stop a particular use; where the law gives you the right, we will.
• Complain: if you're in the EU or UK, you can also contact your data protection authority.

To use a right we don't offer as a button, email [privacy@ email]. We reply within 30 days and may ask you to confirm it's you. We won't treat you differently for using your rights.

Cookies

We use only the cookies needed to keep you signed in and to remember that you unlocked a password-protected link. No advertising or analytics cookies.

Security

We protect information with encryption in transit and at rest, private storage for originals, access controls, two-step sign-in and audit logs. See the security page. If a breach affects you, we'll tell you as the law requires.

Children

epk is for people 18 and older. If you believe someone under 18 created an account, email [privacy@ email] and we'll remove it.

Changes

If we change this policy in a meaningful way, we'll email account owners and show a notice at least 30 days before it applies.

Contact

[Legal entity, LLC], [postal address]. Privacy questions: [privacy@ email].