Privacy notice

1. Who is responsible

For account, security, billing, support and service-operation data, the controller is Epicod, operator of EpicIMS. For customer-entered client, invoice, payment, expense and receipt data, the EpicIMS customer normally decides the purposes and acts as controller; Epicod acts as the customer's processor under the Data Processing Agreement.

Controller contact: privacy@epickod.org. Legal notices: legal@epickod.org.

2. Data we process

• Account data: name, email address, Firebase user identifier, sign-in and passkey metadata.
• Workspace data: company profile, members, clients, invoices, credit notes, payments, expenses, receipts and audit events.
• Operational data: IP address and security events needed to authenticate, rate-limit, protect and troubleshoot the service.
• Support data: information voluntarily included in support requests.
• Optional Penny data: prompts, relevant retrieved finance records and proposed actions sent to the configured AI provider when Penny is used.

Do not enter special-category data, payment-card numbers, authentication secrets or other information EpicIMS does not need. We do not intentionally collect children's data or use customer data for advertising.

3. Why we use data

• To create accounts, authenticate users and provide the contracted invoicing workspace (GDPR Art. 6(1)(b)).
• To maintain accounting, tax, fraud-prevention and security records where required by law or necessary to establish, exercise or defend claims (Art. 6(1)(c) and (f)).
• To provide support, reliability, backups, abuse prevention and service improvement in our legitimate interests, balanced against individual rights (Art. 6(1)(f)).
• To send transactional email, such as invoice delivery and account messages.
• To provide Penny only when a user invokes it. Penny does not make credit, employment, eligibility or other legal or similarly significant decisions.

4. Sharing and processors

We disclose data only to service providers needed to operate EpicIMS, under written agreements and documented instructions. Current categories and transfer safeguards are described on the Subprocessors page. Customers remain responsible for giving their own clients and staff any required notices.

5. International transfers

Where personal data leaves the EEA or UK, we use an adequacy decision or another lawful safeguard such as the European Commission's Standard Contractual Clauses, with a transfer assessment and supplementary measures where required (GDPR Arts. 44–49). See the transfer register for the actual deployment configuration.

6. Retention

We retain data only for as long as needed for the stated purpose, contract, legal obligation, security and claims. Issued invoices, credit notes, payments and supporting records may require statutory retention. The customer-specific schedule is documented in the DPA and retention policy; deletion is suspended by legal holds and applicable legal exceptions.

7. Your rights

Depending on applicable law, you may request access, correction, erasure, restriction, objection, portability, or withdrawal of consent. California residents may also have rights to know, delete, correct, opt out of sale/sharing, limit sensitive personal information and receive equal treatment. Epicod does not sell personal information or use it for cross-context behavioural advertising.

Use the data-rights request page or email privacy@epickod.org. We will verify identity proportionately, respond within the applicable deadline, and explain any legal-retention exception. You may complain to the relevant supervisory authority.

8. Security and incidents

Controls include TLS, tenant-scoped authorization, server-side Firebase token verification, rate limiting, audit logging, restricted credentials and tested isolation. No security measure is absolute. We investigate incidents, notify customers and regulators where legally required, and maintain an incident-response record.

9. Changes

Material changes will be published with a new version and effective date. Where required, we will request renewed acceptance. This notice is versioned together with the onboarding acceptance recorded by EpicIMS.