What we collect — and don't.

What we collect

• Pilot intake form. Name, business name, email, optional segment-event volume, optional free-text notes. Stored in our D1 database; founder receives an email notification per intake.
• Sealed event payloads. Whatever you ask us to seal. Stored only as the canonical hash and any retention-required metadata. We do not read or index payload contents.
• Security report form. Severity, CVSS, title, contact email, free-text body. Stored in our D1 database.
• Request metadata. IP address (for rate-limit), user-agent string. Used solely for abuse detection and forensics on the security-report flow.

What we do not collect

• No third-party analytics cookies. We use Cloudflare Web Analytics which is cookieless and ships no personal data to third parties.
• No advertising trackers. No Facebook Pixel, Google Ads tag, LinkedIn Insight, or similar.
• No data sales. We don't sell, rent, or exchange your information with anyone.

Retention

• Pilot intakes — kept while you are a prospect or active customer; deleted on written request within 30 days of cancellation.
• Sealed event metadata — kept per your subscription's retention class (see /security). Public chain anchors are permanent and cannot be erased.
• Security reports — kept indefinitely for incident-response audit. Email security@seal.epochpay.today for redaction requests.

Your rights

GDPR / CCPA. You may request access, correction, or erasure of any data we hold about you by emailing security@seal.epochpay.today. We respond within 30 days. For records under regulatory retention, erasure happens via cryptographic blinding (we keep the hash; the cleartext is redacted).

Sub-processors

Listed at /security. Updates announced on the changelog (forthcoming) with 30 days notice for material changes.

Contact

Privacy questions: privacy@seal.epochpay.today.
Postal: EpochCore LLC, Huntersville NC USA.