Privacy Policy

1. Who we are

Epifany ("Epifany", "we", "us" or "our") is a private video-enhancement service operated from Ontario, Canada. This Privacy Policy explains what personal information we collect when you use our website and the Epifany studio (the "Service"), why we collect it, who we share it with, where it is processed, how long we keep it, and the choices and rights you have.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to us. Questions and requests about privacy go to support@epifanylabs.com.

2. Epifany is a private service

Your uploads and results are private to your account. Epifany has no public feed or gallery, and other customers cannot browse, search or view your videos.

We do not routinely watch, review or moderate your uploads or results. Your files can be accessed only:

• by automated systems, to process, analyse, store and deliver them for you (see section 4);
• by our service providers, as needed to provide their part of the Service (see section 6);
• by us, when you ask us for help with a specific file or project;
• by us, when needed to investigate or respond to a security incident, a credible complaint, or a suspected breach of our Terms of Service or Acceptable Use Policy; and
• when required by law, for example by a valid court order.

We do not offer end-to-end encryption, and we cannot promise that no person or provider will ever be able to access a file. We describe the protections we do use in section 9.

3. What we collect

### Account information Your email address and password (stored by our authentication provider in a hashed form we cannot read), the date you created your account, and your sign-in history. If you sign in through a third-party provider such as Google, we receive the basic profile information that provider shares with us, such as your name, email address and profile picture.

### Onboarding and profile information What you tell us when you set up your account: your name, preferred language, how you heard about Epifany (optional), which description fits you best (for example "Content creator" or "Student"), what you plan to use Epifany for, and whether you agreed to receive marketing emails. We also record when you accepted our Terms of Service and Privacy Policy. If you add a profile picture, we store it.

### Your videos and results The videos you upload, the processed results we produce, thumbnail images, project names, and technical details about each video, such as its resolution, length and format.

### Billing information Payments are processed by Stripe. Your full card number and security code go directly to Stripe and are never received or stored by Epifany. At checkout we collect your billing name and address, which are used to calculate sales tax, and, if you choose to provide it, a business tax registration number. We keep your Stripe customer ID, your plan and subscription status, your credit balance and credit history, your Auto Top-Up settings, and records of your purchases and charges.

### Communications Messages you send us, such as support requests, and our replies.

### Technical information Information needed to run and secure the Service, such as your IP address, browser and device type, the pages and features you use, error reports and server logs. These are generated by our hosting, database, storage and processing providers as part of operating the Service.

We do not use third-party analytics or advertising tools.

4. How we use your information

We use personal information only for the purposes below:

• To provide the Service: creating and securing your account, processing your videos, storing and delivering results, and showing your projects and files.
• To process payments: charging for plans, credits, top-ups and archive storage, calculating and collecting sales tax, applying credits, and running Auto Top-Up if you turn it on.
• To communicate with you: sending verification codes, password-reset codes, receipts, service notices (such as storage deadlines) and replies to your requests.
• To personalise the Service: for example showing the Service in your preferred language.
• To keep the Service safe and working: preventing fraud and abuse, investigating security incidents, fixing errors and enforcing our Terms.
• To meet legal obligations: such as keeping tax and accounting records.
• Marketing emails: only if you opted in. You can unsubscribe at any time using the link in any marketing email or by contacting us.

We do not use your videos or results in advertising, as public examples, or to train artificial-intelligence models without your separate, express permission. We do not sell your personal information.

5. Consent

By creating an account and accepting this Privacy Policy, you consent to the collection, use and disclosure of your personal information as described here. You may withdraw consent at any time by contacting us, subject to legal and contractual limits. Withdrawing consent may mean we can no longer provide some or all of the Service; for example, we cannot process a video without receiving it.

6. Who we share information with

We share personal information only with the service providers that help us run the Service, and only what each needs for its role:

• Supabase — accounts, sign-in and our database (account, profile, project and billing records).
• Cloudflare (R2) — storage of your uploads, results, thumbnails and profile picture.
• Modal — the computing platform that processes your videos.
• Stripe — payment processing, subscriptions and saved payment methods.
• Resend — delivery of verification, password-reset and other account emails.
• Sign-in providers — such as Google, only if you choose to sign in with them.

Each provider handles information under its own terms and privacy policy, which are linked from our Service Providers page. We use these providers under agreements that restrict them to processing information on our behalf.

We may also disclose information when required by law or legal process, to protect the rights, property or safety of Epifany, our users or others, or in connection with a reorganisation, merger or sale of the business, in which case the information would remain subject to the protections of this policy.

7. Where your information is processed

Epifany is based in Canada, but our service providers store and process information outside Canada:

• our database and authentication (Supabase) are hosted in the United States (Oregon);
• file storage (Cloudflare R2) uses Cloudflare's global network;
• video processing (Modal) runs on cloud computing infrastructure that may be located in the United States or other countries where Modal operates;
• payments (Stripe) and email delivery (Resend) are processed in the United States and other countries where those providers operate.

Information processed in another country is subject to that country's laws and may be accessible to its courts, law-enforcement and national-security authorities.

8. How long we keep information

• Uploaded videos and results in cloud storage: deleted 30 days after upload, unless you archive the project.
• Archived projects: kept while your paid archive storage remains active, until you delete them. If archive storage ends, archived videos return to the ordinary retention model and are deleted after a new 30-day period, as described in the Digital Delivery and Storage Policy.
• Working copies on the processing platform: uploads are removed within about 6 hours, delivered results within about 24 hours after processing, and failed or cancelled jobs within about 6 hours.
• Account, profile and project records: kept while your account is open. When you ask us to close your account, we delete or anonymise them, except where we must keep information to meet legal obligations, resolve disputes or enforce our agreements.
• Billing records: kept as long as required by tax and accounting laws.
• Backups: our providers keep backups for limited periods to recover from failures; deleted information remains in backups until they are overwritten in the ordinary course.
• Information on your own device: previews, local project data and preferences stored in your browser stay there until you clear them (see section 10).

9. How we protect information

We use reasonable safeguards appropriate to the sensitivity of the information, including encryption of data in transit (HTTPS), encryption at rest provided by our storage and database providers, private storage that is reached only through short-lived signed links, access controls that keep each account's data separate, and limited internal access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Cookies and browser storage

We use cookies and your browser's storage only to make the Service work. We do not use advertising or analytics cookies.

• Sign-in cookies keep you signed in and secure your session. They are set by our authentication system and are required for the dashboard to work.
• Payment cookies: when you check out, Stripe may set cookies to process the payment and prevent fraud, under Stripe's privacy policy.
• Preferences: your chosen language and dashboard settings, saved in your browser's local storage.
• Local projects and files: videos you add to My files, and drafts in progress, can be kept in your browser's storage (IndexedDB and session storage) so they are available quickly on this device.
• Video previews: previews of your cloud videos are cached in your browser so they play quickly.

Clearing your browser data removes these items from that browser and signs you out. It does not delete anything stored in your Epifany account in the cloud, such as your cloud projects, results, credits and billing records. Files that exist only in your browser and were never uploaded to your account are lost when you clear its storage. A cached preview is not a backup.

11. Your rights and choices

Subject to applicable law, you can:

• ask for access to the personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your account and personal information;
• withdraw your consent, as described in section 5; and
• unsubscribe from marketing emails at any time.

To make a request, email support@epifanylabs.com from the address you use to sign in. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

12. Young users

Epifany has no minimum age. If you are under the age of majority where you live, you may use Epifany only with the permission of a parent or legal guardian. A parent or guardian who believes their child has provided personal information without permission can contact us to have it reviewed, corrected or deleted.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date and, if the changes are significant, tell you by email or in the Service before they take effect.

14. Contact

Privacy questions and requests: support@epifanylabs.com.