1. Who we are
The controller of your personal information is Epilog Life Inc., a company registered in the State of Texas, United States. For privacy questions or requests, contact us at support@epilog.life.
2. Scope
This Policy applies to personal information processed through our website at epilog.life (and related domains), our iOS and Android apps, and related customer support channels. It does not apply to third-party websites or services that we do not control.
3. Information we collect
Depending on how you use the Services, we may collect:
- Account and contact data: email address, phone number, name, profile details, and authentication credentials.
- Contacts and family graph: contact details you choose to provide or import (with permission), including trusted contacts, recipients, and family relationships.
- Location data: location information when you enable location-related features (for example geotags), with your consent where required.
- User content: messages, letters, stories, documents, photos, videos, audio, and other media you upload or create.
- Payment and subscription data: billing status and transaction metadata processed by Stripe, Apple App Store, or Google Play (we do not store full payment card numbers).
- Device and usage data: IP address, device type, app version, logs, and diagnostic information needed to operate and secure the Services.
- Crash and error diagnostics: technical diagnostics collected via Sentry to detect and fix crashes and errors.
- Support communications: information you send when you contact support.
We do not collect government-issued identification documents as a standard part of the Services.
4. How we use information
We use personal information to:
- Provide, operate, maintain, and improve the Services;
- Create and manage accounts, authentication, and OTP verification;
- Store and deliver your content to people you authorize, including after death verification by trusted contacts;
- Process subscriptions and payments;
- Send service-related notices (security, billing, product updates);
- Detect, prevent, and investigate fraud, abuse, and security incidents;
- Comply with legal obligations; and
- Generate anonymized story text embeddings to power search/similarity features without linking identifying user data to external AI processing (see Section 11).
5. Legal bases (GDPR / UK GDPR)
If you are in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis, we process personal information under one or more of the following:
- Contract: to provide the Services you request;
- Consent: for optional features such as contacts access, location, marketing communications (if any), or other consent-based processing — you may withdraw consent at any time;
- Legitimate interests: to secure, improve, and support the Services, provided those interests are not overridden by your rights;
- Legal obligation: where we must retain or disclose information to comply with law.
7. International transfers
We currently store and process personal information in the United States. If you access the Services from outside the U.S., your information may be transferred to the U.S. When we onboard users in the EEA/UK, we will use appropriate transfer mechanisms (such as Standard Contractual Clauses) where required.
8. Retention and deletion
While your account remains active, we retain your content and account data so the Services can function, including long-term legacy storage until you delete the account or content is released according to your instructions and our trusted-contact verification process.
When you delete your account, we wipe associated personal data from live production systems within 7 days, and from backups and caches within 31 days, except where we must retain limited information for legal, security, or accounting purposes (for example transaction records).
9. Security
We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls, and restricted contractor access (including VPN). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
If a security incident occurs that requires notification under applicable law, we will notify affected individuals and/or regulators as required.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing or withdraw consent.
To exercise rights, email support@epilog.life. We may need to verify your identity. We aim to respond within 30 days (or within timelines required by applicable law, including up to 45 days under California law, with extensions where permitted).
EEA/UK residents may also lodge a complaint with their local supervisory authority.
11. AI and embeddings
We may create text embeddings from story content you submit to support product features such as similarity or retrieval. These embeddings are processed so that identifying user information is not connected to the content sent for external AI processing. We do not use an “AI Buddy” conversational product.
12. Children and family accounts
Account registration is intended for adults age 18 and over. Parents or guardians may include family members under 18 as contacts, recipients, or related profiles under their account and are responsible for obtaining any required consent. Advisors using the platform may not contact individuals under 18 through the Services. If you believe we have collected information from a child in a manner inconsistent with this Policy, contact us and we will take appropriate steps.
13. California privacy rights (CCPA/CPRA) & Your Privacy Choices
California residents have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information, and to not be discriminated against for exercising these rights.
We do not sell personal information and do not share personal information for cross-context behavioral advertising. If we receive a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale/sharing (which aligns with our existing practice of not selling or sharing for advertising).
To submit a request, email support@epilog.life. You may use an authorized agent as permitted by law.
15. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated Policy with a revised effective date and, where appropriate, provide additional notice. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.
16. Contact us
Epilog Life Inc.
Email: support@epilog.life