Privacy policy

Who we are

The data controller for epure.sh marketing pages and Epure Cloud is the Operator of Epure (France).

Contact the controller at legal@news.epure.sh. We do not publish a personal identity or home address.

If you self-host Epure, you are the controller of data in your instance. This policy does not govern your deployment.

Scope

This policy covers: the public website, waitlist signup, support and security email, and Epure Cloud accounts when available.

It does not cover third-party sites linked from ours, or self-hosted Epure instances you operate.

What we collect

• Waitlist: name, email, optional company — email is encrypted at rest; we use a one-way fingerprint to prevent duplicates.
• Cloud accounts (when open): account email, authentication data, billing identifiers from the payment processor, and service usage needed to run the product.
• Product telemetry you send to Cloud: error events, stacks, releases, and related metadata you configure your SDK to transmit.
• Technical logs: IP address, user agent, timestamps, and security events, retained only as long as needed for abuse prevention and operations.
• Support email content you choose to send us.

What we do not do

• No advertising trackers or third-party ad networks on the marketing site.
• No sale of personal data.
• No public directory of customers or waitlist members.
• No requirement that you publish personal details about yourself to use the open-source software.

Cookies and similar tech

The marketing site does not rely on non-essential analytics cookies.

Epure Cloud uses a session cookie required to keep you signed in (strictly necessary for the service).

You can block cookies in your browser; Cloud login will not work without the session cookie.

Legal bases (GDPR)

• Contract / pre-contract steps: waitlist interest, Cloud accounts, billing.
• Legitimate interests: securing the service, preventing abuse, improving reliability — balanced against your rights.
• Legal obligation: tax, accounting, and regulatory retention where applicable.
• Consent: only where we ask for it and you can withdraw it (for example optional communications).

Processors and transfers

We use infrastructure and service providers (hosting, email delivery, and payment processing when Cloud billing is active) as processors under contract.

Some providers may process data outside the EU. Where that happens, we rely on appropriate safeguards (such as Standard Contractual Clauses) or an adequacy decision.

A current processor list is available on request at legal@news.epure.sh.

Retention

• Waitlist: until Cloud launch messaging is complete, you ask deletion, or we close the list — then deleted or anonymized.
• Cloud account and billing records: for the life of the account plus legal retention periods.
• Ingested error data: per your plan and product settings; deleted when you delete the project/account or when retention windows expire.
• Security logs: short operational windows unless needed for an investigation.

Your rights

If GDPR or similar law applies, you may request access, rectification, erasure, restriction, portability, and objection to certain processing.

Email legal@news.epure.sh from the address we have on file. We may ask for information needed to verify your identity without collecting extra public identity documents when avoidable.

You may lodge a complaint with the CNIL (France) or your local supervisory authority.

Security

We apply reasonable technical and organizational measures (encryption in transit, access controls, least privilege). No method of transmission or storage is perfectly secure.

Report vulnerabilities to security@news.epure.sh.

Children

The service is directed at professionals. We do not knowingly collect data from children under 16. Contact us to delete any such data.

Changes

We may update this policy. The effective date at the top of the page will change. Continued use after an update means you accept the revised policy where permitted by law.

Effective 2026-09-18. Last updated 2026-09-18.