Privacy Policy

1. Introduction

Welcome to Epic.ai ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI voice agents platform (the "Service").

By accessing or using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when you:

• Create an account (name, email address, password)
• Configure AI voice agents (instructions, voice preferences, phone numbers)
• Upload contact lists or lead data for campaigns
• Make or receive phone calls through our platform
• Contact our support team
• Participate in surveys or provide feedback

2.2 Automatically Collected Information

When you use our Service, we automatically collect:

• Call Data: Phone numbers, call duration, timestamps, call outcomes, and conversation transcripts
• Usage Data: Features accessed, agent configurations, campaign metrics, API usage
• Device Information: Browser type, operating system, IP address, device identifiers
• Log Data: Error logs, performance data, security events
• Cookies and Tracking: Session cookies, authentication tokens, analytics cookies

2.3 Third-Party Data

We may receive information from third-party services you integrate with our platform:

• CRM Systems: Contact data from Odoo, HubSpot, or other integrated CRMs
• Payment Processors: Billing information from Stripe (we do not store credit card details)
• Telephony Providers: Call detail records from Magnus Billing and other SIP providers

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, operate, and maintain our AI voice agent platform
• Voice AI Processing: To generate responses, transcribe conversations, and improve AI agent performance
• Campaign Execution: To initiate calls, track outcomes, and provide analytics
• Account Management: To manage your account, authenticate users, and provide customer support
• Billing and Payments: To process subscriptions, calculate usage fees, and generate invoices
• Service Improvement: To analyze usage patterns, identify bugs, and enhance features
• Communication: To send service updates, security alerts, and promotional materials (with consent)
• Legal Compliance: To comply with legal obligations, prevent fraud, and enforce our terms

4. Voice and Call Data Processing

4.1 Call Recording and Transcription

Our Service may record and transcribe phone conversations for quality assurance, training, and analytics purposes. You are responsible for:

• Obtaining proper consent from call participants where required by law
• Providing appropriate call recording disclosures
• Complying with federal and state recording consent laws (one-party vs. two-party consent)

4.2 AI Processing

Voice data is processed by third-party AI providers:

• OpenAI: GPT-4 for conversation generation, text-to-speech for voice synthesis
• Deepgram: Speech-to-text transcription
• LiveKit: Real-time audio/video infrastructure

These providers process voice data in accordance with their own privacy policies and data processing agreements.

4.3 Data Retention

We retain call recordings and transcripts for:

• Active Accounts: Duration of your subscription plus 90 days
• Closed Accounts: Up to 1 year for legal compliance and dispute resolution
• Compliance Requirements: Longer retention if required by law or legal hold

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

5.1 Service Providers

• AI Providers: OpenAI, Deepgram for voice processing
• Infrastructure: LiveKit (real-time communications), hosting providers
• Payment Processing: Stripe for billing and subscriptions
• Analytics: Usage analytics and monitoring services

5.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or legal process, or to:

• Comply with legal obligations
• Protect our rights, privacy, safety, or property
• Prevent fraud or security threats
• Respond to government requests

5.4 With Your Consent

We may share your information with other third parties when you explicitly consent to such sharing.

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: TLS/SSL for data in transit, encryption at rest for sensitive data
• Access Controls: Multi-factor authentication, role-based access, principle of least privilege
• Network Security: Firewalls, intrusion detection, DDoS protection
• Monitoring: Security logging, anomaly detection, regular security audits
• Vendor Management: Due diligence on third-party security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

7. Your Rights and Choices

You have the following rights regarding your personal information:

7.1 Access and Portability

You can access and export your data through our dashboard or by contacting support.

7.2 Correction and Update

You can update your account information, agent configurations, and preferences at any time through your account settings.

7.3 Deletion

You can request deletion of your account and associated data by contacting support. Please note:

• Some data may be retained for legal compliance (e.g., financial records, call logs)
• Backup copies may persist for up to 90 days
• Anonymized data may be retained for analytics

7.4 Marketing Communications

You can opt out of marketing emails by clicking "unsubscribe" in any promotional email or updating your communication preferences.

7.5 Cookies

You can control cookies through your browser settings. Note that disabling cookies may limit functionality.

7.6 Do Not Track

We do not currently respond to "Do Not Track" browser signals.

8. State-Specific Privacy Rights

8.1 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising CCPA rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

8.2 Other U.S. States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have similar rights. Contact us to exercise these rights.

8.3 Exercising Your Rights

To exercise your privacy rights, email us at privacy@epic.dm or use the data request form in your account settings.

9. International Data Transfers

Our Service is operated in the United States. If you access our Service from outside the U.S., your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

By using our Service, you consent to the transfer of your information to the United States and other countries that may have different data protection laws than your country of residence.

10. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice in your dashboard

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For privacy-related requests (access, deletion, correction), please include "Privacy Request" in your email subject line and provide sufficient information to verify your identity.