Privacy Policy

EPOS is operated as a small beta service. You can reach us by email at info@greekepos.gr. If you would like to exercise any of the rights described below (access, correction, deletion), email us and we will respond within 30 days.

• Account data: your email address (from Google sign-in or the magic-link sign-in form), your display name and profile picture when provided by Google, and a randomly-generated internal user identifier.
• Lesson activity: which lessons and steps you have attempted, your pass / retry outcomes per step, timestamps of attempts, the audio you record while practising, and the text transcribed from that audio.
• Billing data: subscription status, billing interval, trial state, and a Stripe customer identifier. We never see or store your full payment card number — Stripe handles tokenisation.
• Operational data: request logs (URL, response code, latency), error reports (stack traces, the internal user identifier), and standard hosting metadata (IP address, user-agent).

• To run the service. Your audio is sent to a speech-to-text provider so the coach can react to what you said. Your transcript is sent to a language model so the coach can generate feedback. Your account email is used to sign you in.
• To improve the coach. We review anonymised attempts and flagged feedback to fix bugs and improve the model prompts. We do not sell your data, do not run advertising, and do not use it to train third-party AI models for general purposes.
• To bill subscriptions. Stripe handles payment processing under its own terms; we only see what it tells us about your subscription state.

To operate EPOS we use the following sub-processors. Each one processes only the data needed for its specific purpose.

EPOS uses a small number of cookies. All of them are first-party (set by epos directly, not third parties).

• Strictly necessary: authentication cookies set by Auth.js when you sign in (session token, CSRF token). Without these you cannot sign in.
• Operational diagnostics: Sentry receives error reports from your browser via a same-origin tunnel. If you choose "Essential only" on the cookie banner, errors are still captured but they will not be associated with your account identifier.
• Consent record: an epos_consent cookie storing your banner choice so we do not ask again for 12 months.

We do not use analytics cookies, advertising cookies, or third-party tracking pixels.

• Audio recordings are streamed to Deepgram and not retained on our servers after transcription. Deepgram's own retention is governed by their policy.
• Attempt transcripts and outcomes are kept for the life of your account so you can see your practice history.
• Account and billing records are kept while your account exists and for a reasonable period afterwards to satisfy tax and accounting obligations.
• Error reports in Sentry follow Sentry's default retention (typically 30–90 days).

If you are in the EU/EEA or UK, you have rights under the GDPR to access, correct, delete, or export your personal data, and to object to or restrict its processing. To exercise any of these rights, email info@greekepos.gr. We will respond within 30 days.

You can also lodge a complaint with the data protection authority in your country of residence.

Some of our sub-processors are based in the United States. Where data leaves the EU/EEA we rely on the standard contractual clauses (or equivalent safeguards) published by each provider.

EPOS is not directed to children under 13 (or under 16 in some EU jurisdictions). We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

We may update this policy as the product evolves. Material changes will be announced by email; the "last updated" date at the top of this page always reflects the most recent revision.