Privacy policy

1. Data controller

2. Data we collect

Identity data

• Name, email address, country of residence

Payment data

• Card details handled exclusively by Stripe: never stored on our servers
• Transaction history, billing information
• For the trial: the fingerprint of your card, supplied by Stripe (an identifier that is the same for the same card and does not contain the card number)

Usage data

• Connection logs, activity records
• Terminal preferences, saved watchlists, analysis history
• BRAIN AI requests: relayed by our servers to the host of the AI model; we keep a technical log (date, sizes in tokens, cost, response time) without the content of your messages

Technical data

• IP address, browser, OS, device type
• Cookies and similar tracking technologies (see Cookies policy)

3. Why we process your data

• Service delivery: account management, terminal access
• Service improvement: analytics, bug fixes, performance
• Communications: transactional emails, optional newsletter (consent-based)
• Legal & tax compliance: accounting records, fraud prevention
• Security: access control, abuse detection
• BRAIN AI: producing the answers you request, applying the usage limits of your plan
• One trial per person: checking that the trial has not already been used with the same email address or the same card

4. Legal bases (GDPR Article 6)

• Contract performance: to provide the service you subscribe to
• Explicit consent: for marketing communications and optional cookies
• Legitimate interest: security, anti-fraud, product improvement
• Legal obligation: accounting, tax records
• BRAIN AI: contract performance to produce the answers you request; legitimate interest for the technical log of requests (usage limits of your plan, cost monitoring, security) and for the monthly count of requests made with your own key (usage statistics)
• Trial: legitimate interest in keeping the trial to one per person (checks on the email address and the card fingerprint)

5. Retention periods

6. Third-party processors and other recipients

• Stripe: payment processing (EU and United States; EU-US Data Privacy Framework, with Standard Contractual Clauses where applicable)
• Cloudflare: hosting, CDN, security (United States and EU; EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback)
• Resend (Plus Five Five, Inc.): service emails such as sign-in codes and subscription messages (company in the United States, emails sent from Ireland; EU-US Data Privacy Framework, with Standard Contractual Clauses)
• OpenRouter, Inc.: routing of BRAIN AI requests to the host of the AI model (United States, EU Standard Contractual Clauses). The model is DeepSeek V4 Flash, an open-weight model published by DeepSeek. It runs on allow-listed hosts in the United States (DigitalOcean, DeepInfra, Parasail, CoreWeave), engaged by OpenRouter as its sub-processors under the same clauses, under zero-data-retention terms: your messages are processed to produce the answer, neither stored nor used for training. For web research, the request also contains the search results that OpenRouter obtained from Perplexity (see below). Nothing is sent to DeepSeek or to China.
• Cloudflare AI Gateway: relay and metering of BRAIN AI requests (Cloudflare's global network, including the United States and the EU; EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback); metadata only, no message content is logged
• Perplexity AI, Inc. (United States): web search for research requests only (RESEARCH EXT). For these requests, OpenRouter runs one search on Perplexity's Search API with the name of the asset you asked about. EPTA5's server removes everything else before the request leaves it, including your message, your name, email address and account identifier. Perplexity returns titles, links and excerpts of public web pages, which the AI model uses to write the report. Transfer basis: EU Standard Contractual Clauses (controller-to-processor module), and the UK Addendum for transfers from the United Kingdom, in EPTA5's agreement with OpenRouter; Perplexity AI, Inc. is also certified under the EU-US Data Privacy Framework and its UK Extension. The zero-data-retention terms described above do not cover this step: OpenRouter states that Perplexity applies its own retention policy, and Perplexity's terms for its Search API allow it to retain, copy, distribute and use search queries and results for its own business purposes, including improving and developing its products and services, and set no retention period. Do not include personal information in a research request.

BRAIN AI with your own key

If you connect your own key from OpenAI, Google or Anthropic, your messages and the EPTA5 context sent with them go directly from your browser to that provider (United States), under its own terms and privacy policy. EPTA5 does not receive their content, and the safeguards of the EPTA5 engine (allow-listed hosts, zero data retention) do not apply. With a Google key, use a paid key: on Google's free tier, Google may use your messages to improve its products, and human reviewers may read them. EPTA5 only counts how many requests you make each calendar month, without their content, for its statistics on the use of BRAIN AI; this count does not limit your requests.

Each transfer outside the EEA relies on the basis stated above for each recipient: the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) for certified US companies, or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). For transfers from the United Kingdom, the UK Extension to the Data Privacy Framework or the UK Addendum to these clauses plays the same role. You can obtain a copy of these safeguards by writing to dpo@epta5.com.

7. Your rights under GDPR

You can, at any time, exercise the following rights :

• Access · obtain a copy of your data
• Rectification · correct inaccurate data
• Erasure · "right to be forgotten"
• Restriction · limit processing
• Portability · receive your data in a structured format
• Objection · oppose certain processing (notably marketing)
• Withdraw consent · for any consent-based processing

Send your request to dpo@epta5.com. We respond within 30 days.

8. Cookies

Essential cookies require no consent. Analytics and functional cookies require your explicit consent via the banner on first visit. Full details in our Cookies policy.

9. Children

EPTA5 is intended for users aged 18 or older. We do not knowingly collect data from minors. If you believe we have, contact dpo@epta5.com.

10. Supervisory authority

You can lodge a complaint with the French data protection authority : CNIL · 3 place de Fontenoy, 75007 Paris.

11. Updates

We may update this policy. Material changes will be notified by email and announced on this page. The "Last updated" date above always reflects the current version.