Privacy Policy

Last updated: 10 October 2026

This policy explains what personal data Epicus collects when you use the Epicus app (at app.epicus.co and in the Epicus apps for iOS and Android) and this website (epicus.ai), why we collect it, who we share it with, how long we keep it and what your rights are. We have written it to be read, so it describes what the product actually does.

1. Who we are

The controller of your personal data is Epicus, Abe Lenstrastraat 19, Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 89987144, VAT number NL004778476B97 ("Epicus", "we", "us").

For anything related to privacy, email privacy@epicus.ai.

2. What we collect

Account and sign-in data

Your name, email address and password (stored only as a one-way hash, never in readable form).
Optionally a profile photo, country, time zone and job role.
Two-step verification: when you sign in we email you a one-time code, unless you have switched this off in your settings. The code is stored hashed and expires after 10 minutes.
Sign in with Google: if you choose this, Google tells us your Google account's permanent identifier, your email address (and that Google has verified it), your name and, for a Google Workspace account, its domain. We store the identifier, linked to your Epicus account, with when you first and last signed in this way. The first time, we link it to an existing Epicus account with the same email address or create a new account with your name and email address. We do not receive your Google password or access to anything else in your Google account, such as your email, contacts or files, and we do not store your Google profile photo.
Sign in with Microsoft: available if your organization has connected its Microsoft 365 (Microsoft Entra ID) to Epicus. Microsoft tells us your account's identifiers in your organization's Microsoft tenant, your email address and your name. We store the tenant and account identifiers, linked to your Epicus account, with when you first and last signed in this way. As with Google, we receive no password and no access to your mailbox, files or other Microsoft 365 data.
When you sign in with Google or Microsoft, their sign-in, with its own second factor, takes the place of your Epicus password and the emailed code.
App lock: if you turn on the PIN lock, we store a hashed PIN linked to a random device identifier. If you turn on Face ID, Touch ID or fingerprint unlock, your face or fingerprint never leaves your device and we never receive it: the phone keeps a random key in its secure storage and only releases it after your biometric check, and we store only a hash of that key.
Sign-in tokens, which expire after 30 minutes without use and at most 14 days after you sign in, and your app settings and notification preferences.

Organization and team data

The organization you belong to, your role in it (for example administrator or finance contact), and the email domain your organization has verified.
If your organization has verified its email domain with us, every Epicus account with an email address on that domain is linked to the organization automatically, including accounts that already existed. Only an administrator of the organization can remove you from it.
Provisioning from Microsoft Entra ID: if your organization connects its Microsoft Entra ID to Epicus, Entra can create and update your Epicus account automatically when your organization assigns you to Epicus there. Entra sends us your email address, your name, Entra's identifier for you and whether your account is enabled. Your account stays inactive until you first sign in. If you are not on one of the organization's verified email domains (for example a guest or an external person), we email you an invitation, and your account joins the organization only when you accept it. When your organization removes or disables you in Entra, your Epicus account is deactivated.
Groups: your organization can put you in groups, its own lists of people, either made by an administrator in the Epicus dashboard or kept in step with groups in its Microsoft Entra ID. For an Entra group we store the group's name, Entra's identifier for it and its members. Your organization's administrators can use groups to give their members priority for a seat in Epicus. Groups are separate from teams: being in a group does not put you in a team or share anything with the group's other members.
The teams you are a member of (you join a team only after accepting), buddy and coaching relationships you accept, and invitations you send or receive. If someone invites you, we store the email address and name they entered so we can send the invitation. If an organization invites you, you are added to it straight away, but your account stays inactive until you accept the invitation.
Your answers to team surveys and the notes you add to team surveys and team exercises.

Coaching and development data

This is the heart of the product, and the most personal data we hold:

Your conversations with the AI coach, including onboarding, check-ins and meditations. If you use the microphone, your voice recording is converted to text (see section 4); the recording itself is not stored.
Notes the AI coach keeps so it can remember you between conversations: a short profile (your work context, strengths, growth areas and patterns it has noticed) and events you have told it about, such as a difficult meeting or a decision.
Your goals, development needs, exercises and the progress you log on them, courses and lessons you follow.
Assessments and scores: your leadership development level, skill and belief assessments, questionnaires (including a personality questionnaire) and the results derived from them.
Reflections you write in the app, for example the worries, hidden commitments and assumptions you map during a breakthrough.
The leadership test, if you take it before creating an account: the conversation and your result are stored without your name or email address. If you create an account within 30 days, from the same browser or app, they are linked to your account; otherwise they are deleted.

We do not ask for sensitive data such as health, religion or political views. Coaching conversations are free text, though, so you may choose to mention such things. If you do, we use them to coach you, and if they point to a serious risk the coach can raise a safety warning (see section 4). We filter them out before we use any data to train our own models. You can have them deleted at any time by deleting your account (see section 8).

Seats and usage

Organizations pay for Epicus per seat, so for people who use Epicus through an organization we keep:

A usage register: each time you start a session in the app (by signing in, or unlocking the app after it has locked), we record that you did, when, and which organization you belonged to at that moment. Organizations are invoiced on the basis of this register.
For each month, when you first and last used Epicus that month.
Your seat: when you got it and, once it is released, when and why (for example because you were removed from the organization, or because you had not used Epicus for two months and someone else was waiting for a seat).
If all seats are taken, your place on the waiting list: when you asked for a seat and whether you have priority, given to you personally or through a team or group.

Payment and invoicing data

When you sign up a company, payment is handled by Stripe. Stripe keeps the organization's card and charges it for each invoice. We send Stripe the organization's name, its invoicing email address, our internal reference numbers for the organization and the person signing up, and the amounts and periods we invoice. We receive back whether a payment succeeded. We never see or store card or bank details.

We store each invoice we send. For flex seats, which are billed for every member who used Epicus in the month, the invoice lists each of those members by name and email address with the last day they used Epicus that month. Invoices are emailed, with a PDF, to the invoicing address the organization gave us (or to its finance contacts), and can be seen in the organization's dashboard.

Messages from Epicus in the app

We sometimes show a message when you open the app, for example to tell you that our terms have changed, or open a page for you. We store which messages and pages were queued for you and when you confirmed or opened them, so that you see each one only once.

Technical data

A log of requests made to our servers: which endpoint was called, when, by which account, and for most requests their content, with passwords, codes and other credentials removed. Requests that carry your coaching content (conversations, development, exercises, assessments, team surveys and messages to us) are logged without their content. The log does not contain your IP address. We use it to find bugs, investigate abuse and keep the service secure.
Your IP address, which we use in short-lived counters that limit how often something can be tried from one address, such as signing up or signing in.
Error reports: when something goes wrong on our servers, a report with technical details of the request (such as your IP address, browser type and the data sent, with passwords and other credentials removed) is emailed to our technical team.
Standard server logs kept by our hosting providers.

When you contact us

If you email us, use a contact form or send feedback in the app, we keep your name, email address, phone number (if you give it) and your message so we can answer. Feedback sent in the app is stored with your account and the page you sent it from.

3. Why we use it, and on what legal basis

Purpose	Legal basis (GDPR)
Creating and securing your account, signing you in, two-step verification and the app lock	Performance of our contract with you (Art. 6(1)(b))
Signing you in with Google or Microsoft, if you choose to	Performance of our contract with you (Art. 6(1)(b))
Creating and updating accounts and groups provisioned from your organization's Microsoft Entra ID, and using groups to give seat priority	Our and your organization's legitimate interest in managing who in the organization uses Epicus (Art. 6(1)(f))
Providing AI coaching, exercises, courses, assessments and progress tracking	Performance of our contract with you (Art. 6(1)(b))
Voice input in the chat (only when you tap the microphone)	Your consent, given by choosing to use the microphone (Art. 6(1)(a))
Providing team features, buddies, coaching relationships and the organization dashboard, and linking accounts on an organization's verified email domain to that organization	Performance of the contract, and our and your organization's legitimate interest in running its development programme (Art. 6(1)(b) and (f))
Managing your organization's seats and waiting list, and keeping the usage register that invoices rest on	Performance of the contract with your organization, and our and your organization's legitimate interest in billing correctly for actual use (Art. 6(1)(b) and (f))
Processing payments, charging the saved card, and sending and keeping invoices, including the list of members billed for flex seats	Performance of the contract, our legitimate interest in invoices your organization can check, and our legal obligations under Dutch tax law (Art. 6(1)(b), (c) and (f))
Showing you messages from Epicus in the app, such as changes to our terms, and remembering that you have seen them	Performance of our contract with you (Art. 6(1)(b))
Deleting accounts that have been inactive for a year after being deactivated	Our legal obligation not to keep personal data longer than needed (Art. 5(1)(e) and 6(1)(c))
Service emails: sign-up and sign-in codes, invitations, password resets, payment reminders	Performance of the contract (Art. 6(1)(b))
Request logs, error reports, bot checks at sign-up, limiting abuse and keeping the service secure	Our legitimate interest in a secure, working service (Art. 6(1)(f))
Improving the product using aggregated usage statistics	Our legitimate interest in improving Epicus (Art. 6(1)(f))
Training and improving our own models (machine learning and AI) to find the right development need, exercise and moment to step in, used only within Epicus	Our legitimate interest in helping you grow as a leader faster, which is what you use Epicus for (Art. 6(1)(f)); you can object at any time (see section 4)
Answering your questions and feedback	Our legitimate interest in helping you (Art. 6(1)(f))
Safety warnings when the coach notices signs of serious risk to you or others	Our legitimate interest, and yours, in keeping you and others safe, and protecting the vital interests of you or another person (Art. 6(1)(d) and (f)); for health information, protecting vital interests (Art. 9(2)(c))
Sensitive information you choose to mention in a coaching conversation	Your explicit consent, given by sharing it with the coach (Art. 9(2)(a)); you can withdraw it by deleting your account

We do not sell your data, we do not use it for advertising, and the app contains no advertising or third-party tracking software.

4. How the AI coach uses your data

The coach is powered by large language models. To produce a reply, we send the relevant part of your conversation to a language model, together with context the coach needs: your first name, your goal and development need, your exercises and progress, and the profile and events the coach keeps about you. When you use the team coach, the names and roles of your teammates, and the profiles of teammates who switched on sharing, are included too. The model returns text, which we store as part of your conversation.

We reach these models through OpenRouter, which forwards each request to the provider of the model in use. Today these are mainly models from Google and OpenAI, with models from Anthropic and DeepSeek as fallbacks when a main model is unavailable.
To let the coach find earlier conversations and events by meaning, the text of your messages and events is also converted into numerical representations ("embeddings") by an OpenAI model via OpenRouter. These are stored with your data in our own database.
When you speak to the coach, the audio clip is sent to a Google Gemini model via OpenRouter to be transcribed. The transcript appears in the input box for you to check before sending. We do not store the recording.
We do not send your email address or account identifier with these requests. We have set up our OpenRouter account so that requests are not stored and not used for training, by OpenRouter or by the model providers it forwards them to.
The coach estimates your leadership development level and suggests goals and exercises. These are suggestions to support your own development. They are not used to make decisions about your employment, and no decision with legal or similarly significant effects is made about you by automated means.
Safety warnings: if the coach notices signs that you or someone else may be at serious risk, such as self-harm, harm to others or physical danger, it records a warning with a short note. A small number of authorized Epicus staff are notified so we can respond. They see the kind of risk and the coach's note, not your conversation.

Training our own models

Epicus is there to help you grow as a leader, and we keep working on how fast it can do that. To that end we may use the data described in this policy, including your conversations with the AI coach and the profile, events, exercises, assessments and progress that go with them, to train and improve our own models. These are not only language models but also machine-learning models that help us find the right development need, the right exercise and the right moment to step in. We use them for one purpose only: to help people grow their leadership level and leadership skills faster.

Before any data is used for training, we filter out health information and other sensitive data, such as religious or political views.

These models are used only within Epicus. We do not share, sell or license them, or the data we train them on, to anyone else. This is separate from the model providers above, which do not train on your data.

You can object to this at any time by emailing privacy@epicus.ai. From then on, we no longer use your data to train our models. Deleting your account has the same effect.

5. Who can see your data

Within your organization

If you use Epicus through your employer, your employer is the customer, but your coaching is yours:

Your organization's administrators can see the list of people in the organization: name, email, photo, country, time zone, role, whether they are an administrator, whether their account is active, when they joined and when they last signed in. They can also remove people from the organization. They, and the organization's other contacts such as its finance contact, can see the organization's groups and who is in them.
Seats: your organization's administrators can see who holds a seat (name, email, when they got it and when they last used Epicus) and who is waiting for one (name, email, when they asked and whether they have priority). They can give seats, free them and give priority.
Invoices: the organization's administrators and finance contacts, and whoever reads its invoicing email address, can see its invoices, including the names, email addresses and last day of use of the members billed for flex seats.
The organization dashboard otherwise shows only aggregated figures: how many people used the app per week, month or year, how many exercises are active, how many coaching conversations take place, how people are spread across development levels, and team culture scores. Development levels, leader counts and culture scores that rest on fewer than five people are not shown. It does not show your conversations, your notes, your level or your individual answers.
Colleagues in your organization can see your name, email, photo, country, time zone and role, for example when choosing a buddy.
Your team sees team survey results as combined scores and counts. Notes you add to a team survey or a team exercise are shown to the team without your name, though in a small team others may be able to tell who wrote what.
Team sharing: if you switch on sharing for a team (it is off by default), teammates who have also accepted the team can see your development needs, your exercises and the notes you log on them, your personality questionnaire scores and your badges. The team coach can then also use your personality scores when your teammates talk to it.
A buddy, once you have both accepted, can see your development needs, your exercises and the notes you log on them, your personality questionnaire scores and badges, and your development phase, level and progress, with the coach's note on your progress.
A human coach, only if you accept their invitation to coach you, can see your name, email, photo, role and time zone; your level, goal and development need; your full development profile, including what the AI coach noted from your conversations; your breakthrough map and the coach's recommendation for it; your exercises with your latest notes; and how active you are (for example when you last practised and how many conversations you have had). A human coach can also change your development phase. A coach cannot read your conversations with the AI coach.

Service providers

We use the following service providers. Those that process personal data on our behalf do so only on our instructions and under a data processing agreement.

Provider	What for	Where
Scaleway (France)	Hosting of the app servers, database and its backups, file storage (such as profile photos and course videos), scheduled jobs and secrets	Amsterdam, the Netherlands (EU); database backups in another Scaleway data centre in the EU
Fly.io (USA)	Hosting of this website	Amsterdam, the Netherlands (EU)
OpenRouter (USA)	Routing requests to AI models for coaching, embeddings and voice transcription	United States
AI model providers via OpenRouter: Google, OpenAI, Anthropic, DeepSeek	Generating coaching replies, embeddings and transcripts	Mainly the United States; other countries depending on the model and hosting provider
Postmark (ActiveCampaign, USA)	Sending emails, such as sign-in codes, invitations and password resets, and forwarding contact messages, feedback and error reports to our team	United States
Namecheap Private Email (USA)	Our email inboxes, where your emails, contact messages, feedback and error reports arrive	United States
Stripe	Payment processing for organizations: the saved card, the first payment and the monthly and yearly invoices	EU and United States
Cloudflare (USA)	Bot check (Turnstile) when you create an account	United States and a worldwide network
Matomo Cloud (InnoCraft)	Cookieless visitor statistics for this website only	Frankfurt, Germany (EU)
Google Fonts	Loading fonts on this website and in the app	United States and elsewhere
jsDelivr	Loading a script library on this website	Worldwide network

Google and Microsoft sign-in

If you sign in with Google or Microsoft, you sign in on their pages, and they learn that you are signing in to Epicus. They do this as independent controllers under their own privacy policies (Google, Microsoft), not as our processors. If your organization provisions accounts and groups from Microsoft Entra ID, your organization decides what Entra sends us, and Microsoft processes that data for your organization under its agreement with them.

Within Epicus, access to personal data is limited to the people who need it to run, support and secure the service.

We may also disclose data where the law requires it, for example to comply with a court order.

6. International transfers

Our database, servers and file storage are hosted by Scaleway in Amsterdam, and our database backups in another Scaleway data centre in the European Union. This website is hosted by Fly.io on servers in Amsterdam. Some of the providers above, notably OpenRouter, the AI model providers, Stripe, Postmark, Cloudflare and our email provider Namecheap, are based in or process data in the United States or other countries outside the European Economic Area. For those transfers we rely on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards. If you sign in with Google or Microsoft, or your organization uses Microsoft Entra ID, the data those companies hold about you may be processed outside the European Economic Area under their own terms.

7. How long we keep it

Your account and coaching data: for as long as you have an account. When you delete your account, it is deleted permanently (see section 8).
Deactivated accounts: an account that is not active, for example because your organization deactivated it, removed or disabled you in Microsoft Entra ID, or created it for you by invitation or provisioning and you never activated it, is deleted permanently, with its data, after one year of inactivity: one year after it was deactivated or last used, whichever is later.
Safety warnings: for as long as you have an account.
The link to your Google or Microsoft account: for as long as you have an account. Microsoft sign-in stops working when your organization disconnects Microsoft 365 from Epicus.
Accounts provisioned from Microsoft Entra ID: an account your organization removes or disables in Entra is deactivated, and then deleted after one year of inactivity like any deactivated account. You or your organization can ask us to delete it sooner.
Groups: until your organization deletes the group, in the dashboard or in Entra. Your membership ends when your organization takes you out of the group, or when you delete your account.
Leadership tests taken without an account: 30 days, then deleted automatically, unless you have linked the test to a new account by then.
Company sign-ups that are never paid for: we send reminders, and if the sign-up is still unpaid about 13 days after it was created (and at least 3 days after a final notice), the account and organization are deleted automatically.
Invitations that are never accepted: until the person who sent them deletes their account, and at most one year, after which the inactive account made for the invitation is deleted (see deactivated accounts above). You can ask us to delete one sooner.
Request logs: 7 days, then deleted automatically.
Sign-in codes: expire after 10 minutes. Sign-in tokens: expire after 30 minutes without use, and at most 14 days after you sign in.
Seats, waiting-list places, monthly usage and messages from Epicus in the app: for as long as you have an account.
Usage register: 8 years, then deleted automatically, so that invoices can be checked against it for as long as they must be kept. When you delete your account, its entries in the register are kept without your name, email address or account.
Payment and invoicing records, including invoices that list the members billed for flex seats: 7 years, as required by Dutch tax law, also after the account of a member listed on them has been deleted.
Messages to us (emails, contact forms and feedback): 2 years after we receive them, then deleted automatically.
Backups: we back up our database every day and keep each backup for 7 days. Deleted data can remain in these backups until they expire, at most 7 days later.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy.
Rectify data that is wrong. Most of your details can be changed in the app's settings.
Erase your data. You can delete your account yourself, at any time, in the app under Settings → Delete account or at app.epicus.co/delete-account. This permanently deletes your account and personal data, except what we must keep: invoices that list you (for 7 years) and the usage register, in which your entries stay without your name, email address or account (for 8 years). See how to delete your account for details.
Restrict or object to processing, including processing based on our legitimate interests, such as the use of your data to train our own models.
Data portability: receive the data you gave us in a structured, machine-readable format.
Withdraw consent where we rely on it, without affecting processing that took place before.

To exercise any of these rights, email privacy@epicus.ai from the address linked to your account. We answer within one month. If you use Epicus through your employer, you can come to us directly; you do not need to go through your employer.

If you are unhappy with how we handle your data, please tell us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in the EU country where you live or work.

9. Security

All traffic is encrypted (HTTPS). Passwords, sign-in codes and PINs are stored only as hashes. Signing in requires a code sent by email unless you switch this off or sign in with Google or Microsoft, which apply their own second factor. Repeated failed attempts are limited, sign-in tokens expire after 30 minutes without use, and access to production systems and secrets is restricted. When an administrator opens the organization dashboard from the app, they are signed in with a one-time code that is valid for one minute and stored only as a hash. The token your organization's Microsoft Entra ID uses to provision accounts is also stored only as a hash.

10. Cookies, analytics and device storage

The app sets no cookies. It stores only what it needs on your device: your sign-in token, your profile and settings, and the keys for the app lock. Reminders are scheduled by your phone itself; we do not use a push notification service. There is no analytics, advertising or tracking software in the app.
Sign-up: when you create an account, the sign-up page uses Cloudflare Turnstile to check that you are a person and not a bot. Cloudflare receives your IP address and technical information about your browser for this check.
This website uses Matomo to count visits, with cookies disabled. Matomo receives technical data such as your IP address and browser, the pages you visit and the links to other sites you click, and we use it only for aggregated statistics about how the website is used. Our Matomo is hosted in Frankfurt, Germany.
Scripts: this website loads a script library from jsDelivr, a content delivery network, which means your device shares your IP address with it.
Fonts on this website and in the app are loaded from Google Fonts, which means your device connects to Google's servers and shares your IP address with Google.

11. Children

Epicus is a leadership development service for working adults. It is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this policy when the product or the law changes. The date at the top shows when it last changed. If a change materially affects how we use your data, we will let you know in the app or by email before it takes effect.

13. Contact

Epicus
Abe Lenstrastraat 19, Amsterdam, the Netherlands
KvK: 89987144
VAT number: NL004778476B97
Email: privacy@epicus.ai