Contact and lead details
Name, email, company, role, website, industry, company size, and the reason you contacted Epoches.
Plain-language notice
Do not send secrets through public forms.
Website forms are for business intake, qualification, and support. They are not a secure channel for passwords, API keys, raw credentials, private customer exports, or regulated records.
If Epoches needs sensitive operational material for an audit or implementation, the access method, retention expectation, and allowed use are defined in the signed engagement paperwork before access is granted.
Information collected
What the website asks for.
Audit application answers
Workflow pain points, tools used, estimated manual hours, urgency, budget readiness, decision-maker status, and optional context you choose to provide.
Masterclass registration details
Registration fields such as name, email, company, role, industry, and the workflow question you want answered.
Technical and anti-abuse signals
Submission timing, honeypot fields, Cloudflare Turnstile tokens, server logs, and the IP address your request arrives with, which is used to rate-limit abuse and is not stored against your submission.
How it is used
Lead data is used to make the next business step useful.
- Respond to inquiries and route them to audit, build, retainer, masterclass, or general follow-up.
- Score audit applications so serious operational opportunities can be prioritized.
- Send confirmations, reminders, and operational follow-up for forms you submit.
- Improve the website, content, conversion flow, and service quality without inventing client proof.
- Protect the site from spam, abuse, credential stuffing, and automated form attacks.
Service providers
Who else handles this data.
Epoches uses third-party providers to host the website, store form submissions, send email, schedule calls, measure site usage, and block automated abuse. Each receives only the data its role requires, and each is bound by a data processing agreement.
We do not sell personal data, and we do not share it with advertising networks or data brokers. If you want the current provider list by name, ask at epochesofficial@gmail.com and we will send it.
Client data boundaries
Website intake is not the same as project data access.
- Client credentials, API keys, passwords, cookies, and tokens must not be submitted through public website forms.
- Workflow samples are requested only after a scoped engagement starts and the access boundaries are agreed in writing.
- AI employee builds use the minimum data the workflow needs, with human approval gates wherever the risk is material.
- Signed statements of work, security addenda, or data processing agreements control any client-specific data handling commitments.
Cookies and tracking
Limited analytics and third-party booking tools.
Epoches does not use advertising cookies or cross-site advertising trackers. When analytics is enabled, the browser creates a random identifier in memory for the current tab and sends events to our server, which forwards them to PostHog. The identifier is not written to local storage and is discarded when the tab closes.
Cal.com booking embeds and Cloudflare Turnstile load third-party scripts on booking and form surfaces. Those providers receive the network and device information needed to deliver their services and may use cookies or browser storage under their own policies. Turnstile is used to block automated submissions, not to build an Epoches advertising profile.
Lawful basis
Why we are allowed to process each thing.
Legitimate interests, and steps preparatory to a contract where you are asking us to quote
Performance of a contract
Consent, withdrawable at any time from any email we send
Legitimate interests
Legal obligation
Retention
How long each record is kept.
Contact and audit enquiries that do not become engagements
24 months from last contact. Long enough to recognise a returning enquiry, short enough not to hold stale business data.
Records relating to a paid engagement
7 years from the end of the engagement. Tax and accounting retention obligations.
Newsletter subscription records
Until you unsubscribe, then 12 months. Proof that consent existed and that the unsubscribe was honoured.
Anti-abuse records such as rate-limit counters
30 days. Only useful while an attack is in progress.
Server and application logs
90 days. Security investigation and debugging.
International transfers
Your data is processed outside your country.
Our hosting, database, email, scheduling, and analytics providers operate in the United States or across a global edge network. Epoches itself operates from Pakistan. If you are in the UK, EEA, or another region with transfer rules, submitting a form means your data is transferred outside that region.
We rely on those providers' own transfer safeguards, which for each of them is a set of Standard Contractual Clauses in their data processing agreement. We do not operate our own infrastructure in the UK or EEA, and we would rather say so plainly than imply local processing we do not do.
Your rights
What you can ask us to do.
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything inaccurate.
- Ask us to delete data we no longer have a lawful reason to keep.
- Object to processing we carry out under legitimate interests.
- Withdraw consent for the newsletter at any time, without affecting anything else.
- Ask us to restrict processing while a dispute about accuracy is resolved.
- Complain to your data protection authority if we have not resolved the matter.
Data controller
Who is responsible for this data.
The data controller for this website is Epoches, at 15 MM Alam Road, C2 Block, Gulberg III, Lahore, Pakistan.
For any request about your data, including the rights listed above, write to epochesofficial@gmail.com. We answer within 30 days. If you are not satisfied with the outcome, you can complain to the data protection authority in your own country.
Questions about data?
Use the contact form before sending sensitive workflow details.
If the question is about a paid engagement, the signed scope or agreement defines the final handling rules. For a privacy request, use the data controller address above.