1. Data controller
EPTA5 INC., 78 avenue des Champs-Élysées, 75008 Paris, France · SIRET 10382595600016
Data Protection Officer (DPO) : dpo@epta5.com
2. Data we collect
Identity data
- Name, email address, country of residence
Payment data
- Card details handled exclusively by Stripe: never stored on our servers
- Transaction history, billing information
Usage data
- Connection logs, activity records
- Terminal preferences, saved watchlists, analysis history
- BRAIN AI queries (for service improvement, with consent)
Technical data
- IP address, browser, OS, device type
- Cookies and similar tracking technologies (see Cookies policy)
3. Why we process your data
- Service delivery: account management, terminal access
- Service improvement: analytics, bug fixes, performance
- Communications: transactional emails, optional newsletter (consent-based)
- Legal & tax compliance: accounting records, fraud prevention
- Security: access control, abuse detection
4. Legal bases (GDPR Article 6)
- Contract performance: to provide the service you subscribe to
- Explicit consent: for marketing communications and optional cookies
- Legitimate interest: security, anti-fraud, product improvement
- Legal obligation: accounting, tax records
5. Retention periods
- Active accounts · throughout the contractual relationship
- Closed accounts · up to 3 years from last interaction
- Billing records · 10 years (legal requirement, French Commercial Code)
- Connection logs · up to 12 months
- Analytics cookies · up to 13 months (CNIL guidance)
6. Third-party processors
- Stripe: payment processing (US/EU)
- Cloudflare: hosting, CDN, security (US/EU)
- Email provider: transactional emails (EU)
International data transfers outside the EEA rely on EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, where applicable.
7. Your rights under GDPR
You can, at any time, exercise the following rights :
- Access · obtain a copy of your data
- Rectification · correct inaccurate data
- Erasure · "right to be forgotten"
- Restriction · limit processing
- Portability · receive your data in a structured format
- Objection · oppose certain processing (notably marketing)
- Withdraw consent · for any consent-based processing
Send your request to dpo@epta5.com. We respond within 30 days.
8. Cookies
Essential cookies require no consent. Analytics and functional cookies require your explicit consent via the banner on first visit. Full details in our Cookies policy.
9. Children
EPTA5 is intended for users aged 18 or older. We do not knowingly collect data from minors. If you believe we have, contact dpo@epta5.com.
10. Supervisory authority
You can lodge a complaint with the French data protection authority : CNIL · 3 place de Fontenoy, 75007 Paris.
11. Updates
We may update this policy. Material changes will be notified by email and announced on this page. The "Last updated" date above always reflects the current version.