Privacy policy
How Epicat processes personal data and how to exercise your rights.
Last reviewed: 2026-10-13
Draft for review — not yet effective
Bracketed fields mark details that still need confirmation. This draft does not replace any agreement already in force.
Controller and scope
WildJS – Tomas Sivicki, Kaiserstrasse 103, 52134 Herzogenrath, Germany, Germany, operates Epicat, a workflow harness builder for AI agents, workflows and integrations. Contact legal@epicat.com about this policy or your personal data. Company information is in our Imprint.
This policy covers processing for which we determine the purposes, including website operation, account administration, billing and legal compliance. When a customer supplies personal data to an agent, workflow or connected source, we generally process it on that customer's instructions under our DPA. Contact the relevant customer about that data; we assist them as required by the DPA and law.
Data, purposes and legal bases
We receive information you submit, information generated through use of the service, and information from organization administrators and connections you authorize. Depending on use, this includes account details, workspace memberships, prompts, files, messages, workflow definitions, outputs, connection credentials, usage records, invoices, support correspondence, IP addresses and technical logs.
Where the GDPR applies, the following bases apply to our controller activities:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Provide accounts, requested features and support | Account, usage and communication data | Contract, Article 6(1)(b); legitimate interests in administering business customers' accounts, Article 6(1)(f) |
| Billing, accounting and legal duties | Account and transaction records | Contract, Article 6(1)(b); legal obligation, Article 6(1)(c) |
| Security, troubleshooting and legal claims | Necessary technical, account and incident records | Legitimate interests in a secure service and protecting legal rights, Article 6(1)(f); legal obligation where applicable |
| Optional marketing and non-essential tracking | Contact preferences and relevant interaction data | Consent, Article 6(1)(a), where required; another basis only where applicable law permits |
Customer content processed on a customer's behalf follows that customer's instructions and legal basis. Necessary account and transaction information is required to provide the corresponding service; optional consent can be refused or withdrawn without losing unrelated features.
Where we receive your personal data from another source as controller, we must identify the relevant source, including whether it is publicly accessible, and provide the information required by Article 14 GDPR within the applicable period, unless a lawful exception applies. This is generally within one month, or earlier at the first communication or disclosure where required.
AI and connected services
An enabled model or integration may receive the inputs, context, files or tool results needed to perform your request. Limit permissions and avoid unnecessary personal data. Customer-selected services may also process information under their own contracts and privacy notices.
[AI_DATA_USE]: specify Epicat's and each model provider's actual training, evaluation, human-review, abuse-monitoring and retention practices, any opt-outs, and any significant automated decisions about individuals and their safeguards. This draft makes no unverified no-training or zero-retention promise.
Where automated decisions within Article 22 GDPR occur, the completed notice must explain their legal basis, meaningful information about the logic, and their significance and expected consequences, together with applicable human-intervention and challenge rights. Generating an AI response does not by itself establish whether Article 22 applies.
Recipients and international transfers
Information may be disclosed to authorized personnel, contracted service providers, recipients you choose when sharing content, and authorities or advisers where required by law or necessary for legal claims. Organization administrators may access information within their permissions. A corporate transaction may involve disclosure subject to applicable safeguards.
Relevant provider categories include hosting, storage and network/security services; account authentication and email delivery; payment and billing administration; analytics and support; and enabled AI models or integrations. Each receives only information needed for its relevant function. Providers acting on our instructions must be subject to appropriate processing and confidentiality terms; payment, identity or customer-selected providers may instead act under their own responsibilities for particular activities. Their role must be assessed for the activity, rather than inferred from the product name.
[PROVIDERS_AND_LOCATIONS]: identify actual recipients, their purposes, data and processing countries, distinguishing our processors, independent controllers and customer-selected connections. The customer-data subprocessor schedule forms part of the DPA.
[TRANSFER_SAFEGUARDS]: identify restricted transfers and the applicable adequacy decisions or contractual safeguards, including any necessary supplementary measures. You may request information or a copy of applicable safeguards at legal@epicat.com, subject to lawful redactions.
Cookies and retention
[TRACKING_AND_CONSENT]: list actual cookies, local storage and similar technologies, with providers, purposes, lifetimes and working preference controls. Storage or access that requires consent, including under Section 25 TDDDG, must not occur before consent. You can withdraw consent for the future; browser blocking may affect requested functions.
[RETENTION_PERIODS]: state the retention periods or specific criteria for accounts, customer content, execution histories, credentials, support, logs, analytics and billing records, including deletion triggers and backup expiry. Data retained for a legal obligation or dispute remains restricted to that purpose. Customer-data return and deletion follow the DPA.
Pseudonymized records remain personal data when they can be related to a person. Any claim that analytics are anonymous must be supported by the actual method and re-identification risk, rather than merely removing names.
Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. You may withdraw consent for future processing and have rights concerning solely automated decisions with legal or similarly significant effects.
Send requests to legal@epicat.com. We may reasonably verify identity. Under the GDPR, we normally respond within one month and explain any permitted extension. You may complain to a competent supervisory authority, including where you live, work or believe an infringement occurred.
Requests are generally free of charge. We may charge a reasonable administrative fee or refuse a request only where the GDPR permits, with an explanation. Where required, we will tell recipients about a correction, erasure or restriction and inform you about those recipients on request. Exercising your rights does not remove restrictions needed to protect another person's rights or meet a binding legal obligation.
Our privacy contact is Tomas Sivicki at legal@epicat.com. For our establishment in Herzogenrath, the supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany. This does not limit your right to complain to another competent authority.
[DPO_APPOINTMENT]: determine whether a statutory data protection officer must be appointed and complete any required independent appointment and contact disclosure. The privacy contact above is not represented as an independently appointed DPO.
Security, age requirements and updates
Security measures for customer processing belong in the DPA's agreed measures. No service can guarantee absolute security. Report suspected data exposure to legal@epicat.com.
Payments and monetization are restricted to adults aged 18 or over. A minor may use only free, non-monetized features with parental or guardian authorization and any consent required by law. This permission does not extend to paid execution, purchases or selling. If you believe a minor is using restricted features or lacks the required authorization, contact legal@epicat.com so we can investigate, restrict access and address the data as required by law. See the eligibility rules in our Terms.
We publish policy revisions with an updated date and give additional notice where required. Before using personal data for a new purpose, we must provide the required information about that purpose and establish a valid legal basis. A policy update does not replace any consent required for new processing.