Who we are
Epic Portal is the client portal of Epic Algorithms. It is operated by EPIC ALGORITHMS YAZILIM DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ ("Epic Algorithms", "we", "us"), registered at the İstanbul Ticaret Sicili Müdürlüğü under number 1004025 (MERSIS 0336128310500001), Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul Sitesi C1 Blok No: 2b İç Kapı No: 376 Ataşehir / İstanbul, Türkiye.
We are the data controller for the personal data described in this policy. You can reach us about privacy at [email protected].
What this policy covers
This policy covers Epic Portal at portal.epicalgorithms.com: the client accounts our clients' staff use, the support requests they send us by email or through the portal, and the sign-in options the portal offers, including Google and Microsoft. Where your company has a separate agreement with Epic Algorithms, that agreement also governs how we handle data we process on its behalf.
Data we collect
Account information
- Your name, work email address, phone number and job title, as entered by you, your company's portal admin or our team.
- Your company, your role in the portal and any extra permissions you were given.
- A profile photo, if you upload one. We re-encode it and drop any embedded metadata such as location.
Sign-in information
- Your password, stored only as a one-way hash, and your two-factor authentication settings if you turn them on.
- When you sign in with Google or Microsoft: your name, email address, whether the provider has verified that address, and the provider's identifier for your account. See Google user data and Microsoft sign-in.
Support communications
- The emails you send to our support addresses and the replies you write in the portal, including attachments.
- The addresses of people copied on those emails, so replies can reach them too.
- The status and history of each ticket, and who opened it.
Security and usage records
- Sign-in events, including the time, IP address and browser, and changes to who can access the portal.
- Technical error reports when something in the portal goes wrong.
Cookies and analytics
Epic Portal only uses strictly necessary cookies. The Cookie Policy lists every one of them.
How we use it
- To create and run your account and let you sign in securely.
- To match you to the invitation or account your company set up.
- To receive, track and answer your support requests, and to email you and the people copied about their progress.
- To show your name and photo to the people working on your requests, on your side and ours.
- To keep the portal secure: detect misuse, investigate incidents and keep an audit trail of access changes.
- To meet our legal obligations.
We do not sell personal data, use it for advertising, or build marketing profiles from it.
Google user data
If you choose "Sign in with Google", Google asks you to share basic profile information with Epic Portal. This section explains exactly what we receive and what we do with it.
What we access
We request only the openid, email and profile scopes. Through them we receive your name, your email address, whether Google has verified that address, and your Google account identifier. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service.
How we use it
- Your verified email address is used to find the invitation or account your company set up for that address and connect your Google account to it.
- Your Google account identifier is stored so that the same Google account signs you in next time.
- Your name may be used to fill in your profile.
We use this information only to sign you in and to provide the portal features described in this policy.
How we store and protect it
We store your Google account identifier, email address and name with your Epic Portal account, in our database and backups, protected as described under Security. We do not store Google access tokens or refresh tokens for client accounts.
Sharing
We do not share, sell or transfer Google user data to third parties, except to the service providers listed under Who we share it with where needed to run the portal, when you ask us to, to comply with the law, or as part of a merger or acquisition with the same protections in place.
Limited Use
Epic Portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not use it to develop, improve or train generalised artificial intelligence or machine learning models, and no person at Epic Algorithms reads it unless you ask us to, it is needed for security or to comply with the law.
Removing access
You can disconnect Google from your account page in Epic Portal at any time, and revoke Epic Portal's access in your Google account at myaccount.google.com/permissions. When you disconnect, we delete the stored Google account identifier. To have your whole account deleted, see Your rights.
Microsoft sign-in
If you choose "Sign in with Microsoft", we request the openid, email, profile and offline_access permissions and receive your name, your account's sign-in address and your Microsoft account identifier. We use and protect them in the same way as Google user data above, and we do not store Microsoft access tokens for client accounts. You can disconnect Microsoft from your account page, and manage the apps you have allowed at myapps.microsoft.com or account.live.com/consent/Manage.
Legal bases
Under the EU and UK General Data Protection Regulation and Türkiye's Personal Data Protection Law No. 6698 (KVKK), we rely on:
- Contract: to provide the portal and support under our agreement with your company.
- Legitimate interests: to keep the portal secure, keep records of support work and improve our service, balanced against your rights.
- Legal obligation: where the law requires us to keep or disclose information.
- Consent: for optional choices such as signing in with Google or Microsoft, which you can withdraw by disconnecting them, and for analytics cookies, which you can switch off under Cookie settings.
Who we share it with
We share personal data only with service providers that help us run the portal, under contracts that require them to protect it and use it only on our instructions:
- Postmark (ActiveCampaign): sending and receiving support emails.
- Amazon Web Services: storing files such as attachments and profile photos.
- Our cloud hosting provider: running the servers and database behind the portal.
- Bugsnag (SmartBear): error reports that help us fix problems.
- Anthropic and OpenAI: AI features our team may use to help with support work. Under their business terms, data sent to them is not used to train their models.
- Twilio: text messages, where a portal feature uses them.
- Google and Microsoft: as sign-in providers, when you choose to use them.
People at your company with the right role in the portal can see your profile and the tickets shared with them. We may also disclose information when the law requires it.
International transfers
Some of our service providers process data outside Türkiye and the European Economic Area, including in the United States. Where they do, we rely on safeguards recognised by the applicable law, such as standard contractual clauses, and on the notifications and undertakings required under KVKK.
How long we keep it
- Account information: while your account is active, and for a reasonable period after it is closed or your company stops being a client.
- Support communications: for as long as we provide services to your company, and afterwards as long as needed for legal, accounting or dispute purposes.
- Sign-in identifiers from Google or Microsoft: until you disconnect the provider or your account is deleted.
- Security records and error reports: for a limited period, long enough to investigate problems.
Security
The portal is served only over HTTPS. Passwords are hashed, two-factor authentication is available, access inside the portal follows each person's role, files are served through signed, expiring links, and our team's access is limited to people who need it. No system is perfectly secure, so please keep your password private and tell us at [email protected] if you suspect misuse of your account.
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. You can withdraw consent at any time without affecting what happened before. Under KVKK you also have the rights listed in its Article 11.
To use these rights, email [email protected]. We answer within 30 days. Where we process data on behalf of your company, we may pass your request to them. You can also complain to your data protection authority, in Türkiye the Personal Data Protection Authority (KVKK).
Children
Epic Portal is a business tool for our clients' staff. It is not meant for children under 16, and we do not knowingly collect their data.
Changes
We will update this policy when the portal or the law changes, and change the date at the top. If a change materially affects how we use your data, we will let you know in the portal or by email before it takes effect.
Contact
EPIC ALGORITHMS YAZILIM DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ
Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul Sitesi C1 Blok No: 2b İç Kapı No: 376 Ataşehir / İstanbul, Türkiye
Email: [email protected]