← epigraphia.appPrivacy Policy — EpigraphIA
Xolo Beaver Studios Inc. respects your privacy. This Policy explains what information is handled when you use the EpigraphIA desktop application, how it is used, and what your rights are. EpigraphIA is designed around the principle of minimal data collection.
1. Core principle: your content lives on your computer
EpigraphIA is a local-first application. We do not collect, store or have access to your Content —your novels, sketches, images, projects, designs, ideas or prompts—. All of it remains 100% on your computer. We keep no copies or backups of it, we have no access to it, and no server of ours receives it.
The Application runs without telemetry and without servers of our own: 0 telemetry · 0 servers · everything on your PC.
Note about the Beta Program: during the Beta Program (prior to commercial launch and still active until September 2026 for invited participants) a proxy operated by Xolo Beaver Studios Inc. temporarily processes certain AI provider requests to let participants try the product without configuring their own keys. This proxy keeps only aggregate usage counts (to manage granted credits) and transient IP addresses for a maximum of 30 days. Full details are in the Beta Program Addendum invited participants receive by email. This mechanism DOES NOT apply to purchased licenses (those operate 100 % local-first as described in this policy).
2. Information the Application does NOT collect
EpigraphIA does not collect, transmit or store on our servers:
- The text of your works, sketches, images, projects or designs.
- Your prompts or the AI-generated output.
- Location data, biometric data, health or financial information.
- Browsing or activity history.
- Usage analytics or automatic crash reports (there is no telemetry).
3. API keys (BYOK)
The API keys you configure (OpenAI, Anthropic, Google, Replicate, Pixabay, etc.):
- Are encrypted locally on your machine (using the operating system's secure storage).
- Are never stored in plain text and are never sent to our servers.
- Are visible only to you within the Application.
- Are used to call the provider's API directly from your computer; that traffic goes from your machine to the provider, not through us.
Any content you send to those APIs is additionally subject to the corresponding provider's privacy policy.
4. Information related to purchases and support
Although the Application does not collect data, information may exist in connection with your purchase of a license or your contact with support, handled outside the Application:
- Purchase: processed by Lemon Squeezy Inc. (Delaware, USA), our Merchant of Record (MoR). Lemon Squeezy collects your email, payment and tax details under its own privacy policy. We receive only your email and country (for licensing and billing purposes) and do not store your card details.
- Support / contact: if you write to us (support, legal, privacy), we receive your email address and the content of your message so we can respond.
We use that information solely to process your purchase, validate your license, respond to your requests, send you important product notices and comply with legal obligations. We do not sell it, we do not use it for advertising or profiling, and we do not use it to train AI models.
5. Sharing with third parties
We only share information when necessary to operate:
- Payment processor (for the transaction).
- Email service (to send you notices related to your license, if applicable).
- Authorities, only where there is a valid court order or legal obligation.
We do not share with: AI providers (API calls go straight from your PC), advertisers, data brokers, social networks or AI training services.
6. Data retention
- Purchase/support data: retained for as long as necessary for the purpose and for applicable accounting/legal obligations, and deleted once no longer needed.
- API keys: remain on your machine for as long as you choose; you can delete or reset them at any time from Settings.
- Your Content: we do not have it; if you delete it from your PC, it is gone.
7. Your rights (PIPEDA · CCPA/CPRA · LFPDPPP · GDPR)
Depending on your jurisdiction, you have the right to access, rectify, delete and object to the processing of the personal data we may hold in connection with your purchase or support, as well as the right to data portability where applicable.
- How to exercise them: write to legal@xbstudios.ca, state which right you are exercising and verify your identity (the email associated with your purchase). We will respond within 30 days.
- Important: as for your creative Content, we cannot give you access to it or a copy of it because we do not have it (it lives on your computer).
8. Security
We protect the data we handle by applying the operating system's secure-storage encryption for sensitive data (such as API keys), TLS for data in transit to processors, and the principle of minimal data collection. No security measure is 100% infallible; you are responsible for keeping your machine and your third-party credentials secure.
9. Cookies and analytics
The EpigraphIA desktop application does not use cookies or web tracking. If you visit the epigraphia.app website, anonymous web analytics tools may apply; see the site's own notice.
10. Incident notification
If we detect unauthorized access to personal data we handle, we will notify the affected individuals and the authorities where required by law, within the applicable legal timeframes, describing what happened and the recommended measures.
11. Rights by jurisdiction
- Canada (PIPEDA): all of the rights above apply.
- U.S. — California (CCPA/CPRA): the right to know, delete, correct, and to no sale of personal data (we do not sell data).
- U.S. — other states: we comply with applicable state regulations.
- Mexico (LFPDPPP): ARCO rights (Access, Rectification, Cancellation, Objection); see also the LFPDPPP Privacy Notice (separate document).
- European Union, European Economic Area and United Kingdom (GDPR / UK GDPR): the rights described in section 12 apply.
12. Users in the European Union, EEA and United Kingdom (GDPR / UK GDPR)
If you are located in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR grant you the following rights with respect to the personal data we may process (remember that the Application does not collect your content; personal data is limited to what is associated with your purchase or your contact with support — see sections 1 through 4).
12.1 Data controller
The data controller is Xolo Beaver Studios Inc. (British Columbia, Canada). Contact: legal@xbstudios.ca.
EU representative (Art. 27 GDPR): EpigraphIA is currently not available to residents of the European Union or the European Economic Area. Our Merchant of Record (Lemon Squeezy Inc.) applies a geo-restriction at checkout to block purchases from those territories. As a result, and since we do not offer products or services to EU/EEA residents, the obligation of Art. 27 GDPR does not apply. When we expand availability to that region we will designate a representative in compliance with Art. 27 and update this section with their name and physical address.
UK representative: EpigraphIA is available to UK residents. Under UK GDPR, the data controller remains Xolo Beaver Studios Inc. (contact address in section 14). Complaints may be filed with the UK's ICO (Information Commissioner's Office) at ico.org.uk.
12.2 Legal basis for processing
We process your personal data on the following lawful bases:
- Performance of a contract (Art. 6(1)(b)): processing your purchase and providing you with the EpigraphIA license and support.
- Legal obligation (Art. 6(1)(c)): keeping accounting and tax records.
- Legitimate interest (Art. 6(1)(f)): ensuring product security, preventing fraud and responding to your requests; always balanced against your rights.
- Consent (Art. 6(1)(a)): for optional communications about updates; you may withdraw it at any time without affecting the lawfulness of prior processing.
12.3 Your rights under the GDPR
You have the right to:
- Access your personal data.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten").
- Restriction of processing.
- Portability of your data in a structured, commonly used format.
- Object to processing based on legitimate interest.
- Not be subject to automated individual decision-making with legal effects (we do not carry out such decisions or profiling).
- Withdraw your consent at any time.
- Lodge a complaint with a supervisory authority (section 12.5).
To exercise them, write to legal@xbstudios.ca. We will respond without undue delay and, at the latest, within one (1) month, extendable as provided by the GDPR where the request is complex.
12.4 International transfers
Because Xolo Beaver Studios Inc. is located in Canada and the payment/email processors may be located outside the EEA/United Kingdom, data associated with your purchase or support may be transferred outside the EEA/United Kingdom. Such transfers rely on valid GDPR mechanisms, such as adequacy decisions (Canada holds a partial adequacy decision from the European Commission for entities subject to PIPEDA) or Standard Contractual Clauses (SCCs) with the corresponding providers. Remember that your content is not transferred because it never leaves your computer.
12.5 Supervisory authority
You have the right to lodge a complaint with the data protection authority of your country (for example, your national Supervisory Authority in the EU/EEA, or the ICO in the United Kingdom), without prejudice to any other remedy.
12.6 Retention
We retain data associated with purchases and support only for as long as necessary for the purposes described and to comply with legal obligations; it is then deleted. We do not retain your creative content (we do not possess it).
13. Children's privacy
EpigraphIA is not directed at children under 13. Between 13 and 17 years of age, the consent of a responsible adult is required, and that adult may request access to or deletion of associated data. Children under 13 may not use the Service. (In GDPR jurisdictions where the age of digital consent is higher, the applicable local age applies.)
14. Changes to this Policy
We may update this Policy. If there are material changes, we will publish the version with its date and, where reasonable, announce it within the Application. Continued use after the changes take effect constitutes acceptance.
15. Contact
For privacy questions or requests:
Email: legal@xbstudios.ca
Xolo Beaver Studios Inc. — Registered address and address for service of notices: 653-5515 Boundary Road, Vancouver, British Columbia, Canada V5R 0E3
Response time: up to 30 days.
This document is a general reference and does not constitute legal advice. It should be reviewed by a professional before commercial publication.