Privacy statement

Epistola Nederland B.V. (Chamber of Commerce number 42127724) is responsible for the personal data described in this statement. You can reach us about privacy at privacy@epistola.app.

This statement covers our website epistola.app, Epistola accounts (auth.epistola.app) and the public demo environments (demo.epistola.app and valtimo.demo.epistola.app). It does not cover installations of Epistola that organisations run themselves or that we host for customers; those are described under Self-hosting and hosting for customers below.

To show you a page, your browser sends us technical information, such as your IP address, the page you ask for and your browser type. We use it to deliver the website and to keep it secure and working, not to build a profile of you.

The website runs on our servers at Hetzner in Germany. We do this based on our legitimate interest in offering a secure website that works.

We use Simple Analytics to see how many people visit, which pages they view, where they come from and which kinds of devices they use. Simple Analytics uses no cookies and builds no visitor profiles. The statistics go through our own server, which passes your IP address and browser type on to Simple Analytics so it can filter out bots and estimate the country of a visit. According to Simple Analytics, it does not store IP addresses.

We also record errors that happen in your browser on our website, such as a video that fails to load, so we can fix them. An error report contains the kind of error, the page, and the web address with sensitive values removed. It contains no cookies, form input, account details or sign-in data, and it is processed by Simple Analytics too.

We do this based on our legitimate interest in understanding how the website is used and keeping it working.

You need an Epistola account to use the demo environments and some learning materials. Accounts are kept in our own sign-in service at auth.epistola.app, which runs on our servers in Germany.

For your account we store:

• your email address;
• how you sign in: a password (stored only as an unreadable hash) or a passkey;
• any other details you enter when you create the account, such as a name.

We use this to let you sign in, to give you access to the demos and learning materials that come with your account, and to keep the service secure. We do this because you asked us for an account. When you sign in on our website, we place cookies that keep you signed in; see Cookies and browser storage.

Want your account deleted? Email privacy@epistola.app.

The demo environments are live applications that visitors share. When you use them with your Epistola account, you get a workspace of your own. Its name is based on part of your email address, and what you make there, such as templates and generated documents, is stored in the demo.

The demos are only for trying out Epistola. Do not enter personal data, confidential information or real production data. Demo environments and everything in them may be reset or deleted at any time, without notice.

Our contact form is provided by Tally. What you fill in, such as your name, email address and message, is stored by Tally and sent to us. When you email us, we receive your email address and message.

We use this only to answer you and, if you ask for it, to follow up. We do this based on our legitimate interest in answering questions, or to take steps towards an agreement you ask us about.

We use no advertising or tracking cookies. The website only places cookies it needs, almost all of them when you sign in:

Cookie	What it does	How long
__Host-ep1	Keeps you signed in	15 minutes, renewed while you use the site
__Secure-ep2	Renews your sign-in without asking for your password again	30 days
__Secure-ep3	Protects the step of signing in or creating an account	Up to 1 hour
__Secure-ep4	Lets us sign you out at our sign-in service too	30 days
ep0	Tells the page you may be signed in, so the sign-in button does not flash	30 days
__Secure-epmedia	Lets our video server check that you may watch protected videos. Contains your account ID and access level	Up to 1 hour

The contents of these cookies are encrypted, except the video cookie, which is signed so it cannot be altered.

The website also uses your browser’s local storage to remember your light or dark theme and your progress in interactive training lessons.

All of this is needed for the website to work or only stores your own choices, so we do not ask for permission for it.

We use these providers to run the website and our services:

• Hetzner (Germany): servers for the website, Epistola accounts and the demo environments.
• Simple Analytics (the Netherlands): visitor statistics and error reports.
• Tally (Belgium): the contact form.
• Bunny (Slovenia): delivers videos, subtitles and images from media.epistola.app through servers around the world.
• jsDelivr: delivers the script of the video player through servers around the world.

When your browser loads a video or the video player, the provider that delivers it receives your IP address, as with any request on the internet.

Organisations that run Epistola themselves decide which data they process with it and are responsible for it. We have no access to those installations.

When we host Epistola for a customer, the customer is responsible for the documents and data processed in it, and we only process them on the customer’s instructions. A separate data processing agreement sets out the details, including how long data is kept and where it is hosted.

You can ask us to see the personal data we have about you, and to correct or delete it. You can also object to processing that is based on our legitimate interest, ask us to limit processing, or ask for a copy of your data in a common format.

Send your request to privacy@epistola.app. We answer within one month.

If you think we handle your data incorrectly, please tell us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may update this statement. The date at the top shows when it last changed.