Privacy Policy

This website, www.eposyne.com, is operated by LoreWeaver BV, a private limited company under the law of the Netherlands.

• Contact for privacy matters: hello@eposyne.com

LoreWeaver BV is the data controller for everything described on this page. You exercise your rights through the contact above or the contact form.

We have not appointed a data protection officer, because nothing this website does requires one. Our supervisory authority is the Autoriteit Persoonsgegevens, the Dutch data protection authority.

This policy covers the public website only: the pages, the contact and press forms, and the analytics that run on them.

It does not cover the products. Architect shows its own privacy policy inside the app, where accounts, your content, and billing are described. Director ships with its own terms. If something on this page and something in a product policy seem to disagree, the product policy governs the product and this page governs the website.

Serving the pages. The site is hosted on Firebase Hosting, a Google service. To deliver a page, Google receives your IP address and the usual request details (the page requested, your browser type, the referring page) and keeps short-lived server logs. Lawful basis: our legitimate interest in running a website.

Our own measurement. To learn how the site is used, each page sends a few short messages to our own server, the one that runs the Architect app at architect.eposyne.com, and to no one else. They say which page was viewed; what kind of place you came from (for example "search", "Reddit" or "direct", never the address itself); the campaign name if the link you followed carried one; whether your screen is phone, tablet or desktop sized; your browser's language (Dutch, English, German or other); and a broad region worked out from your device's time zone setting, not from your IP address. They also say which of the site's buttons and links were used, how long the page was in view and how far down it was scrolled, in bands such as "30 to 60 seconds" and "75%", and which parts of the page stayed on screen for a couple of seconds. Every value comes from a fixed list: no web address, search term, or anything you type is sent. Like any request, each message reaches our server with your IP address and browser details, which are not stored for these counts. On the server the messages become daily totals per page, with no record of a single visit or visitor. Nothing is stored on your device, no cookie and no other entry, and the messages carry no cookie either. Lawful basis: our legitimate interest in knowing which pages are read and which links are used.

Visits within one day. To see how visitors move through the site within a single day (where a visit starts, which pages follow, and where it ends), our server computes a key from your IP address and your browser's identification string, combined with a random value that is replaced every day. The key is computed on our server and never stored on your device, and the IP address and browser string themselves are not stored. After the day ends, that day's steps are turned into totals and deleted, together with that day's random value, so no key can be traced back or linked to any other day. A route through the site is kept only when at least five visits followed it. Lawful basis: our legitimate interest in understanding how the site is navigated.

Optional analytics and marketing tags, only if you accept. If you accept in the cookie banner, two further tools load: Google Analytics, operated by Google, and the LinkedIn Insight Tag, operated by LinkedIn. Both set cookies, both build a picture of how visitors use the site, and LinkedIn also uses it to measure and target advertising on LinkedIn. Neither loads before you answer the banner, and neither loads if you reject. Lawful basis: your consent, which you can withdraw at any time (section 04).

Contact and press forms. When you send a form we receive what you typed: your name, email address, company or outlet, project type, and message. The form is delivered by Formspree, a form-handling service in the United States, which forwards it to our mailbox. We use it to answer you and for nothing else. Lawful basis: taking the steps you asked for before any contract, and our legitimate interest in answering enquiries.

Fonts. The typeface on this site is loaded from Google Fonts, so your browser requests the font files from Google, which sees your IP address in that request.

Links to other services. The site links to Discord, Calendly, LinkedIn, Reddit, X, and the Architect app. Following a link takes you to that service, whose own policy applies from that point.

We do not sell personal data, we do not buy data about visitors from anyone, and we make no automated decisions about you.

On your first visit a banner asks whether the optional tools in section 03 may load. Accept loads Google Analytics and the LinkedIn Insight Tag on this and later visits. Reject loads neither. Your answer is stored in your browser under the name lw_consent; that entry holds only the word "accepted" or "rejected" and is the one thing this site writes to your device itself.

To change your mind, use the Cookie choices link in the footer of any page. It clears the stored answer and shows the banner again. Clearing this site's data in your browser does the same, and also removes any cookies the optional tools set.

The pages themselves and our own measurement work without any cookie, so this site has no "necessary cookies".

Global Privacy Control and Do Not Track. If your browser sends the Global Privacy Control or Do Not Track signal, the site sends none of the measurement messages described in section 03, and our server also discards any message that arrives with either signal. Google Analytics and the LinkedIn Insight Tag stay behind the banner either way: they load only after you accept.

Campaign parameters. If you arrive through a link that carries campaign parameters (utm_ values and, for a Reddit ad, Reddit's click id), the site keeps that first set in your browser under the name ep_acq for 30 days and adds it to the links that open the Architect app, so an account created there can record which campaign brought it. This is not a cookie, it identifies the campaign and not you, nothing is sent to any third party, and clearing this site's data removes it. What the app does with it is described in the Architect privacy policy.

• Google (Firebase Hosting, Google Fonts, and, with your consent, Google Analytics). Google may process data in the United States. It is certified under the EU-US Data Privacy Framework and offers the European Commission's standard contractual clauses. Google's privacy policy.
• LinkedIn (Insight Tag, with your consent). Data may be processed in the United States under the same framework and clauses. LinkedIn's privacy policy.
• Formspree (form delivery). Based in the United States; your submission is processed there before it reaches us. Formspree's privacy policy.
• Railway, the hosting provider of our own server at architect.eposyne.com, which receives the measurement messages in section 03. Railway stores the resulting counts for us and uses them for nothing else.

We share nothing else with anyone, except where the law requires us to.

• Form submissions: for as long as we are dealing with your request and as long as we may need to refer back to the conversation. Ask and we delete them.
• Our own measurement: the daily totals are kept for 25 months. They contain nothing that identifies you. If the visits-within-one-day step is switched on, its individual steps and that day's random value are deleted once the day has been counted, at most about 25 hours after the visit.
• Google Analytics and LinkedIn: for as long as their cookies remain in your browser and according to their own retention policies, linked in section 05.
• Hosting logs: kept by Google for a short period for security and operations, according to Google's own retention.

Under the GDPR you can ask us to tell you what personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to hand it over in a portable form. Where we rely on your consent, you can withdraw it at any time; where we rely on legitimate interest, you can object and we will stop unless we have a compelling reason to continue.

Write to the privacy contact in section 01 or use the contact form. We answer within one month. If you are not satisfied, you can complain to the Autoriteit Persoonsgegevens or to the data protection authority in your own country.

When the website starts or stops doing something described here, this page changes with it and the date at the top moves. The page is kept in the website's source repository, so earlier versions can always be reproduced.

Questions about this policy: hello@eposyne.com contact form.