Privacy Policy

Who we are

EPTA is a media and distribution studio. We make launch films and run the distribution behind them for founders, venture funds and the companies they back. This policy covers epta.co and the enquiries, applications and project work that reach us through it. In this policy, EPTA, we and us mean the studio operating under the EPTA name.

If you want to know what we hold about you, or want it deleted, write to us at privacy@epta.co and we will answer.

What we collect

What you send us. When you book a call, reply to an email, send a brief, apply for a role or share files with us, we receive what is in that message: your name, your email address, the company you work for, what you are launching and when, and any documents, links or footage you attach. On a call we may take notes so the team that makes the film is working from the same information.

What our hosting records. Like any website, the servers that serve this site keep short-lived technical logs: the IP address a request came from, the browser and device it identified itself as, the page requested and the time. These logs exist so the site can be operated and defended against abuse, not to build a profile of you.

What the page counter records. We use Vercel's web analytics, which counts page views and where they came from without setting a cookie, without storing an identifier on your device, and without following you to any other site. It derives a daily, non-reversible hash from your request to tell one visitor from another for that day, and keeps no profile beyond it. We use it to know which pages are read, nothing more.

What the analytics record. We also use PostHog, a product analytics service. It stores a random identifier in a cookie and in your browser's local storage so that it can recognise the same browser across page views and return visits, and it records the pages you view, the page you came from, your browser, device and approximate location derived from your IP address, how quickly pages load, and the links and buttons you use. It may also record a session, meaning a replay of what the page showed and where you scrolled and clicked, and it builds heat maps of where visitors click across many sessions. Text you type into a field is masked in recordings. We do not use any of this to identify you by name, and we do not join it to what you send us. The data is processed by PostHog, Inc. in the United States under its own privacy policy. We use it to understand which pages are read, where readers lose interest and how the site performs. If you would rather not be counted, a content blocker that blocks PostHog stops it entirely, and you can write to us to have the events tied to your identifier deleted.

What third parties see when media loads. Some launch films on this site are played from the platform they were published on rather than from our own servers. When you press play on one of those, that platform receives your IP address and device information directly, under its own privacy policy, exactly as it would if you watched the post on the platform itself. The same applies when you follow a link out to X, LinkedIn or a client's site. The foot of each page holds Cal.com's calendar, loaded when you scroll near it, so Cal.com receives your IP address and device information at that point, and the name, email and details you enter if you book, under its own privacy policy.

What we do not do

• No cookies or storage beyond the analytics identifier described above: nothing for advertising, nothing that follows you to another site.
• No tag managers, and no third party scripts other than the two analytics services named above and Cal.com's calendar.
• No advertising or retargeting pixels, and no audience lists built from visitors.
• No selling or renting of personal data, in any circumstances.
• No automated decision making or profiling that has any effect on you.

Why we process it

To answer you and to do the work. If you are a client or a prospective client, we process what you send us to quote, plan, produce and distribute the work, and to invoice it. If you applied for a role, we process your application to assess it and to come back to you either way.

Where the law asks for a basis, ours are these: performing a contract with you or taking steps at your request before one exists; our legitimate interest in running and defending a studio, including operating this site and keeping records of work we have delivered; your consent where you have given it, for example to be credited or quoted; our legitimate interest in understanding how this site is read and used, or your consent where the law requires it for analytics of this kind; and compliance with tax and accounting obligations.

Who we share it with

We share personal data with the suppliers that make the studio run, and only with what they need to do their part:

• Hosting and content delivery for this site, and cloud storage for the films and assets a project needs.
• The two analytics services named above, Vercel and PostHog, which receive the technical and usage data described under what we collect.
• Email and calendar providers, which is where enquiries, applications and scheduling live.
• A scheduling tool for booking calls, which receives the name, email and time you give it.
• Payment, accounting and legal advisers where a project requires them.
• Production partners and freelancers on a specific project, under confidentiality, and only where the work needs it.

We also publish our own work. A case study on this site may name a client, quote what they said with their agreement, and show the public counts a post carried. We do not publish figures a client has asked us to keep private, and we do not publish anything from an unannounced launch before it is announced.

Where it goes

We work across Italy, Pakistan and the United States, and our suppliers operate internationally, so personal data may be processed outside the country you are in, including outside the European Economic Area and the United Kingdom. Where that happens we rely on the transfer mechanisms our suppliers put in place, such as standard contractual clauses.

How long we keep it

• Enquiries that do not become projects: up to two years, then deleted.
• Project records, contracts and invoices: as long as the law requires us to keep them for tax and accounting, normally between six and ten years depending on the country.
• Project files and footage: for the life of the engagement and a reasonable archive period afterwards, so a client can come back for a recut. On request we delete our copies where no legal obligation requires us to keep them.
• Applications: twelve months, unless you ask us to keep you on file for longer or to delete it sooner.
• Server logs: a short operational period, normally measured in weeks.
• Analytics events and heat maps: for as long as we use PostHog to understand the site. Session recordings: a limited period set by PostHog, after which they are deleted automatically unless we have saved one.

Your rights

Depending on where you live, you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing we base on our legitimate interests, and ask for it in a portable form. You can withdraw a consent you gave us at any time, which does not affect anything done before you withdrew it.

If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data protection authority. If you are a California resident, we do not sell or share personal information as those terms are defined there, and you can exercise your rights of access and deletion by writing to us. Exercising any of this costs you nothing and we will not treat you differently for it.

Write to privacy@epta.co and we will answer within thirty days. We may ask you to confirm who you are before we hand over data.

Security

Access to client material is limited to the people working on it. Files live in access-controlled cloud storage, accounts use two-factor authentication where the provider offers it, and material is shared by link with the people who need it rather than by broadcast. No system is perfect, and if a breach affects you we will tell you and the relevant authority as the law requires.

Children

This site and this studio are for people doing business. We do not direct either at children and we do not knowingly collect data from anyone under sixteen. If you believe we have, write to us and we will delete it.

Changes

If we change how this site or the studio handles personal data, we change this page and move the date at the top. If a change is significant and we hold your email address because you are a client, we will tell you directly rather than leaving you to notice.

Contact

Questions, requests and complaints about privacy go to privacy@epta.co. Everything else goes to the address on the contact page.