Privacy Policy

This Privacy Policy describes how EpiphanyMade ("EpiphanyMade," "we," "us") collects, uses, and discloses information in connection with agent-cold-email (the "Service"), including this marketing site and the live platform API/MCP/CLI surface.

1. Who this covers

This policy covers (a) visitors to this site, including activation-request signups, and (b) customers and their end users of the live Service. It does not cover the third parties your own cold-email recipients interact with independently.

2. What we collect

• Activation-request signup: the email address you submit, and the timestamp/source of submission.
• Account signup: brand name, contact email, and — for paid tiers — billing information processed by Stripe (we do not store full payment card numbers ourselves).
• Tenant configuration: the physical postal address and sender identity you provide for use in your own outbound email footers (required for CAN-SPAM compliance), your persona/offer text, and your lead lists, to the extent you provide them to the Service to run campaigns.
• Operational data: API usage, tool calls, and platform logs needed to operate, secure, meter, and bill the Service.
• Site analytics: we do not load third-party analytics or ad trackers on this site as of this writing; if that changes, this policy will be updated first.

3. How we use it

• To operate the Service: provisioning, sequencing, reply handling, billing, and support.
• To send you activation and product emails if you go live or become a customer — only about this Service (product updates, activation notices, account/billing notices), always CAN-SPAM compliant, always with a working unsubscribe, and never sold or used for unrelated marketing.
• To monitor for abuse and enforce the Acceptable Use Policy — see "Monitoring" below.
• We do not sell your personal information.

4. Your data as a customer — controller vs. processor

If you are a customer, you (not EpiphanyMade) are the sender of record for outreach you run through the Service — see the customer-is-sender designation in the Terms of Service. For lead lists and recipient data you upload or otherwise provide to the Service, you are the data controller and EpiphanyMade acts solely as your data processor / service provider: we process that data only to deliver the outreach you configure (provisioning, sequencing, suppression, reply handling), on your instructions, and not for our own purposes. We do not use your lead or recipient data for our own marketing and do not sell it. The full Data Processing Addendum (DPA) — roles, subprocessors, security, and what happens to your data on termination — is at coldrig.dev/dpa and applies automatically to every account; a signed/negotiated version for enterprise agreements is available on request at privacy@coldrig.dev.

5. Monitoring consent

By using the Service, you consent to automated monitoring of (a) account metadata — send volume, bounce rate, spam-complaint rate, and warmup/placement signals — and (b) where necessary for guardrail enforcement (e.g., subject-line honesty, the third-party-brand lookalike reject, or investigating a specific abuse report), automated scanning of outbound message content. This monitoring is for the purposes of guardrail enforcement (suppression, per-mailbox caps, auto-pause on complaint thresholds) and abuse prevention protecting the shared vendor infrastructure underlying the Service. It is operational and automated; EpiphanyMade does not manually review your message content except where necessary to investigate a specific abuse report or legal obligation. See the corresponding consent clause in the Terms of Service.

6. Data sharing

We share data with the vendors and processors necessary to run the Service: Stripe (billing), our domain registrar and mailbox/warmup vendor(s) (to provision and operate your infrastructure), and Cloudflare (hosting/infrastructure). We do not sell personal information to third parties, and we do not share your lead lists or recipient data outside of what's required to deliver the Service you configured, apart from the shared bounce list described below.

Shared bounce list (crowdfunding accounts only). If you choose the crowdfunding vertical at signup, your account joins a shared bounce list with other crowdfunding accounts. When a real (non-sandbox) email sent from one of these accounts hard-bounces or draws a spam complaint, we store a one-way hash (SHA-256) of that email address in the list, together with whether it was a bounce or a complaint and the time. The address itself, your account, your campaign and the message are not stored in the list. When a campaign on another crowdfunding account is due to email an address that is on the list, we skip that one send, so one organization does not email an address that another already found undeliverable or that complained. A customer whose send is skipped sees that the send was skipped and whether the address bounced or complained, but never which organization added it. Unsubscribes and soft bounces are never added, a match is not copied into your own suppression list, and entries have no expiry date today. The list affects crowdfunding accounts only: accounts without that vertical neither add to it nor check it. Sandbox and demo accounts never add to it, but a crowdfunding sandbox or demo account does check it. If the list cannot be reached, sending continues using your own suppression list.

7. Data retention

We retain account and operational data for as long as your account is active plus a reasonable period for legal, tax, and dispute-handling purposes. Activation-request emails are retained until you unsubscribe or are converted to a customer or removed. You may request deletion — see Contact below.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information, and to opt out of certain processing. EU/UK/GDPR-scoped processing is currently out of scope for this Service (US-first at this stage — see the Terms).

California residents (CCPA/CPRA). If you are a California resident, you have the right to: (a) know what personal information we have collected about you and why; (b) delete personal information we hold about you, subject to certain exceptions; (c) correct inaccurate personal information; (d) opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined by the CCPA/CPRA, so there is nothing to opt out of, but you may still submit a request to confirm this; (e) limit the use of sensitive personal information — we do not use sensitive personal information for purposes beyond what's necessary to provide the Service; and (f) not be discriminated against for exercising any of these rights. To exercise a right, email privacy@coldrig.dev with your request and the account/email you're inquiring about; we will verify your identity using the information on file and respond within the time required by law. You may also designate an authorized agent to submit a request on your behalf.

9. Security

We use industry-standard safeguards for data in transit and at rest. No system is perfectly secure; see SECURITY.md in the repository for how to report a vulnerability.

10. Children

The Service is a business tool not directed at children, and we do not knowingly collect personal information from anyone under 16.

11. Changes to this policy

We'll update the "Last updated" date above and, for material changes affecting activation-request or customer emails, notify affected users by email before the change takes effect.

12. Contact

Questions or requests: privacy@coldrig.dev. EpiphanyMade is the operating entity for this Service. The CAN-SPAM sender-identification / notice address for EpiphanyMade's own marketing and activation emails is:

EpiphanyMade, 209 Crest Hill Road, Toms River, NJ 08755, US