Privacy Policy

This Policy applies to personal information collected through the Epic Fill website, API, dashboard, and browser extension. It does not apply to third-party sites you visit while using the extension; those sites have their own policies.

We may collect:

Page access is user-gesture-only. Epic Fill does not silently read every site you visit. When you start a scan or fill session, the extension inspects the active tab’s form structure (labels, types, values) to propose fills from your Super Profile.

Application snapshots retained by the Service are stored in redacted form. Sensitive field types (including SSN and criminal-history classes) are never auto-filled and are not kept as autofill targets.

When you use voice dictation or ask for page guidance, the extension may capture a screenshot of the visible tab you are working in to power that specific request. Screenshots are used for the request and are not stored as part of your profile.

We use personal information to:

• Operate the Service and propose reviewable form fills
• Parse resumes, maintain Super Profile provenance, and power the application ledger
• Run metered AI drafting within hard budget caps when you use AI features
• Send approval-gated outbound messages only after you approve them in Epic Fill Inbox
• Process subscriptions and usage metering (including Stripe)
• Secure the Service, prevent abuse, and comply with law

We do not sell personal information for advertising purposes.

Epic Fill is designed to refuse autofill for SSN, criminal-history, and related legal-disclosure field types. AI drafting also refuses those targets. You remain responsible for any sensitive values you type manually into a third-party form.

We do not treat Epic Fill as a vault for storing Social Security numbers as reusable autofill data. Redaction and never-store policies apply to sensitive ledger and snapshot paths in the product.

We may share information with service providers that help us operate the Service:

• LLM providers when you use AI drafting or parsing features (content necessary to fulfill the request)
• Stripe for payment processing
• SMTP email and Twilio SMS providers when outbound messaging is configured and you approve a send
• Hosting and infrastructure providers that process data on our behalf
• Legal authorities when required by law

We retain information for as long as needed to operate the Service, comply with law, resolve disputes, and enforce agreements.

You may delete your account from Settings. Account deletion permanently removes associated personal data on a best-effort basis within 30 days, subject to legal retention requirements. Anonymized aggregate statistics may be retained.

Data-subject access and deletion workflows are also supported through our privacy operations / DSAR processes where applicable.

Depending on your jurisdiction, you may have rights to:

• Access and receive a copy of personal information
• Correct inaccurate information
• Delete personal information (subject to legal limits)
• Object to or restrict certain processing
• Data portability in a structured, commonly used format
• Opt out of sale/share of personal information where those concepts apply (we do not sell personal information for ads)

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States where protections may differ. Where required, we rely on recognized transfer safeguards for cross-border processing.

The use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can take appropriate action.

We implement administrative and technical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, hashed passwords, and access controls. No method of transmission or storage is perfectly secure.

We may update this Privacy Policy periodically. Updated versions will be posted on this page with a revised “Last updated” date. Continued use of the Service after changes constitutes acceptance where permitted by law.

For privacy inquiries, data-subject requests, or questions about this Policy, contact:

privacy@epicfill.com

Epic Fill is operated by Collective Epic LLC. Privacy contact: privacy@epicfill.com.