[loading]
Who controls what, which providers the application uses, and which data-subject tools are actually implemented. Contractual and deployment facts that the repository cannot prove are identified explicitly.
For contact data — the records you import — you are the controller and Epafi is the processor. We act only on your documented instructions: the features you use and the settings you choose are the instructions.
For account and billing data — your name, email, and billing identifiers — Epafi is the controller, and our Privacy Policy governs that processing directly.
A DPA is a contractual artifact, not an application feature. No executed DPA or approved template is versioned in this project, so this page does not claim that one is already in effect.
The deployment configuration uses Hetzner for the backend and data services and Vercel for the web applications. Configured enrichment sends only the selected identifiers to the selected provider. Actual processing regions and transfer mechanisms require contractual verification before launch.
| Processor | Role | Transfer mechanism | Location |
|---|---|---|---|
| Hetzner | Backend and data-service hosting | To be confirmed contractually | Deployment-configured |
| Vercel | Web application hosting | To be confirmed contractually | Global |
| MillionVerifier | Email verification | To be confirmed contractually | Provider-operated |
| NinjaPear | Contact and company enrichment | To be confirmed contractually | Provider-operated |
| Clerk | Authentication | To be confirmed contractually | Provider-operated |
| Polar | Billing | To be confirmed contractually | Provider-operated |
The repository does not prove an executed transfer mechanism. This must be resolved as a legal and deployment prerequisite rather than inferred from the provider name.
As controller, you own the lawful basis for the contacts you import. In practice:
We build the tools; the compliance posture of your list is yours. The current product does not contain a dedicated rights-request case-management workflow.
How Epafi helps you answer your contacts when they exercise rights:
| Right | How you honor it in Epafi |
|---|---|
| Access (Art. 15) | Filter and export contacts as CSV, JSON, or vCard |
| Rectification (Art. 16) | Direct contact editing with a contact-updated activity entry |
| Erasure (Art. 17) | Permanent contact deletion removes the primary record and queues search-index removal; an export generated before the deletion is a point-in-time snapshot and is not rewritten — it expires on its own seven-day schedule. Backup copies follow separate retention rules |
| Restriction (Art. 18) | No dedicated record-freeze workflow is implemented |
| Objection (Art. 21) | No dedicated suppression-list workflow is implemented |
| Portability (Art. 20) | Bulk CSV, JSON, and vCard export plus REST API access |
Data protection contact: dpo@epafi.app. For DPA execution, breach inquiries, or records of processing, this is the published contact address.
Epafi is operated by Entro314 Labs Single Member P.C., established in Greece; our lead supervisory authority is the Hellenic Data Protection Authority (dpa.gr). Data subjects may also complain to their own local authority.
Questions about this document? legal@epafi.app — we answer legal mail within two business days.