Privacy Policy

Version 1.6 — last updated: November 3, 2026

Wersja polska (Polish version)

1. Data Controller

The controller of your personal data is Damian Mazurek, operating under the business name Damian Mazurek IoTdev, Tax ID (NIP): 7352656720, REGON: 120916513, address: Handlowka 58, 37-123 Handlowka, Poland (hereinafter: “Controller” or “we”).

Data protection contact: privacy@eliteperformancecollective.com

2. Definitions

• Platform — the EPC Portal web application available at portal.eliteperformancecollective.com.
• User — a natural person who holds an account on the Platform and is at least 18 years old.
• Health Data — data relating to the User’s physical or mental health, including data from WHOOP, Oura Ring, Garmin and Ultrahuman Ring devices, constituting a special category of personal data under Art. 9 of the GDPR.
• AI Assistant (Stefan) — an automated system based on large language models (LLM) that supports Users on the Platform.
• Processor — an entity that processes personal data on behalf of the Controller under a data processing agreement (Art. 28 GDPR).
• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

3. What Data We Collect

3.1. Identity and Contact Data

During registration and use of the Platform we collect:

• name, email address, password (stored in hashed form),
• display name, avatar (profile picture), biography,
• company name, position, location, industry, years of experience,
• LinkedIn profile URL and website URL.

Required: Name and email address are required to create an account (contractual requirement). Other profile data is optional.

3.2. Onboarding Data (My Mission)

During onboarding we collect answers about your mission, goals, challenges, allies, transformation vision, and legacy. This data is used to personalize your experience on the Platform, including through the AI Assistant.

Required: Optional. You may skip answers during onboarding.

3.3. Health Data (Special Category — Art. 9 GDPR)

If you voluntarily connect a wearable device (WHOOP, Oura Ring, Garmin, or Ultrahuman Ring), we collect the following data:

• Sleep: duration, sleep stages (REM, deep, light), sleep efficiency, respiratory rate, sleep consistency.
• Recovery: recovery score, heart rate variability (HRV), resting heart rate, blood oxygen saturation (SpO2), skin temperature.
• Physical Activity: workout type, duration, strain, average and maximum heart rate, calories burned.
• Physiological Cycle: daily strain, energy expenditure.
• Additional metrics (device-dependent): Body Battery (Garmin), stress level (Garmin), intensity minutes (Garmin), metabolic score (Ultrahuman).

How the data reaches the Platform: the device is connected through Terra API (a wearable data aggregator, see Section 5.3). You authorize access to your account with the device manufacturer (OAuth 2.0) in the Terra window; Terra retrieves the data from the manufacturer and delivers it to our server in a unified format. The Platform does not store your password or access tokens for the manufacturer account.

Required: Entirely voluntary. The Platform works fully without connecting a device. Connection requires your explicit, separate consent for processing health data (Art. 9(2)(a) GDPR).

Withdrawal of consent: You may withdraw consent at any time by disconnecting the device in Settings → Wearable Integrations — the connection in Terra is then deauthorized and Terra stops delivering data to us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3.4. Data Processed by the AI Assistant (Stefan)

The AI Assistant has access to the following data for response personalization:

• your profile (name, company, position, industry, experience),
• onboarding answers (My Mission),
• active habits and streaks,
• health data from the connected wearable device (WHOOP, Oura, Garmin or Ultrahuman), if connected,
• conversation history with the AI Assistant,
• workbook answers,
• information about your group (Trio),
• documents you uploaded to the AI Assistant.

This data is sent to Google Gemini Developer API to generate responses. We permit processing only under a confirmed paid plan and project settings excluding voluntary sharing of content for training generalized models. The applicable data-use basis is theGemini API Paid Services terms. Excluding training does not imply zero retention, for example for abuse monitoring.

iOS dictation (including Companion): after you grant speech recognition permission, microphone audio may be sent to Apple and the transcript to your Inbox. This feature does not automatically receive Google Calendar data. Processing and available settings are described in Apple's dictation privacy information.

Deep Research: after your confirmation, the topic and plan steps are used for queries to public services DuckDuckGo, Semantic Scholar, OpenAlex, Crossref and PubMed. Do not include private data or calendar content; we do not automatically anonymize these inputs. Private memory and internal EPC search results are not used to generate public queries.

3.5. Social Data

• posts, comments, likes, saved content,
• private messages (DMs) and group conversations,
• group (Trio) membership,
• poll votes,
• uploaded images, GIFs, and attachments,
• leaderboard position and XP points (visible to other Users).

3.6. Educational Data

• course and module progress,
• quiz answers and results,
• workbook answers,
• unlocked achievements and experience level (XP).

3.7. Technical and Log Data

• IP address (for security and rate limiting purposes),
• login date and time,
• browser and device information (user-agent),
• the version of the EPC OS, EPC OS Companion or EPC mobile application you use (request header; section 3.10).

3.8. Payment Data

Payments are processed by an external provider (EasyCart). We do not store payment card data. We only receive: subscription ID, payment status, subscription plan, and billing period end date.

3.9. Google Calendar Data (optional integration)

The Google Calendar integration is optional and starts only after the User grants OAuth 2.0 authorisation. It is used by the AI Assistant on the Platform and by the EPC OS desktop application (its day-plan view is referred to below as the Mission panel). We request three scopes: https://www.googleapis.com/auth/calendar.events to read, create, update and delete events in your calendars and calendars shared with write access; https://www.googleapis.com/auth/calendar.calendarlist to read the calendar list, select calendars for work blocks, check the connection and set colours for EPC category calendars; https://www.googleapis.com/auth/calendar.app.created to create EPC category calendars on your request.

• What we read: the list of your calendars (names, identifiers, colours and access level, including calendars shared with you by other people) and events within a selected date range — title, start and end time, description, location, status, colour, link to the event, creation and last-modification dates, and the technical identifiers of the event and of the series it belongs to. When checking the connection status we read the current calendar list to obtain the name of your primary calendar and its identifier (your Google account e-mail address) to show them in settings; this identifier appears in the cached calendar list, in your calendar filter in the Mission panel and as the calendar identifier saved with your work blocks; it may also appear in a saved conversation with the AI Assistant as part of an event identifier (section 3.4). Reads happen when the Mission panel is displayed, including its roughly 30-second refresh for the current day, or when you talk to the AI Assistant.
• What we write to your calendar: events matching the work blocks you create in the Mission panel with synchronisation enabled, and their deletions; events you ask the AI Assistant to create, change or delete in chat (a single creation or change is executed immediately on your instruction, bulk changes and deletions require an additional confirmation click); on your request, also a set of seven EPC calendars (one per block category, such as goal-directed actions, active recovery or sleep) together with their colours. Blocks go to the EPC calendar of their category or, if it does not exist, to your primary calendar; some categories (training, EPC, free time) always go to the primary calendar. Events created by the Platform are tagged with a private property indicating their origin. We also write tasks from a linked work block as a checklist in the event description and read changes to that checklist from Google. A write may follow a task change in the Mission panel or the next display of your day plan. We preserve the rest of the description. We do not write the checklist to an event with other attendees, an event you do not organise, a locked event or a read-only calendar. Anyone who can view event details in a shared calendar may see the task list. If a deleted event has guests, Google notifies them. Checklist synchronisation runs while you use the Mission panel and sends no e-mail notification for description changes.
• What we store on our side: the access and refresh tokens (the integration cannot work without them), a cached list of your calendars (valid for up to 6 hours, refreshed on next use), and the identifiers of calendars you exclude from the Mission panel. When you turn a calendar event into a work block (for example by marking it in the Mission panel or adding tasks to it), we store a copy of its title, description (up to 10,000 characters), start and end time, creation date, and the technical identifiers of the event, its series and its calendar; the copy is refreshed each time the Mission panel is displayed. Deleting such a block in the Mission panel hides it from the day timeline; the copy remains in our database until account deletion. Work blocks, including those originating from your calendar (planning time, category calendar, colour), are used to automatically verify habits and award XP points (section 7.2). Events you ask the AI Assistant about may appear in the saved conversation and in the AI memory (see sections 3.4, 7.1 and 11).
• Legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw it at any time by disconnecting the calendar in settings. We immediately block integration use and request token revocation at Google. If Google is unavailable, we show a pending result and retry, retaining only an encrypted credential needed to finish revocation. We delete it when the operation completes. Reconnection is blocked until then. You can also remove access through yourGoogle Account connections. Disconnecting does not delete original Google events or copies retained in EPC. Account deletion starts a durable cleanup job; an incomplete result remains pending for retry. After successful connection, we store the data-use disclosure version and acceptance time.

Google Limited Use disclosure. The Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google Calendar data is not used for advertising, not sold, not transferred to data brokers and not used to train artificial intelligence models. We pass this data to our language model provider (Google Gemini) only within the AI Assistant features: so that it can answer your questions about your schedule, prepare plan proposals and update your AI memory (sections 3.4 and 7.1); the provider processes it on our instructions and does not use it to train its models. Human access to this data occurs only with your explicit consent (for example while handling a support request), where necessary for security purposes, or where required by law.

3.10. EPC OS (macOS, Windows) and EPC OS Companion (iPhone) applications

EPC OS and EPC OS Companion are applications of the Platform: you sign in with the same account, and the Inbox, work blocks, weekly Mission and habits are the same data you see in the portal. The applications connect only to the Platform's servers over HTTPS (section 9) and contain no advertising or analytics tools.

• What we store on the device: session tokens in the system's protected store (keychain), a copy of your plan and Inbox for offline use, and a queue of tasks added offline, sent once the connection returns. Companion additionally stores a snapshot of the day's plan for its widgets and lock screen activities in the application's protected container, accessible only to the app and its extensions. Signing out removes this data from the device.
• Microphone and speech recognition (Companion): only while you dictate an Inbox item, and only after you grant permission in the system. Recognition is performed by iOS (Apple Speech), on the device or on Apple's servers under Apple's terms depending on the system settings; the Platform receives only the recognised text, never the recording. The microphone in EPC OS is used for voice conversations with the AI Assistant (section 3.4).
• Notifications (Companion): local only, scheduled on the device (block start, time's up). Companion does not register for push notifications.
• Permissions Companion does not request: system calendar, photos, location, contacts.
• Updates: on launch Companion checks Expo's servers (section 5.2) for an update of its code; the request carries the application identifier, runtime version and platform, no account data. EPC OS checks GitHub's servers for updates the same way.

3.11. Subscribed calendars (ICS link, optional integration)

In EPC OS you can add up to five calendars by their ICS link (also called iCal), for example a company Outlook calendar that cannot be connected through Google. We show events from such a calendar in the Mission panel in EPC OS and in EPC OS Companion next to your Google events, and the AI Assistant takes them into account when planning your day. An ICS link works like a password: anyone who knows it can read that calendar.

• What we store: the ICS link encrypted with a key kept outside the database (we never show it in full, only the server name and the last few characters), a hash of the link to detect duplicates, the name and timeline category you choose, the status of the last fetch, and a copy of events from 14 days back to 90 days ahead: title, start and end time, description (up to 10,000 characters), location, online meeting link, creation and modification dates and technical identifiers. We refresh the copy at most every 15 minutes while you view your day plan, and on your request.
• What we do not do: events from subscribed calendars are read only. We write nothing to the source calendar, send none of your data to its server beyond the plain request for the calendar file, and do not turn these events into work blocks. Events you ask the AI Assistant about, or that it considers when planning your day, are shared with the language model provider as described in sections 3.4 and 5.1. These events may contain data of other people (e.g. participant names in a meeting title) entered by the organizer in the source calendar.
• Legal basis and deletion: consent (Art. 6(1)(a) GDPR), given by adding the calendar. You can withdraw it at any time by removing the subscription in the EPC OS settings: we then delete the encrypted link and the copy of events. Deleting your account removes all subscriptions. If someone may have learned your link, invalidate it in the source calendar (e.g. by publishing the Outlook calendar again).

4. Purposes and Legal Bases for Processing

5. Data Recipients — Processors

Your data may be shared with the following categories of recipients. We have entered into a data processing agreement (DPA) with each processor in accordance with Art. 28 GDPR. Your data is not sold or shared with third parties for marketing purposes.

5.1. AI Service Providers (Processor)

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — provider of Google Gemini language models used by the AI Assistant (Stefan). Data sent to Google includes the content of conversations, your user context (profile, habits, health data if connected), uploaded documents and, if you connect Google Calendar, the names of your calendars (with every conversation) and the events you ask the Assistant about (section 3.9) and, if you add subscribed calendars, their names and events (section 3.11). Google processes data solely on our instructions and does not use it to train its own AI models.

5.2. Cloud Service Providers (Processors)

• Google Cloud Platform (application hosting — Cloud Run, region europe-west1; Firebase Storage — AI memory storage, region US).
• MongoDB, Inc. — MongoDB Atlas database (EU region, Frankfurt).
• Expo (650 Industries, Inc.) — delivery of code updates for EPC OS Companion and the EPC mobile application (EAS Update, USA); receives the application identifier, runtime version and platform, no account data.
• GitHub, Inc. — distribution of EPC OS application updates (download of the update file, no account data).

5.3. Wearable Device Integrations

Terra Enabling Developers, Inc. (1111B S Governors Ave #6127, Dover, DE 19904, USA; Terra API) — data processor. Terra operates the wearable connections on our behalf: after your authorization it retrieves health data from the device manufacturer, normalizes it and delivers it to our server (webhooks secured with an HMAC-SHA256 signature, plus retrieval on our request), and it stores the authorization tokens for your account with the manufacturer. Terra processes the data solely on our instructions, for the purpose of providing the Platform service. Disconnecting the device in the Platform deauthorizes the connection in Terra.

The device manufacturers are independent data controllers for the data collected on the device. The data reaches us through Terra based on the OAuth 2.0 authorization you grant with the manufacturer:

• WHOOP, Inc. (Boston, MA, USA) — data from the WHOOP device.
• Oura Health Oy (Oulu, Finland, EU) — data from the Oura Ring device.
• Garmin Ltd. (Schaffhausen, Switzerland / Olathe, KS, USA) — data from Garmin devices (Garmin Connect).
• Ultrahuman Healthcare Pvt. Ltd. (Bengaluru, India) — data from the Ultrahuman Ring AIR device.

As independent controllers, the above providers process data on their devices according to their own privacy policies: WHOOP Privacy Policy, Oura Privacy Policy, Garmin Connect Privacy Policy, Ultrahuman Privacy Policy.

5.4. Payment Service Providers (Processor)

• EasyCart — payment processor. We only share data necessary for transaction processing. EasyCart is an independent controller of payment card data.

6. International Data Transfers

Due to our use of Google (Gemini API, Firebase), Terra (wearable data aggregator), WHOOP, Garmin, Ultrahuman, and Expo and GitHub (application updates, section 5.2) services, your data may be transferred to third countries (United States, India). These transfers are safeguarded by:

• Standard Contractual Clauses (SCCs) approved by European Commission Implementing Decision 2021/914,
• additional technical measures: encryption in transit (TLS) and at rest,
• additional organizational measures: DPAs with providers, minimization of data transferred.

7. Automated Decision-Making and Profiling

7.1. AI Assistant Profiling

The AI Assistant (Stefan) analyzes your data (profile, habits, health data, conversation history) to create a personalized conversation context and “memory”. This processing does not lead to decisions producing legal effects or significantly affecting you within the meaning of Art. 22(1) GDPR.

7.2. Automatic Habit Logging

Based on data from the connected wearable device (delivered by Terra), the system automatically verifies habits (e.g., sleep ≥ 7h, workout ≥ 30 min) and awards XP points. You can disable this by disconnecting the device in Settings → Wearable Integrations. Similarly, planning habits (e.g. a deep work block, completing the end-of-day ritual) are verified based on work blocks, including those originating from Google Calendar (section 3.9).

7.3. Proactive Messages (Stefan Ally)

With your consent, the system automatically generates and sends you private messages based on analysis of your data. This constitutes profiling under Art. 4(4) GDPR, based on your consent (Art. 6(1)(a) GDPR).

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — obtain information about and a copy of your processed data.
• Right to rectification (Art. 16) — correct inaccurate data in Settings → Edit profile.
• Right to erasure (Art. 17) — request data deletion (“right to be forgotten”). We delete data within 30 days, subject to the obligation to retain billing data for 5 years.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — receive your data in a structured format (JSON) via “Export my data” in Settings.
• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling.
• Right to withdraw consent (Art. 7(3)) — at any time for:
  • health data processing — Settings → Wearable Integrations → Disconnect,
  • proactive AI messages — Settings → Stefan Ally → disable toggle,
  • Google Calendar integration — Settings → Integrations → Disconnect.
• Right to lodge a complaint — with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, contact us: privacy@eliteperformancecollective.com. We will respond within 30 days.

9. Data Security

We apply the following security measures (Art. 32 GDPR):

• encryption in transit (HTTPS/TLS),
• password hashing (bcrypt),
• httpOnly cookie-based sessions (BFF pattern),
• HMAC-SHA256 signature verification for wearable data webhooks (Terra),
• rate limiting on authentication endpoints,
• authorization tokens for device manufacturer accounts are held by Terra; the Platform stores only a connection identifier and never exposes it in API responses,
• role-based access control (RBAC).

9.1. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the supervisory authority within 72 hours (Art. 33 GDPR). If the breach is likely to result in a high risk, we will also notify you without undue delay (Art. 34 GDPR).

10. Cookies and localStorage

• epc-session — session cookie (httpOnly, secure) required for authentication. Expires at end of session.

We do not use advertising, tracking, or analytics cookies.

11. Data Retention

• Account data: until account deletion + 30 days.
• Health data: until consent withdrawal (device disconnection) + 30 days. The connection in Terra is deauthorized immediately upon disconnection.
• Google Calendar integration: access and refresh tokens, the cached calendar list and the list of excluded calendars — until the integration is disconnected or the account is deleted; on disconnection normal use is blocked; an encrypted retry credential is retained until revocation at Google completes and is then deleted. Copies of events turned into work blocks (title, description, start and end time, identifiers) remain in our database until account deletion; deleting a block in the Mission panel hides it from the day timeline.
• Subscribed calendars (ICS link): the encrypted link, name, category and a copy of events from 14 days back to 90 days ahead (refreshed at most every 15 minutes) until the subscription or the account is deleted.
• AI conversations: until manually deleted by the User or account deletion.
• Posts and comments: until manually deleted or account deletion.
• Billing data: 5 years from end of fiscal year (accounting regulations).
• Security logs (IP): maximum 12 months.

12. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy. We will inform you of significant changes via email or Platform notification with 14 days’ notice.

13. Contact

• Email: privacy@eliteperformancecollective.com
• Address: Damian Mazurek IoTdev, Handlowka 58, 37-123 Handlowka, Poland
• Tax ID (NIP): 7352656720, REGON: 120916513