PRIVACY NOTICE
Your data,
considered.
A short list of what this website stores, what it doesn’t, and how to get your details deleted.
In short: we store only what you type into the early-access form. There are no cookies for visitors, no analytics and no advertising trackers. Your details are deleted automatically after 90 days, and you can delete them yourself at any time with your private link.
Who is responsible
Epidermal Technologies, Inc. operates this website and decides how the details you submit are used. You can contact us at contact@epidermal.space.
What we collect, and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Name, company, work email, and the design direction you were viewing | To contact you about a possible early-access pilot. | Your consent (GDPR Art. 6(1)(a)). | Up to 90 days, or until you delete it. |
| A record of your consent: the time and the version of this notice | To show that you agreed. | Legitimate interest in evidencing consent (Art. 6(1)(f)). | Stored with, and deleted with, your request. |
| A one-way hash of your private deletion token (never the token itself) | To let you delete your own details. | Your consent and our legitimate interest. | Stored with, and deleted with, your request. |
| Your network address | Held briefly in server memory to limit abuse such as automated form submissions. It is not written to our database. | Legitimate interest in security (Art. 6(1)(f)). | Minutes, then discarded. |
| Standard server logs kept by our hosting provider | Operating and securing the service. | Legitimate interest. | According to the provider’s own policy. |
What we don’t do
- We set no cookies for visitors, and use no analytics, advertising or tracking scripts.
- We don’t sell or share your personal information, and we make no automated decisions about you.
- The concept walkthrough runs entirely in your browser. It never requests your screen, camera or device, and the sample report it offers is created on your device.
- Our team uses one strictly necessary sign-in cookie, only after signing in to a private operator area. It is not set for visitors.
Retention and deletion
Early-access requests are deleted automatically 90 days after you submit them. Expired requests are removed by a scheduled job and whenever a new request is processed.
When you join the list you are shown a private deletion link, once. Opening it lets you erase your details immediately, which is also how you withdraw your consent. The link is carried in the part of the address after the “#”, which browsers don’t send to servers. If you have lost it, you can paste it on the deletion page, or ask us to delete your request.
Who receives your data
Your details are stored in a PostgreSQL database run by our hosting provider, acting on our instructions. We don’t disclose them to anyone else unless the law requires it. The hosting location determines where your data is processed.
Your rights
Under the GDPR and UK GDPR you can ask to access, correct, erase, restrict or receive a copy of your data, object to its use, and withdraw consent at any time without affecting what happened before. You may also complain to your local data protection authority. California residents have rights to know and to delete personal information; we don’t sell or share it.
Security
The site is served over HTTPS with strict security headers. Deletion tokens are stored only as hashes, forms are rate-limited and validated, and administrative access is authenticated. No system is perfectly secure, and we don’t claim any independent security certification.
Children
This site is for business use and isn’t directed at anyone under 16.
Changes
If this notice changes, we’ll update the date above. Material changes that affect how we use details you’ve already given will not be applied without asking you again.