Privacy Policy

Epiqon Series – Mobile Application and Website (epiqon-series.com)

Effective Date: July 27, 2026                                                                  Last Updated: July 27, 2026

1. Introduction

This Privacy Policy explains how Nobaka Tech L.L.C-FZ, with its registered office at Meydan Grandstand, SHARED DESK 6th floor, Nad Al Sheba, Dubai, United Arab Emirates  ("Epiqon," "we," "us," or "our"), collects, uses, shares, and protects personal data when you use the Epiqon Series mobile application (the "App"), the website epiqon-series.com (the "Website"), and related services (collectively, the "Service"). We act as the data controller for the personal data described in this Policy.

This Policy applies to the Epiqon Series product only. The Epiqon Legacy platform (hosted on LearnWorlds) is governed by its own separate privacy policy available at epiqon.co/privacy.

2. Personal Data We Collect

2.1 Data You Provide

• Account data: email address, display name, password (stored in hashed form), and account preferences.

• Communications: the content of messages you send to our support team and related contact details.

• Age confirmation: your confirmation that you meet the minimum age requirement (18+). We do not collect identity documents unless required to verify age in specific cases permitted or required by law.

2.2 Data Collected Automatically

• Usage and viewing data: titles and episodes viewed, watch time and progress, interactions with App features, search queries within the App, and in-app events.

• Device and technical data: device model, operating system and version, app version, language and region settings, IP address, approximate location derived from IP (country/region level), unique app instance identifiers, and crash and performance diagnostics.

• Advertising and measurement identifiers: where you have given consent through the applicable platform mechanism (including Apple App Tracking Transparency), platform advertising identifiers (IDFA/GAID) used for attribution and marketing measurement.

2.3 Subscription and Purchase Data

Payments are processed by Apple and Google through their in-app purchase systems. We do not receive or store your full payment card details. We receive transaction and entitlement data (subscription tier, purchase and renewal dates, price tier, transaction identifiers, and refund status) from the platforms via our subscription management provider, RevenueCat.

3. Purposes and Legal Bases of Processing

Where the EU or UK General Data Protection Regulation applies, we process personal data on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object to such processing as described in Section 9. We do not use personal data to make decisions producing legal or similarly significant effects by solely automated means.

4. Service Providers and Recipients

We share personal data with service providers acting on our behalf under data processing agreements, and with independent controllers where indicated:

• RevenueCat, Inc. – subscription management and entitlement validation (processor).

• Apple Inc. and Google LLC – app distribution and in-app payment processing (independent controllers for the payment transaction; see their privacy policies).

• Analytics providers – product analytics and diagnostics (processors).

• Marketing and attribution partners – campaign measurement (processor or joint controller depending on configuration; consent-based).

• Hosting and content delivery providers – cloud infrastructure and video delivery (processors).

• Professional advisers and authorities – where necessary to comply with legal obligations, respond to lawful requests, or establish, exercise, or defend legal claims.

We may also share personal data in connection with a corporate transaction (merger, acquisition, or asset sale), subject to appropriate safeguards and notice where required. We do not sell personal data for money.

5. International Data Transfers

We operate internationally, and personal data may be transferred to and processed in countries outside your country of residence, including outside the EEA and the United Kingdom. Where we transfer personal data from the EEA or UK to countries without an adequacy decision, we rely on appropriate safeguards, principally the European Commission’s Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement, as applicable), together with supplementary measures where needed. You may request further information about these safeguards using the contact details in Section 13.

6. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

• Account data – for the life of your account and up to 12 months after deletion, unless longer retention is required by law;

• Subscription and transaction records – for the period required by applicable tax, accounting, and consumer protection law;

• Usage and analytics data – in identifiable form for up to 24 months, after which it is deleted or aggregated/anonymized;

• Support communications – up to 24 months after resolution of your request.

When retention periods expire, data is deleted or irreversibly anonymized.

7. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, environment segregation, and vendor due diligence. No system is completely secure; if a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent authority and, where required, affected users in accordance with applicable law.

8. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that personal data of a person under 18 has been collected, we will delete it and terminate the associated account. If you believe a minor is using the Service, please contact us.

9. Your Rights

9.1 EEA and UK Residents

Subject to the conditions of the GDPR / UK GDPR, you have the right to: access your personal data; rectify inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests (including profiling) and to direct marketing at any time; and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with a supervisory authority, in particular in your Member State of habitual residence, or with the UK Information Commissioner’s Office.

9.2 California and Other U.S. State Residents

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have the right to know/access, correct, and delete personal information, the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising, the right to limit use of sensitive personal information (which we do not use beyond permitted purposes), and the right not to receive discriminatory treatment for exercising your rights. We honor opt-out preference signals (such as Global Privacy Control) on the Website. To the extent our use of advertising SDKs constitutes "sharing" under the CCPA/CPRA, you may opt out via [in-app privacy settings / "Do Not Share My Personal Information" link on the Website] or by declining tracking in the ATT prompt.

9.3 Other Jurisdictions

Residents of other jurisdictions (including Canada, Australia, and New Zealand) may have similar rights under local law, including rights of access and correction under PIPEDA, the Australian Privacy Act 1988, and the New Zealand Privacy Act 2020. We will honor valid requests in accordance with the law applicable to you.

9.4 Exercising Your Rights

You may exercise your rights via in-app settings (where available) or by contacting us at support@epiqon.co . We may need to verify your identity before acting on a request. We respond within the timeframes required by applicable law (generally one month under the GDPR, extendable where permitted; 45 days under the CCPA). You may use an authorized agent where permitted by law.

10. Tracking Technologies

Details of the cookies, SDKs, and similar technologies used on the Website and in the App, and the available consent and opt-out mechanisms (including cookie consent banners and the Apple App Tracking Transparency framework), are set out in our separate Cookie and Tracking Technologies Policy at epiqon-series.com/cookies.

11. Migration from Epiqon Legacy

If you choose to migrate your Epiqon Legacy account to Epiqon Series, we will transfer your account profile and, where technically feasible and disclosed to you during migration, your content access history from the Legacy platform to the Service. Migration is initiated only at your request, and you will be asked to review and accept the Epiqon Series Terms of Service and this Privacy Policy before migration completes. Your data on the Legacy platform will thereafter be handled according to the Legacy privacy policy and applicable retention rules.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect and, where required by law, seek your consent. The "Last Updated" date at the top of this Policy indicates the latest revision.

13. Contact Us

Data controller: Nobaka Tech L.L.C-FZ, Meydan Grandstand, SHARED DESK 6th floor, Nad Al Sheba, Dubai, United Arab Emirates.

Privacy inquiries: support@epiqon.co