What we collect, and what we do not.

Who we are

This site is run by Epsilon Labs AI Solutions (SMC-PVT) Ltd., registered by the Securities and Exchange Commission of Pakistan under section 16 of the Companies Act, 2017 (XIX of 2017), Corporate Unique Identification No. 0290150 (“Epsilon Labs”, “we”, “us”). We decide how the personal data described here is used, which makes us its controller. For anything on this page, write to er@epsilon-labs.co.

What we collect

When you browse the site. Nothing that we see. There is no analytics, no advertising or tracking script, no social-media embed, and nothing is stored on your device. Fonts and every other file are served from this domain, so your browser never contacts a third party while you read. Our host, Vercel, keeps short-lived technical logs of requests (IP address, browser type, the page asked for, time) to run and protect the service; we do not use them to identify or profile visitors.

When you email us. Your name, email address, anything in your message and its attachments, and whatever you share during the conversation that follows. The site has no forms: the “Start a project” page only prepares an email in your own mail app, and nothing is sent until you send it.

When we work together. Contact and billing details, and the project material you give us — which, for security assessments, can include firmware, captures and staging credentials. How that material is handled is set out in the engagement agreement and the NDA we sign before you send anything.

Why we use it, and on what basis

To reply to you, scope and quote work, deliver it, invoice for it, and keep the records the law requires. Under UK and EU data-protection law the bases are: taking steps at your request before a contract, performing that contract, our legitimate interest in running and protecting the business and answering enquiries, and legal obligations such as tax records. We do not sell personal data, use it for advertising, or add you to a mailing list.

Who else handles it

Only providers we need to run the business, each processing data for us under their own terms:

• Zoho hosts our email.
• Vercel hosts this website.
• Anthropic — we use AI software, including Claude, to help sort incoming enquiries and draft replies. A person reads and approves every reply before it is sent, and nothing you send is used to make decisions about you automatically.
• Banks and payment providers, when you pay an invoice.

We may also disclose data where the law requires it. These providers, and we, are outside the UK and EU, so your data is transferred internationally; we rely on the providers’ standard contractual safeguards for those transfers.

How long we keep it

Enquiries that do not become a project: up to 24 months, then deleted. Client records and invoices: as long as tax and accounting law requires, normally six years. Project material from security work: deleted 30 days after the final report unless you ask us to keep it for a retest.

Your rights

You can ask for a copy of the data we hold about you, have it corrected or deleted, object to or restrict how we use it, or receive it in a portable form. Email us and we will answer within one month. If you are in the UK you can complain to the Information Commissioner’s Office (ico.org.uk); in the EU, to your national data-protection authority. We would rather you told us first.

Children

This is a business-to-business site. It is not aimed at, and we do not knowingly collect data from, anyone under 16.

Changes

If what we do with data changes, this page changes first, with a new date at the top.

See also the terms of use and the cookie policy.