EPISTEMIST Privacy Policy – Rest of World Edition

Last updated: October 2026

Note for clients residing in the EU/EEA/Switzerland/Turkey: This policy applies to clients whose country of habitual residence is outside the European Union, the European Economic Area, Switzerland, and Turkey (including the United States, Canada, and the United Kingdom). If you reside in the EU, EEA, Switzerland, or Turkey, please refer to our main Privacy Policy instead: Privacy Policy.

EPISTEMIST (“we”, “us”, “our”) operates the website epistemist.de and the associated services under the brands PRAXIS (psychological consultation) and EPISTEMIST LABS (mobile B2C apps for evidence-based, behavioral microtraining), currently covering the BRAKED App. We take privacy, confidentiality, and data protection exceptionally seriously. This page explains what personal data we process, how we protect it, and what rights you have under the GDPR.

This is the Rest-of-World edition of our Privacy Policy, provided to clients whose country of habitual residence is outside the European Union, the European Economic Area, Switzerland, and Turkey. As explained in Section 2 below, it gives you the same protections as our main Privacy Policy for the EU/EEA/Switzerland/Turkey. This document is issued in English, which is its authoritative language; no German-language version of this specific document exists or governs.

We purposely keep data processing minimal. No personal data is stored on the website itself. No tracking, no analytics, no advertising cookies.

---

1. Controller

Onur Yavuz
c/o MDC Management #4163
Welserstraße 3
87463 Dietmannsried
Germany
E-Mail: support[at]epistemist.de

2. Scope of This Policy for Clients Outside the EU/EEA/Switzerland/Turkey

EPISTEMIST is established in Germany. Under Art. 3(1) GDPR, the GDPR’s obligations attach to the location of the controller, not the location of the data subject. This means that if you are a client located outside the EU/EEA/Switzerland/Turkey, your personal data — once it reaches us — is processed under the same GDPR-based rules, safeguards, and rights described throughout this Policy as apply to clients located within these regions. You are not afforded a lesser standard of protection because of where you live.

3. Cross-Border Data Flows — Data You Send to Us

When you submit personal data to us from outside the EU/EEA/Switzerland/Turkey — for example by email or through a consultation request — this is a transfer of data into the European Union, not a transfer of data out of it. The restrictions on international data transfers under Chapter V GDPR (and mechanisms such as Standard Contractual Clauses) govern the export of personal data from the EEA to third countries; they do not apply to data flowing into the EEA. No additional transfer mechanism is required or applicable for this inbound flow. This is separate from the outbound transfers described in Section 6 (Online payments via Stripe) below and in the BRAKED app privacy policy at the end of this document, which remain governed by their own transfer safeguards as described there.

4. What data we process when you visit the website

4.1 No tracking, no analytics, no advertising technologies

This website uses only technically essential cookies required for basic operation, such as session cookies. We do not:

• track behavior,
• use Google Analytics or similar tools,
• embed marketing pixels,
• share data with third parties for advertising purposes.

A trilingual cookie notice is displayed via Real Cookie Banner, and the consent history is stored only for legal compliance.

4.2 Essential cookies

Essential cookies (Art. 6(1)(f) GDPR, §25(2) TDDDG) are required to operate the website. They cannot be deactivated. Details appear in the cookie banner under “Essential”.

4.3 Server log files

The hosting provider automatically stores minimal technical logs to maintain security and stability. This may include:

• IP address (short-term storage only),
• date and time of access,
• requested page,
• browser type and version,
• operating system.

These logs are deleted automatically by the hosting provider within the standard retention periods defined in their ISO-certified infrastructure.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

5. Contact via e-mail

If you contact us via email (for PRAXIS, EPISTEMIST LABS Apps or general inquiries), we process the data you voluntarily provide. This typically includes:

• email address,
• content of your message,
• optional pseudonym.

Inquiry form data. If you use the inquiry form on our website, the entries you make (year of birth, gender, country, language, plan, scheduling preferences, and an optional title) are sent to us by email. They are not stored on the website.

Annual subscription ID. If you claim a subscriber benefit, you submit your annual subscription ID through the contact form. We verify its status and period via RevenueCat.

We explicitly support anonymity and pseudonyms.

You may contact PRAXIS using a pseudonym or preferred name — you are not required to provide your legal name.

Strict confidentiality

All consultation inquiries and client-related emails are handled with strict confidentiality based on professional practice standards.

90-day deletion policy

Emails, calendar entries, and session-related digital traces are deleted 90 days after the last interaction, unless legal obligations require longer retention.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contract), Art. 6(1)(f) GDPR (legitimate interest in secure communication), Art. 9(2)(a) GDPR (explicit consent to the processing of special category personal data in the context of a PRAXIS consultation request).

Where you contact EPISTEMIST for a PRAXIS psychological consultation, the information you share may constitute special category data under Art. 9 GDPR — in particular, information relating to your mental health or personal circumstances. The legal basis for processing such data is your explicit consent pursuant to Art. 9(2)(a) GDPR, provided via the consultation form. You may withdraw this consent at any time with effect for the future (support@epistemist.de). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

6. Online payments via Stripe

For paid services, we send an individual Stripe payment link by email on request. The payment is handled entirely and exclusively on Stripe’s own pages; Stripe is not integrated into our website. You enter your payment data directly with Stripe only. We ourselves do not collect, store, or transmit any complete card data — neither on our website nor on our servers. After the payment is completed, we receive from Stripe only a payment confirmation (your email address, the amount, the transaction ID, and where applicable details of the payment method used, such as the card brand and the last four digits of the card), which we process to deliver the agreed service. If you fill in optional fields (e.g. a reference), we also receive the information you enter there.

Stripe processes the data you enter as an independent controller under its own privacy policy, including any transfers to third countries (including the USA). Stripe’s privacy policy applies: https://stripe.com/privacy

Legal basis for processing the payment confirmation transmitted to us: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligations, in particular accounting and tax retention duties), and Art. 6(1)(f) GDPR (legitimate interest in documenting payments and defending legal claims).

7. Data storage on the website

We intentionally do not store:

• user accounts,
• uploaded images,
• comment data,
• client messages,
• analytics profiles.

The website is technically configured so that no personal data is written into the WordPress database except what is required for essential operation (cookie consent logs via Real Cookie Banner).

8. Embedded third-party content

Currently, this website uses no embedded third-party media (e.g. YouTube, Vimeo, Maps). If we integrate such content in the future, it will be protected by a content blocker until you provide explicit consent.

9. Your rights under the GDPR

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent at any time (Art. 7(3) GDPR)
• Right to complain: Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). If you are not habitually resident, employed, or affected by the alleged infringement within an EU/EEA member state, this right remains fully available to you and is anchored to our place of establishment: the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), https://www.baden-wuerttemberg.datenschutz.de.

To exercise your rights, contact: support[at]epistemist.de

10. Data security

We implement strict measures to protect your data:

• SSL/TLS encryption for all communication,
• secure email infrastructure with SSL-encrypted transmission,
• no persistent storage of email or consultation data on the website,
• restricted pseudonymous handling where possible,
• minimization of all digital footprints.

11. Data retention

• Emails, consultation records, and calendar entries: deleted 90 days after the last interaction
• Stripe payment confirmations: retained for as long as German law requires
• Cookie consent logs: retained per legal requirement (up to 6 years)
• Server logs: retained according to host’s security policy (short-term)

12. US State Privacy Laws

Certain US state privacy statutes — such as the California Consumer Privacy Act / California Privacy Rights Act and comparable laws in other states — apply only to businesses that meet defined thresholds of revenue, personal data volume, or data-sale activity. EPISTEMIST is a solo consultation practice and does not currently meet these thresholds under any applicable state law. These statutes therefore do not currently apply to our processing activities. We will revisit this assessment if our scale of operations changes.

13. Changes to this policy

This policy may be updated to comply with new legal requirements or service adjustments.

14. Contact for data protection

Onur Yavuz
support[at]epistemist.de
EPISTEMIST / EPISTEMIST LABS / PRAXIS
Germany

---

EPISTEMIST LABS APPS

BRAKED — Privacy Policy (EN)

Last updated: 2026-10-18
Controller: Onur Yavuz, Germany
Contact: support@epistemist.de

Minimum age: BRAKED is intended exclusively for persons aged 18 and older.

1) Summary (plain English)

BRAKED works without user accounts. All user training data stays on your device (for example: selected templates, timer sessions/history, notes/labels, and unlocked guidance items). The only external processing occurs for subscriptions: purchases are handled by Apple In-App Purchase, and subscription status/entitlements are verified via RevenueCat as an entitlement management service provider. No user training content is sent to any third-party AI service.

Data processed for subscriptions and entitlements. If you purchase a subscription, the transaction is processed by Apple App Store. To validate subscription status and unlock premium features, the app may communicate with RevenueCat. This may involve processing purchase/receipt metadata and technical identifiers required for entitlement verification. We do not transmit your training profile, timer content, notes, or guidance interactions to RevenueCat or any AI provider.

2) Data we store on your device (local-only)

The App stores data locally (on-device) to provide functionality, such as:

• selected behavior templates, preferences, language (currently EN-only),
• timer sessions/history and basic statistics,
• locally stored Guidance items (and read/archive status),
• export/import data files you create.

You control this data and can export/import it at any time from within the App.

3) Data processed for subscriptions and entitlements

If you purchase a subscription, the transaction is processed by Apple App Store.

To validate subscription status and enable premium features, the App may communicate with RevenueCat (as an entitlement management service provider). This may involve processing purchase/receipt data and technical identifiers necessary to verify entitlements. RevenueCat processes such data as a processor under a data processing agreement (DPA) pursuant to Art. 28 GDPR and solely on our instructions.

Transfer to the USA: This may involve processing on servers in the United States. The transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) incorporated into the DPA. RevenueCat’s privacy notice: https://www.revenuecat.com/privacy

4) Analytics, tracking, crash reports

We do not actively collect in-app telemetry or tracking analytics by default. Apple and/or the operating system may generate diagnostic or crash information depending on your device settings and platform policies.

We may introduce optional, privacy-preserving analytics in a future update; if we do, we will update this policy and implement it transparently.

5) Notifications

If you enable notifications, the App uses device notification services to schedule reminders. Notification delivery can be affected by OS settings and restrictions.

6) Legal bases (GDPR)

Where GDPR applies, processing is based on:

• Performance of a contract (Art. 6(1)(b)) to provide app functionality and subscription features,
• Legitimate interests (Art. 6(1)(f)) for basic security and fraud prevention where applicable,
• Consent (Art. 6(1)(a)) if optional analytics is introduced later.

7) Data sharing

We do not sell personal data. Data sharing is limited to:

• Apple (for purchases/subscriptions),
• RevenueCat (for entitlement verification and subscription status), as needed.

8) Retention

On-device data remains stored until you delete the App or clear its data. Subscription-related data retention is governed by Apple and RevenueCat policies.

9) Your rights

Depending on your jurisdiction (including GDPR), you may have rights to access, deletion, restriction, objection, and portability. Because most data is local-only, the most effective way to exercise deletion is to delete the App or clear its local data.

Because we currently do not maintain user accounts, we may not be able to identify you beyond what you provide.

Right to complain: Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

For questions, contact: support@epistemist.de