Epicurus One Epicurus One
Features Pricing Blog
Log In Get Started
Last Updated: July 28, 2026

Privacy Policy

At Epicurus One, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at epicurus.one and our AI-powered SEO content platform. The Service is operated by Leonova Technologies Ltd, a company registered in England and Wales under company number 17038635, which is the data controller for the personal data described here. Please read this policy carefully. By using Epicurus One, you agree to the collection and use of information in accordance with this policy.

Who Is Responsible for Your Data

Leonova Technologies Ltd is the data controller. It decides how and why your personal data is processed, and it is the party you exercise your rights against. Every reference in this policy to "we," "us," or "our" means Leonova Technologies Ltd.

  • Registered name: Leonova Technologies Ltd
  • Registered in: England and Wales, company number 17038635
  • VAT registration number: GB 513 372 515
  • Registered office: One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom
  • Data protection contact: hello@epicurus.one

The Epicurus One platform itself is owned by COGNIVO FZ-LLC, a Dubai Free Zone company established in the United Arab Emirates under trade licence 0000004077695, at IDS Building, Office 02, Sheikh Khalifa Bin Zayed St, Opp. Burjuman Center, Al Karama, Dubai. Cognivo FZ-LLC builds the platform and licenses it to Leonova Technologies Ltd to operate, and it also holds some of the vendor accounts used to run it, such as the AI and search-data providers listed in Section 3. Cognivo FZ-LLC owns the software and acts only as a processor on Leonova's instructions; it does not decide how your personal data is used and does not process it for its own purposes.

You can reach us about anything in this policy at hello@epicurus.one. If you are in the United Kingdom or the European Union and you are not satisfied with how we have handled a request, you have the right to complain to your national data protection authority.

Independent by Design. Private by Principle.

We are privately funded and operate free from government influence. We do not sell, share, or hand over user data to governments, third parties, or private organisations.

Your information is protected by strong security controls and used only to deliver and improve our services.

We believe privacy is not a feature. It is a fundamental right.

1. Information We Collect

Account Information

When you create an account, we collect:

  • Email address — used for authentication, communication, and account recovery. Email verification is required for all new accounts.
  • Password — securely hashed using bcrypt with 12 salt rounds. We never store your password in plain text and cannot recover it.

Information We Receive From Your Website Platform

If you started using Epicurus One by installing it as an application inside your website builder, e-commerce platform, or content management system, we receive some of your information from that platform rather than from you directly, because the platform has already verified who you are. When you activate the application, we may receive:

  • The account owner's name and email address — used to create your Epicurus One account and to contact you about the Service.
  • Your website address and business name — used to identify the site the application is working on.
  • The plan you purchased and its status — used to apply the correct article allowance and features.
  • Access credentials issued by the platform — used solely to publish articles and images to your website on your instruction, and stored encrypted.

In this case your account may be created automatically so that the application works the moment you open it, and your email address may initially be an internal placeholder rather than a real address until you provide one. Our lawful basis for this processing is the performance of our contract with you. The platform's own privacy policy governs what it does with your data; this policy governs what we do with it.

Website & Business Data

To provide our SEO services, we collect information about the websites you add to our platform:

  • Domain URL — your website address used to identify your site within our system.
  • Site content — we crawl your publicly accessible website pages to analyze content for SEO optimization purposes.
  • Business profile information — niche, target audience, brand tone, and products/services. This helps our AI generate relevant, on-brand content.

Generated Content

As part of our service, we generate and store:

  • AI-generated articles and blog posts
  • Keyword research data and content strategies
  • AI-generated images for your articles

Payment Information

For subscriptions purchased directly at epicurus.one, all payment processing is handled entirely by Stripe. We never receive, store, or have access to your full credit card number, debit card number, or bank account details. Stripe collects and processes your payment information directly in accordance with their Privacy Policy. We only store your subscription status, plan tier, and Stripe customer/subscription identifiers.

If you obtained Epicurus One through a website platform, marketplace, or authorised reseller, that party collects payment under its own privacy policy and we receive no payment details from it at all — only the identifier of your plan and whether it is active.

Usage Data

We automatically collect certain information when you interact with our platform:

  • Session data (server-side sessions)
  • Login timestamps
  • Subscription status and billing cycle

Google Search Console Data

If you choose to connect your Google Search Console account via OAuth2, we access analytics data such as search queries, click-through rates, impressions, and average positions for your connected properties. This data is used solely to provide SEO performance insights and improve content strategy within your dashboard.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Service delivery — to crawl your website, research keywords, generate AI-powered SEO content, create images, and publish articles to the website platform you connect.
  • Account management — to create, maintain, and secure your account, process subscriptions, and handle authentication.
  • Communication — to send transactional emails such as account verification, password resets, subscription confirmations, and important service updates.
  • Analytics & optimization — to provide you with SEO performance dashboards, keyword rankings, and content strategy recommendations based on your Google Search Console data.
  • Platform improvement — to understand how our service is used and improve our AI models, user experience, and overall product quality.
  • Security — to detect and prevent fraud, abuse, and unauthorized access to our platform.

3. Third-Party Services

We work with trusted third-party services to operate our platform. Each service receives only the minimum data necessary to perform its function:

AI & Content Generation

  • OpenAI — we send your website content, business profile, and keyword data to OpenAI's API to generate articles and images, analyze content, and build content strategies. OpenAI processes this data in accordance with their Privacy Policy.
  • xAI (Grok) — used as an automatic fallback when OpenAI is unavailable, so that article generation and site analysis do not fail during an outage. When the fallback is used, it receives the same website content, business profile, and keyword data described above, and processes it in accordance with the xAI Privacy Policy.

SEO Data Providers

  • DataForSEO — we query keyword volume, search difficulty, and competitive data for the keywords relevant to your website.
  • SerpAPI — we analyze Google search results and discover relevant YouTube videos for content enrichment.

Google APIs

  • Google Search Console API — when you connect your account via OAuth2, we read your search performance data to provide analytics and insights.
  • Google Indexing API — we submit your published articles to Google for faster indexing.
  • YouTube Data API — we search for relevant YouTube videos to embed within generated articles.

Payments

  • Stripe — handles all payment processing, subscription management, billing, and invoicing. Your financial data is processed directly by Stripe and never touches our servers.

Email & CRM

  • Brevo (formerly Sendinblue) — we use Brevo for transactional emails (account verification, password resets, subscription updates) and contact management. Contact attributes such as your email, subscription status, plan tier, and usage metrics are synced with Brevo's CRM for communication purposes.
  • Our SMTP email provider — used as a fallback delivery route when Brevo is unavailable, so that verification and password-reset emails still reach you. It receives the recipient address and the message content.

Publishing to Your Website

When you connect a website and enable publishing, we send the generated articles, images, and their metadata to the platform that hosts your site, on your instruction. Depending on which platform you connect, that is WordPress, Shopify, Wix, Webflow, Framer, Squarespace, a webhook or automation endpoint you configure (including Zapier, n8n, Make, or Lovable), or the website builder or e-commerce platform on which you installed Epicurus One. Each receives only the content being published and the credentials needed to publish it.

  • Credentials you provide — where a platform requires a username, application password, API key, or access token, we store it encrypted at rest and never expose it in API responses or logs.
  • Credentials issued by a platform — where you installed Epicurus One as an application, the platform issues us a token scoped to your site instead, and we store it the same way.

Hosting

  • Railway — provides the cloud infrastructure, PostgreSQL database, and file storage on which the Service runs. All of the data described in this policy is stored there.

4. Cookies & Tracking

We use a minimal set of cookies that are strictly necessary for the operation and security of our platform:

  • Session cookie (express-session) — an httpOnly cookie that maintains your authenticated session. It contains only a session identifier, not your personal information, and expires when you log out or after the session timeout.
  • CSRF cookie (_csrf) — a security cookie used to protect against cross-site request forgery attacks using the double-submit cookie pattern.
  • Language preference — your chosen interface language is stored locally in your browser so the site loads in that language next time. It is not sent to us as a cookie.

Both cookies above are strictly necessary and set only after you sign in. When you use Epicurus One inside your website platform's editor, the same two cookies are set with SameSite=None; Secure; Partitioned, because a browser will not send a same-site cookie to an application running inside another site's page. The Partitioned attribute means the cookies are isolated to that context and cannot be used to follow you anywhere else.

We do not use any advertising cookies, tracking pixels, or third-party analytics cookies. We do not track you across other websites, and we do not serve targeted advertisements.

5. Data Storage & Security

We take the security of your data seriously and implement industry-standard measures to protect it:

  • Database — all account and website data is stored in a PostgreSQL database hosted on Railway, a secure cloud infrastructure provider.
  • Sessions — session data is stored server-side in the same PostgreSQL database, not in the browser, and is pruned automatically once expired.
  • Images — AI-generated images are stored on Railway's persistent volume storage.
  • Passwords — hashed with bcrypt using 12 salt rounds. We cannot reverse or view your password.
  • Platform credentials — the credentials and access tokens for any website platform you connect are stored encrypted and never exposed in API responses. All API responses pass through error sanitization to prevent leaking of internal details.
  • Two-factor authentication — available on direct accounts and recommended. Sessions are listed in your settings with the device they were created on, and you can revoke any of them individually.
  • Transport security — all data in transit is encrypted via HTTPS/TLS.

While we implement robust security practices, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your personal information.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

  • Account data — retained until you delete your account.
  • Generated content — articles, keywords, and strategies are retained for the lifetime of your account to maintain your content history and SEO strategy.
  • Payment records — subscription history and billing references are retained as required for accounting and legal purposes, even after account deletion.
  • Session data — automatically purged after session expiry.
  • Removed application installations — if you installed Epicurus One inside a website platform and then removed it, we retain your account and content for 60 days so that reinstalling restores your data, after which it is deleted. This retention period is required by the platforms we distribute through.

When you delete your account, we will remove your personal data from our active systems. Some information may be retained in backups for a limited period consistent with our backup retention schedule.

7. Your Rights

Our lawful bases for processing are: performance of our contract with you (delivering the Service, creating and running your account, publishing on your instruction, billing); legitimate interests (securing the platform, preventing fraud and abuse, and improving the product); legal obligation (retaining accounting and billing records); and consent where you choose to connect an optional integration such as Google Search Console, which you can withdraw at any time by disconnecting it.

As a UK-established controller we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and with the EU GDPR where it applies to you. Those laws give you the rights set out below. We do not make any decision about you that is based solely on automated processing and has a legal or similarly significant effect on you.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access — you can access your account information, generated content, and connected website data directly through your Epicurus One dashboard at any time.
  • Correction — you can update your email, password, business profile, and website information through your account settings.
  • Deletion — the "Danger Zone" section in your account settings disables your account and cancels any active subscription, and your data is kept so that you can reactivate later. To have your personal data permanently erased instead, email us at hello@epicurus.one and we will complete the erasure within one month.
  • Data portability — your generated articles are published to the website platform you connect, so you hold them on your own site independently of us. You can also request a machine-readable copy of the data we hold about you.
  • Withdrawal of consent — you can disconnect third-party integrations (such as Google Search Console) at any time through your settings.
  • Objection — you may object to certain data processing activities by contacting us.
  • Restriction — you may ask us to pause processing of your data while a request or dispute is being resolved.
  • Complaint — you may complain to your national data protection authority. In the United Kingdom this is the Information Commissioner's Office.

To exercise any of these rights, you can use the self-service options in your account settings or contact us at hello@epicurus.one. We respond within one month, as required by the UK and EU GDPR.

If you obtained Epicurus One through a website platform, marketplace, or authorised reseller, some self-service controls (including account deletion and password changes) are managed by that platform instead of by us. You can still exercise every right above by contacting us directly at hello@epicurus.one, and we will act on your request regardless of how you signed up.

8. Data Sharing & Selling

We do not sell, rent, or trade your personal information to third parties — ever.

We share data only with the categories of service provider described in Section 3, and only to the extent necessary for them to perform their function for us. These providers are contractually obligated to protect your data and may not use it for their own purposes. We keep the list in Section 3 current; if we add a provider that receives personal data, we update this policy.

In addition, where you obtained Epicurus One through a website platform, marketplace, or authorised reseller, we exchange the limited information needed to keep your subscription working with that party — for example, confirming your installation is active, which plan applies, and whether it has been cancelled. We do not send them your generated content, your keyword research, or your Search Console data.

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Epicurus One, our users, or the public.

9. Children's Privacy

Epicurus One is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at hello@epicurus.one.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We are established in the United Kingdom, our software licensor and processor Cognivo FZ-LLC is established in the United Arab Emirates, and the third-party providers listed in Section 3 operate principally in the United States and the European Union. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal data out of the UK or the European Economic Area, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses together with appropriate technical safeguards. You can request details of the safeguard used for a specific transfer at hello@epicurus.one.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Your continued use of Epicurus One after any changes to this Privacy Policy constitutes your acceptance of those changes.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Data controller: Leonova Technologies Ltd, registered in England and Wales, company number 17038635, One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom
  • Platform and intellectual property owner: COGNIVO FZ-LLC, a Dubai Free Zone company, trade licence 0000004077695, IDS Building, Office 02, Sheikh Khalifa Bin Zayed St, Opp. Burjuman Center, Al Karama, Dubai, United Arab Emirates
  • Email: hello@epicurus.one
  • Website: epicurus.one

We will respond to your inquiry as soon as reasonably possible.

Epicurus One Epicurus One

AI SEO, AEO & GEO Engine

Features Pricing Blog Dashboard Affiliate Privacy Policy Terms & Conditions Contact
© 2026 Epicurus One. All rights reserved.