Privacy Policy

Effective date: November 11, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. We collect, use, and disclose Your information as described in this Privacy Policy and, where required by applicable law, only where We have a valid legal basis to do so, including Your consent (where consent is required).

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Buyer means the person who orders and pays for a Gift.
• Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to EPIME ATLAS LLC, 8200 Maplecrest Pl Tampa, FL 33615. Seven Envelopes is a product of EPIME ATLAS LLC, a Florida limited liability company.
• Device means any device that can access the Service, such as a computer, a cell phone or a digital tablet.
• Do Not Track (DNT) is a concept that has been promoted by U.S. regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites.
• Gift means one story, written for one Recipient from the Buyer’s order, delivered as seven envelopes that open one at a time through a Gift Link.
• Gift Link means the private web address through which the Recipient opens the envelopes of a Gift.
• Personal Data (or “Personal Information”) is any information that relates to an identified or identifiable individual. We use “Personal Data” and “Personal Information” interchangeably unless a law uses a specific term.
• Recipient means the person a Gift is for, who opens the Gift Link.
• Service refers to Seven Envelopes, the website through which Gifts are ordered and opened, and the emails it sends.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, or to perform services related to the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the address of a page that was requested).
• User means any individual who accesses or uses the Service.
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Information

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• If You order a Gift: the Recipient’s first name and, if You add them, a pet’s name and Your own first name (required if You ask Us to email the Recipient, because that email is signed with it, or, if You ask Us to keep Your name secret, because the last envelope reveals it)
• If You order a Gift and ask Us to email the Gift Link to the Recipient: the Recipient’s email address
• If You order a Gift: Your choices from Our lists, which describe the Recipient (the pronouns to use for them, their relationship to You, the occasion, the kind of story, a tone, up to three interests, a favorite place, a season and a pet kind)
• If You order a Gift: the schedule (the start date, the Recipient’s time zone, the evening hour and the finale date)
• If You email Us: Your message

Apart from the names and the email addresses, the order form only lets You pick from Our lists. It also asks You to confirm that the Recipient is 18 or older; We check this but do not store it.

Usage Data

Usage Data is collected automatically when using the Service.

Our web server keeps a log of each request. Each entry includes Your Device’s Internet Protocol address (e.g. IP address), the date and time, the page or file requested, the response status and size, the address of the page that linked to it (the referrer), and the user agent Your browser sends (which shows, for example, the browser type and version).

To limit abuse, We also count requests per IP address. These counts are kept in memory only and are never stored.

Information About the Recipient

If You received a Gift, the person who gave it to You (the Buyer) gave Us Your first name and, if they chose to, a pet’s name. If the Buyer asked Us to email You the Gift Link, they also gave Us Your email address. The Buyer also chose from Our lists things that describe You: the pronouns to use for You, Your relationship to the Buyer, the occasion, the kind of story, a tone, up to three interests, a favorite place, a season and a pet kind. We did not get any of this from You. We do not ask You for an account or anything You type: You only tap one of the options shown in each envelope.

For each Gift, We keep:

• the story, with the names from the order filled in (Yours, and the pet’s and the Buyer’s if the Buyer gave them);
• the schedule of the envelopes (the dates, the evening hour and Your time zone);
• each choice You tap (which envelope, which option, and when);
• when the Gift Link was first and last opened;
• how many of Your choices have been reported to the Buyer;
• the Gift’s status, when it was created, and a reference to the Buyer’s order;
• a scrambled (hashed) form of the Gift Link’s key. Our database does not store the key itself.

Each choice You tap can be shared with the person who gave You the Gift. The envelope page tells You this before Your first choice.

You can ask Us to delete the story and Your choices and, if the Buyer gave it, Your email address at any time (see “Delete Your Personal Data” below).

Tracking Technologies and Cookies

Our pages do not set cookies and do not use tracking technologies. They load nothing from other companies’ servers: Our fonts are served from Our own server, and We use no analytics, advertising or tracking pixels.

• Order form draft. While You fill in the order form, Your browser keeps an unsent draft in its session storage, on Your Device only. It is not sent to Us until You submit the form.
• Opening scene. The envelope page shows a short opening scene before the first envelope. Once it has been seen, Your browser notes that in its session storage, on Your Device only, so it does not play again in the same session. The note does not contain the Gift Link’s key and is not sent to Us.
• Calendar reminder. If the Recipient adds an envelope reminder to their calendar, the file is made in their own browser. It is not sent to Us and does not contain the Gift Link’s key.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including to monitor the usage of Our Service.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
• To contact You (Buyers only): To contact You by email regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To manage Your requests: To attend and manage Your requests to Us.
• For business transfers: We may use Your Personal Data to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about Our Service users is among the assets transferred.

We may share Your Personal Data in the following situations:

• With the Buyer: If You are the Recipient, each choice You tap can be shared with the Buyer, as described in “Information About the Recipient” above.
• With Service Providers: We may share Your Personal Data with Service Providers to host the Service, for payment processing, to contact You, and to store email sent to Us, as described in “Detailed Information on the Processing of Your Personal Data” below.
• For business transfers: We may share or transfer Your Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Your consent: We may disclose Your Personal Data for any other purpose with Your consent.

We do not sell Personal Data, and We do not share it for advertising or marketing.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with Our legal obligations (for example, if We are required to retain Your data to comply with applicable laws), resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting data. Unless otherwise stated, the retention periods below are maximum periods (“up to”) and We may delete data sooner when it is no longer needed for the relevant purpose. We apply different retention periods to different categories of Personal Data based on the purpose of processing and legal obligations:

• Customer Support Data
  • Support tickets and correspondence: up to 24 months from the date of ticket closure to resolve follow-up inquiries, track service quality, and defend against potential legal claims. A message that contains a Gift Link is deleted once We have found the Gift.
• Usage Data
  • Web server access logs (IP addresses, access times): about 15 days, for security monitoring and troubleshooting purposes. The logs are rotated daily and the oldest file is deleted.
  • Request counts used to limit abuse: kept in memory only and never stored.

Usage Data is retained in accordance with the retention periods described above, and may be retained longer only where necessary for security, fraud prevention, or legal compliance.

We may retain Personal Data beyond the periods stated above for different reasons:

• Legal obligation: We are required by law to retain specific data (e.g., financial records for tax authorities).
• Legal claims: Data is necessary to establish, exercise, or defend legal claims.
• Your explicit request: You ask Us to retain specific information.
• Technical limitations: Data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete Personal Data according to the following procedures:

• Deletion: Personal Data is removed from Our systems and no longer actively processed.

Our Service Providers keep the data they process under their own retention terms.

Transfer of Your Personal Data

The Service is hosted on servers in the eastern United States. Your information, including Personal Data, is processed there, at the Company’s operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards and, where relevant, supplementary measures. The Company takes reasonable steps to treat Your data securely and in accordance with this Privacy Policy, and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

There are no accounts. Wherever You live, You may contact Us to request access to, correct, or delete the Personal Data We hold about You.

• Buyers can ask Us to delete their order, the Gift and the Recipient’s choices. Deleting a Gift before its last envelope ends the Gift.
• Recipients can ask Us to delete their email address, or the story and their choices, which also ends the Gift. To help Us find the right Gift, tell Us Your first name and the date Your first envelope opened. Please do not send Us the Gift Link (see “Email Sent to Us” below).

Please note that We may ask You to verify Your identity before responding to such requests. If You make a request, a person at the Company handles it. We will try Our best to respond to You as soon as possible, and within 60 days.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

Our database stores only a scrambled (hashed) form of each Gift Link’s key, and the key never appears in Our web server logs.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. They process it to provide their service to Us, under their own terms and Privacy Policies.

Hosting

The Service and its data, including encrypted backups of the database, are stored with Amazon Web Services. Data deleted from the database can remain in these backups until the backups themselves are deleted, which happens automatically 90 days after each backup is made.

• Amazon Web Services Their Privacy Policy can be viewed at: aws.amazon.com/privacy

Emails

We do not send newsletters or marketing emails.

Email Sent to Us

A person reads every email You send Us and decides every request. No request is granted or refused automatically, and We do not promise an immediate reply.

Please do not send Us a Gift Link. If You do, We delete Your email once We have found the Gift. We use a Gift Link You send Us only to find that Gift, and We never pass it to an automated or AI tool.

Email sent to Our contact addresses is stored by Microsoft (Microsoft 365). Their Privacy Statement can be viewed at privacy.microsoft.com/privacystatement.

“Do Not Track” Policy as Required by California Online Privacy Protection Act (CalOPPA)

Our web pages do not track You across other websites, and no other party collects information about Your activity on them.

However, some third-party websites do keep track of Your browsing activities. If You are visiting such websites, You can set Your preferences in Your web browser to inform websites that You do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of Your web browser.

Notice for Nevada Residents

We do not sell Personal Data. If You are a Nevada resident, You may still send a request that We not sell Your covered information to Our designated request address: privacy@epimeatlas.com. We will respond to a verified request within 60 days, or within a further 30 days if We tell You We need more time.

Children’s and Minors’ Privacy

The Service is for adults. Buyers and Recipients must be 18 or older. The Service is not directed to children, and We do not knowingly collect Personal Information from anyone under the age of 13.

If You are a parent or guardian and You believe Your child has provided Us with Personal Information, or has been sent a Gift, please contact Us. If We become aware that We have collected Personal Information from anyone under the age of 13, We will take steps to remove that information from Our servers as soon as reasonably possible.

If We learn that a Buyer or Recipient is under 18, We will end the Gift and delete it as soon as reasonably possible.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the “Effective date” at the top of this Privacy Policy.

We will let You know through a prominent notice on Our Service, prior to the change becoming effective. Material changes will not apply to Personal Data We already hold unless You consent.

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If You have any questions about this Privacy Policy, You can contact Us:

• By email: privacy@epimeatlas.com
• By phone: +1 813-419-7466