Privacy policy

Effective October 23, 2026. ePayRecon (epayrecon.com) is operated by InfoTilt, Inc. ("we", "us").

The short version

• We never sell, rent or share your data, and we don't use it for advertising.
• Your organization's data is visible only to your organization's members.
• A few service providers process data for us as processors, on our instructions — listed below. None of them may use it for their own purposes.
• Your payment and student data is never used to train AI models.
• You can delete your data at any time.

What we collect

• Your account: your name, email address, a hash of your password (never the password itself), whether two-factor sign-in is on (its secret is stored encrypted), and when you signed in.
• Your organization's data, which you upload or type in: the people you serve and their related payers (names, groups, school IDs, emails, phone numbers), payment records from your bank exports (date, amount, type, payer name, memo, reference, and the last four digits of the account), the original files you upload, your matching rules and your settings.
• Records of activity in your organization (the audit log): who imported, assigned, changed or exported what, with the time and network address.
• Contacts the organization provides — parents and guardians, tenants and co-signers, owners, members, donors, billing contacts: names, email addresses, phone numbers and, optionally, a mailing address. They are stored encrypted and used only to send that organization's notices, statements and receipts (with an unsubscribe link in every email). We never share or sell them, and never send them to our AI provider.
• Messages you send through our contact form.
• Technical data: our server keeps error logs and counts of sign-ins (a keyed hash per sign-in, not your address). We use no analytics, advertising or tracking cookies; the only cookies are the session cookie that keeps you signed in and, if you use it, the one-time cookie for Google sign-in. Your light or dark display choice is kept in your own browser.

Country of a sign-in

To warn an organization's Owners and Admins when someone signs in from a country not seen before, we estimate the country from the sign-in's IP address with an offline database kept on our own server: no service is asked where you are. The country is an estimate (a VPN or a mobile network can place you elsewhere). It is kept in the access log only, with the same retention, and never shared. Owners and Admins can turn the email off. Country data: IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence.

How we use it

Only to provide the service you asked for: storing your organization's data, matching payments, showing reports, securing accounts, sending invitations and password resets, and answering your messages. We don't sell it, rent it, share it for anyone's marketing, or use it to build profiles.

Service providers (processors)

These process data on our instructions, only to run the service, under obligations to keep it confidential. None of them may use it for their own purposes:

• Web hosting — our hosting provider runs the servers and database and sends our emails.
• AI processing — Anthropic, PBC. AI matching is on by default and can be turned off at any time, in Settings or on the upload screen. While it is on, we send only: payer names, memo text with emails removed and digits masked (except amounts, dates and your own account numbers), and the names to choose from. For "Read with AI" on a PDF, the statement text with account and card numbers removed. A scanned statement or a photo of one is first read in your own browser (text recognition); only that text, redacted the same way, is sent — never the image. Anthropic's commercial terms prohibit training its models on this data. When it is off, nothing is sent.
• Google sign-in — optional. If you choose it, Google confirms your name and email address to us.
• Bot protection — if we switch on Cloudflare Turnstile for sign-in forms, Cloudflare checks that a person (not a bot) is signing in.

We don't share data with anyone else except where the law requires it (for example a valid court order), and then only what is required.

Security

Sensitive fields and uploaded files are encrypted at rest (AES-256-GCM), all traffic uses HTTPS, and access is limited by role inside each organization. See Security & privacy for the details.

Keeping and deleting data

• Your organization's data is kept while the organization exists. Original uploaded files are kept until you delete them, or deleted straight after import if you choose that.
• An Owner can delete the organization and all its data from Settings. Access ends immediately, an Owner can undo it for 7 days, and then it is purged from our database and file storage. After that it remains only in the hosting provider's routine backups until they are replaced (see the next point).
• Our hosting provider makes routine automatic server backups that are kept for a limited time (no longer than about a month). Data you delete drops out of those backups as they are replaced. We do not keep any other copies. Sensitive fields and files stay encrypted in those backups too.
• We keep access logs for security (who signed in, viewed, downloaded or was refused, with the IP address, the kind of device and the country estimated from the IP address) for 1 year by default — an Owner can choose 90 days, 1, 3 or 7 years. Owners and Admins of the organization can see its log; we use it only to keep accounts safe.
• To delete your own user account, write to us through the contact page.

The people in your lists

When an organization uploads information about its students, clients or their families, that organization decides what to upload and why, and we process it on the organization's behalf. If you are a parent or client with a question about your data, please contact the organization that uploaded it; we will help them answer you. To stop emails sent through ePayRecon, use the unsubscribe link at the bottom of any of them.

Children

The service is for organizations and their staff, not for children. Student names may appear in an organization's data; we use them only to provide the service to that organization.

Your choices and rights

You can see, correct, export and delete your organization's data in the app. Depending on where you live you may have further rights (to access, correct or delete personal data); contact us and we'll respond.

Changes and contact

If we change this policy we'll update the date above, and tell organization Owners about material changes before they apply. Questions: contact us.