Effective 6 August 2026 · version 1.0 pre-launch

ESP Privacy Notice

This notice explains how Enterprise Performance Management Systems Pte. Ltd. ("EPMS", "we", "us") processes personal data when you use ESP — Extrasensory Prompt. EPMS is the data controller. ESP is not yet open for public gameplay.

Contact

Privacy questions and verified requests: privacy@epms.com.

The controller's registered contact address, public DPO designation/contact, any required EEA or UK representative, final processor locations, transfer safeguards, complete rights/account-deletion workflow, and external legal approval must be added before affected players are admitted.

Data we process

• Account and identity: internal user ID, stable OAuth/OIDC issuer and subject, optional provider-supplied email, account status, and authentication timestamps. We validate access tokens but do not persist them or player passwords.
• Choices and consent: your preferred gameplay language and whether it was clearly detected on first use, selected by you, or explicitly changed; Terms and Privacy acknowledgement times; optional research choice; and an optional self-selected country or region badge and visibility choice. ESP stores the normalized catalog language code, not your opening ChatGPT message, for language resolution. We do not use your IP address, location, locale, or badge to infer it.
• Gameplay: matchmaking activity, contest membership, deadlines, submissions, misses, forfeits, reconnects, results, rankings, streaks, and authoritative timestamps.
• Answer text: the original answer, its Unicode-normalized form, character count, digest, and submission time. Do not include personal, sensitive, confidential, or unlawful information in an answer.
• Scoring and service operation: facet results, scores, confidence, model configuration, attempts, errors, token usage, cost, latency, provider identifiers, safe request/trace identifiers, and masked IP prefixes in selected security audit events.
• Sharing: an opaque share identifier, team result, optional badge snapshot, and revocation time. Public shares exclude answers, the source prompt, email, location, and individual internal scores.

Why we use it and our intended legal bases

• To create your account, operate matchmaking, accept and score an answer, provide results, retain game history, and support reconnection: performance of the ESP service contract.
• To secure ESP, prevent abuse, enforce limits, investigate failures, maintain safe audits, and defend legal claims: our legitimate interests in operating a secure and reliable service, balanced against player rights.
• To use eligible data for separately governed research: your optional consent. Research is off by default, is not required to play, and can be withdrawn.
• To meet an applicable statutory duty: compliance with a legal obligation, where one actually applies.

Acknowledging this notice is not consent to optional research.

Automated scoring

OpenAI evaluates each answer in a separate, tool-free request against a frozen rubric. EPMS validates those outputs and Rails calculates the pair's team score. The score affects game results and leaderboards; it does not determine employment, credit, insurance, legal status, or access to an essential service. Fixed rules and human-administered support remain available for disputes.

Recipients and international processing

Data may be processed by EPMS and contracted providers supporting identity, hosting, database, OpenAI scoring, security, observability, and support. We require appropriate controller-processor terms. Where legally required for a transfer outside the EEA or UK, we will use an adequacy mechanism or approved contractual safeguards and document the associated assessment. The final provider list, countries, roles, and safeguards remain launch-blocking until recorded here.

Retention

• Original and substantially reconstructable normalized answer text: 30 days after submission, then physically removed from the live submission record by a scheduled process.
• Derived scores, facet identifiers, game results, streaks, usage/cost records, model provenance, and safe audit evidence: retained while needed for authoritative history, security, accounting, disputes, and applicable legal obligations, under the approved category schedule.
• Research data: no longer than the separately disclosed research period; consent does not extend routine answer-text retention unless a later, specific notice and consent explicitly says so.
• Backups: encrypted and access-controlled under the approved provider schedule. A restored backup must be quarantined and overdue answer text re-purged before service.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw optional research consent without affecting earlier lawful processing. Email privacy@epms.com; we will verify identity and normally respond within one month where GDPR or UK GDPR applies.

Removing ESP from ChatGPT does not delete the EPMS account. Revoke ESP at the identity provider to stop future authorization, and contact us for account deletion. You may complain to the data-protection authority where you live or work, or where you believe an infringement occurred.

Children

ESP is intended only for adults aged 18 or over during the initial release. Do not use ESP if you are under 18. This restriction and an appropriate age-assurance approach require review before public launch.

Cookies and similar storage

ESP currently uses only storage necessary for authentication, security, and requested functionality. We will not enable non-essential analytics, advertising, or tracking storage for European users without the required prior choice and information.

Changes

Material changes will receive a new version and effective date. Where required, we will provide notice before the new processing begins.