This policy explains what personal data Caresoft Inc. collects through the EPM Mate application and the www.epmmate.com website, why, who sees it, how long it is kept, and the rights you have over it.
1. Who we are, and the two roles we play
EPM Mate is provided by Caresoft Inc., 5 Independence Way, Suite 300, Princeton, NJ 08540, United States ("Caresoft", "we").
In the EPM Mate application (EPM TestMate, EPM Admin, EPM Auditor and the EPM CoE Portal), the organization that gave you your account (your "organization") decides what data is loaded and why. Under data-protection law your organization is the controller, and Caresoft is its processor or service provider: we process personal data only on your organization's documented instructions, under the subscription agreement between us (the "Subscription Agreement") and its data-processing terms. If you have a question about data held in your organization's EPM Mate environment, start with your organization's EPM Mate administrator; we help administrators respond.
On www.epmmate.com, Caresoft is the controller of the data collected.
2. Personal data in the EPM Mate application
| Category | Examples | Where it comes from |
|---|---|---|
| Account and profile | Name, work email address, organization, EPM Mate role (administrator, operator, viewer, approver), identity-provider identifier, preferences | Your organization's administrator, or its single sign-on |
| Sign-in and security | Sign-in and sign-out times, IP address, browser and device type, session identifiers, authentication events | Collected automatically when you use the service |
| Audit trail | Every action taken in EPM Mate: what was run, changed, approved or certified, by whom and when | Collected automatically when you use the service |
| EPM Auditor content | Identity-domain users, groups and roles; application security assignments; directory attributes such as title, location, manager and employment status; approver matrices; review decisions and attestations; segregation-of-duties policies; change tickets and approvals | Your organization's Oracle EPM Cloud environments, directory, GRC and ticketing systems, or extracts loaded from them |
| EPM TestMate content | Test cases, baselines and results; screenshots of application screens, which can show user names and the data in forms and reports; run-book assignments and sign-offs | Your organization's applications, captured during tests |
| EPM Admin content | Application catalog with owners and contacts; performance metrics; Activity Reports and logs, which identify the users who ran actions; alerts; batch-job definitions and run logs | Your organization's Oracle EPM Cloud environments |
| EPM CoE Portal content | Run books, documents, learning paths and training completions, points of contact, survey responses, enhancement requests | Content your organization creates in the portal |
| Support | Name, email address, messages, screenshots and diagnostic information you send us | You |
| Service credentials | Connection credentials for Oracle EPM Cloud and connected systems | Your organization. Stored encrypted in Azure Key Vault and never displayed back in the interface |
3. Personal data on the website
- Contact form. When you ask for a proof of concept or a demo, we receive the name, work email address, company, role, the utilities and applications you are interested in, and the message you enter. The form is submitted through a form-processing provider that forwards it to us by email and keeps a copy under its own privacy policy.
- Email. Messages you send to the addresses on this site, and our replies.
- Server logs. Our hosting provider records the standard web-server log for each request: IP address, date and time, page requested, referring page, browser type. We use these logs for security and to keep the site running.
- No cookies, no trackers. www.epmmate.com sets no cookies, uses no analytics or advertising services, and loads its typefaces and other resources from its own servers, so your visit is not reported to any third party.
4. Why we use personal data, and on what legal basis
| Purpose | Data used | Legal basis (where EEA, UK or Swiss law applies) |
|---|---|---|
| Providing EPM Mate to your organization: accounts, roles, campaigns, tests, monitoring, portal content | Account and profile; application content | Your organization's instructions under the Subscription Agreement; performance of that contract |
| Keeping the service secure and preventing misuse | Sign-in and security data; audit trail | Our legitimate interest in the security of the service, and legal obligations |
| Maintaining the audit trail and producing evidence packs, scores and reports your organization uses for its controls | Audit trail; application content | Your organization's instructions and its legal obligations, including SOX |
| Supporting you and communicating about the service, including maintenance and security notices | Account and profile; support data | Performance of the contract; our legitimate interest in running the service |
| AI-assisted features you choose to use (section 5) | The text you enter and the related job, test or log data | Your organization's instructions |
| Improving EPM Mate: performance, reliability and usability | Usage and performance data, aggregated or de-identified wherever possible | Our legitimate interest in improving the service |
| Responding to website inquiries and following up about EPM Mate | Contact-form and email data | Our legitimate interest in responding to a business inquiry; consent where required. You can ask us to stop at any time |
| Meeting legal obligations and protecting rights | Any of the above, as required | Legal obligation; legitimate interests |
We do not sell personal data, do not share it for targeted advertising, and do not use it to make automated decisions that have legal or similarly significant effects on you. In an access review, it is your organization's approvers who decide; EPM Mate records and executes their decisions.
5. AI-assisted features
Some features send what you type, together with the related job, test or log data, to a large-language-model service in order to return a draft script, a summary or an answer. EPM Mate uses models from more than one provider, including OpenAI, Anthropic (Claude) and Microsoft, through those providers' services for business customers and under their terms. Caresoft uses the content only to return the result to you, and keeps the prompts and results under the same protections and retention as the rest of your organization's data. Your organization can ask for these features to be disabled in its environment.
6. Who sees personal data
- Caresoft personnel who need it to operate and support the service, under confidentiality obligations, with access limited to what their role requires and recorded in the audit trail.
- Caresoft Inc. (India), Bhopal, Madhya Pradesh, India, an affiliate that provides support and operations services to Caresoft under a written contract that applies the same obligations.
- Microsoft, which provides the Azure infrastructure EPM Mate runs on: hosting, storage, encryption and Azure Key Vault. Where your organization has chosen to deploy EPM Mate in its own Azure tenant, Microsoft acts as your organization's provider rather than ours.
- AI model providers, currently OpenAI, Anthropic and Microsoft, which receive the content described in section 5 when you use an AI-assisted feature.
- The form-processing provider for the website contact form.
- Your organization's auditors, where your organization admits them to the read-only auditor workspace or shares an evidence pack with them.
- Professional advisers, and authorities where the law requires disclosure or where it is needed to protect rights, safety or property.
- A successor, if Caresoft or the EPM Mate business is sold or merged, with notice to your organization.
A current list of the subprocessors engaged for your organization's environment, with their locations, is part of the Subscription Agreement and is available on request.
7. Where data is kept and international transfers
Caresoft-hosted environments run in the Microsoft Azure region agreed with your organization, in the United States unless agreed otherwise. Support and operations are performed from the United States and from India. Where personal data protected by EEA, UK or Swiss law is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's standard contractual clauses, with the UK addendum or the Swiss adaptations where they apply, as set out in the Subscription Agreement's data-processing terms. A copy is available on request.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, profile and application content | For your organization's subscription or proof of concept, then returned or deleted as the Subscription Agreement provides; by default within 90 days of its end, unless your organization asks for earlier deletion |
| Audit trail and evidence packs | For the retention period your organization sets. Evidence packs are commonly kept for seven years to meet audit requirements. Exported to your organization on request and at the end of the subscription |
| Service credentials | Deleted when the connection is removed or the subscription ends |
| Sign-in and security logs | Up to 12 months, longer where an investigation requires it |
| Support records | 12 months after the request is closed |
| Website inquiries and email | Up to 12 months after our last exchange, or until you ask us to delete them |
| Website server logs | Up to 90 days |
9. How we protect data
Caresoft is ISO 27001, SOC 2 and CMMI certified. EPM Mate encrypts data in transit and at rest, holds system credentials in Azure Key Vault, separates each organization's environment, uses your organization's single sign-on and role-based access to control who can see what, writes every action to an audit trail, limits Caresoft staff access to what their role requires, and keeps its software and infrastructure patched. If a security incident affects your organization's data, we notify your organization without undue delay, as the Subscription Agreement provides, and support its own notifications.
10. Your rights
Depending on where you live, you may have the right to ask for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive a copy in a portable form, to withdraw consent you have given, and to complain to a supervisory authority. Residents of California and certain other US states have rights to know, access, correct and delete personal information and not to be discriminated against for exercising them; we do not sell or share personal information for targeted advertising.
For data held in your organization's EPM Mate environment, make your request to your organization's EPM Mate administrator, who can act on it directly or ask us to; we assist within the time limits in the Subscription Agreement. For data we hold as a controller, write to the contact in section 13. We will verify your identity and respond within the time the law requires. If you are in the EEA, the UK or Switzerland and are not satisfied with our response, you may contact your supervisory authority.
11. Children
EPM Mate and this website are intended for business users and are not directed at anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may change this policy. The effective date at the top shows when the current version took effect. Material changes are notified to your organization's administrator and may be shown when you sign in.
13. Contact
Caresoft Inc., 5 Independence Way, Suite 300, Princeton, NJ 08540, United States
Office 732.764.9500 x 2005 · privacy@caresoftinc.com