Privacy Statement

1. Who we are

EndPointBlank (the "Service", at endpointblank.com) is a software-as-a-service product owned and operated by Bengal Technologies LLC ("Bengal Technologies", "we", "us", or "our"), a privately held company based in Kenosha County, Wisconsin, USA. This Privacy Statement explains what information we collect when you visit our website or use the Service, why we collect it, who we share it with, and the choices and rights you have.

• Legal entity: Bengal Technologies LLC (owner and operator of EndPointBlank)
• Registered address: 11212 251st Avenue, Trevor, Wisconsin 53179, USA
• Privacy contact: support@endpointblank.com

This Statement covers visitors to endpointblank.com, people who hold an EndPointBlank account, and the owners of managed accounts that a provider creates for them. It also describes how we handle the operational data that account holders' applications send to the Service. For that operational data, the account holder decides what is sent and we process it on their behalf.

2. Information we collect

Most of this you give us directly. Some is created automatically as you, your applications, or your API clients use the Service.

Data	Source	CCPA category
Name, email address, job title, time zone and display preferences	You, when you register or edit your profile	Identifiers; professional information
Organization name and domain, and contacts you add for your organization	You, or a provider that creates a managed account for you	Identifiers; professional information
Sign-in methods: a hashed password, passkeys (public keys only), and the Google account you link	You, when you set them up	Identifiers
Mobile phone number and your SMS consent	You, if you add a phone for sign-in codes or alerts	Identifiers
Sign-in history: time, IP address, browser, operating system and device, and the IP address that requested each sign-in code or invite request	Automatically, from your browser	Identifiers; internet activity
Session and sign-in cookies	Automatically, from your browser	Internet activity
Configuration: applications, endpoints, environments, access grants, API packages, groups, client invitations, masking rules, notification settings and API credentials (stored only as irreversible hashes)	You and your organization's members	Depends on what you enter
Operational data: authentication attempts, authorization decisions, API request and response records (including headers and bodies you choose to send), and error reports	Your applications and SDKs, and the API clients that call them	Internet activity; otherwise depends on what the data contains
Plan, subscription and billing status	You, and Stripe, our payment processor	Commercial information
Support tickets and other correspondence	You, when you contact us	Depends on what you write

We do not ask for sensitive personal information such as government IDs or health data, and we never see full payment card numbers: Stripe collects those directly. Operational data is whatever your applications send. EndPointBlank provides masking rules that redact values before they are stored, and applying them is within your control.

Cookies and similar technologies

We use two strictly necessary cookies: _app_portal_key, which holds your session and protects forms against cross-site request forgery and lasts until you close your browser, and _app_portal_web_user_remember_me, which keeps you signed in for up to 60 days if you tick "remember me". We do not use advertising cookies.

Our public pages (the home page, pricing, the docs and feature pages, these legal pages, and the register and sign-in pages) use Google Analytics to measure how the marketing site is doing: which pages people reach, roughly where they arrive from, and whether they go on to register. It sets two first-party cookies, _ga and _ga_ZB23CZSM55, which hold a randomly generated identifier that lets us recognize a returning browser and group its page views into one visit. Both expire two years after your most recent visit, and Google also receives your IP address and browser user-agent. These cookies are not strictly necessary, and you can refuse them (see Section 7). They are never set inside the application: once you are signed in, or on a managed-account page, we do not load Google Analytics at all. We do not use this data for advertising, and we do not combine it with your account.

3. How we use information

We use the information we collect only to:

• create and manage your account and provide, operate, and maintain the Service;
• authenticate users and authorize API access between organizations;
• display the monitoring, logs, and analytics you configure;
• process payments and manage subscriptions;
• send transactional messages (such as sign-in codes, account confirmation, email changes, usage and billing notices, and security notices) by email via Mailgun and, where you enable it, by SMS via Telnyx;
• respond to support requests;
• understand how visitors use our public pages so we can improve them;
• detect, prevent, and investigate abuse, fraud, and security incidents; and
• comply with legal obligations and protect our rights.

We do not sell your personal information, use it for targeted advertising, or use it for automated decision-making that produces legal or similarly significant effects.

4. How we share information

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing. We disclose it only as follows:

• Service providers (sub-processors). Vendors that process data on our instructions to run the Service: Amazon Web Services, which hosts the Service, its databases, and archived request bodies in the United States (us-east-2); Stripe (payments); Mailgun (email delivery); Telnyx (SMS delivery); Google (Google sign-in, if you use it, and analytics on our public pages); and Slack, where our team receives a notice of each new sign-up (organization name and domain) and each support ticket message.
• Within your organization. Data you create is visible to other members of your organization according to the roles and groups you configure.
• Organizations you connect with. When your organization calls another organization's API through EndPointBlank, or lets another organization call yours, each side sees the connection, the contacts it shares, and the authorization and request records about calls between them.
• Providers of managed accounts. If a provider created your organization as a managed account, the provider supplied its name, contacts and owner email, and can manage it through our management API until you claim it.
• Destinations you configure. Notifications go to the Slack and Microsoft Teams webhooks and email addresses your organization sets up.
• Legal and safety. To comply with a subpoena, court order, or other legal process, or to protect the rights, safety, or property of Bengal Technologies LLC, our users, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, in which case this Statement will continue to apply to your information.

Mobile numbers and SMS consent. We do not sell, rent, or share your mobile phone number or your SMS opt-in consent with any third party or affiliate for marketing or promotional purposes, and we never share them with data brokers or lead generators. Your mobile number is disclosed only to Telnyx, our SMS delivery provider, and only to deliver the verification and sign-in codes and alerts you request. Text HELP for help or STOP to opt out at any time.

5. Data retention

We keep personal information only as long as needed for the purposes in this Statement:

Data	Retention period
Account, profile, organization and configuration data	While your account is active, then deleted as described below
Sign-in history, sign-in code requests and sessions (time, IP address, browser and device). A sign-in code is valid for 10 minutes and a session for up to 60 days.	While your account is active
Requests to join an existing organization (email address and IP address), kept as a record of the request and to limit repeated requests	Until you ask us to delete them
Operational data (authentication, authorization, request and error records)	Your plan's retention period, shown on our pricing page (from 7 days on the free plan to 730 days on Business, or as agreed for Enterprise). On plans that keep data longer than 90 days, request and response bodies older than 90 days move to an archive in Amazon S3 until that period ends.
Usage counts and summary analytics	While your account is active
Support correspondence	While your account is active
Billing records	As long as tax and accounting law requires

Moving to a plan with a shorter retention period shortens what we keep, and that cannot be undone. Cancelling a paid subscription deletes your organization's operational data at the next daily cleanup. When we delete your account, we delete or de-identify the associated personal information within a commercially reasonable period, except where we must keep it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Security

We protect data in transit with TLS. Passwords are stored with bcrypt, and API secrets and tokens only as keyed, irreversible hashes, so we cannot read them back. Sign-in codes are stored as keyed hashes and are valid for 10 minutes. Our infrastructure runs in a private network on Amazon Web Services with access restricted to the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and review our practices regularly.

If a breach affects your personal information, we will notify you and any required authorities as the law requires.

7. Your rights under US state privacy laws

If you are a California resident, or a resident of another state with a comprehensive privacy law, you have the right to:

• Know what personal information we collect, use, and disclose;
• Access and receive a copy of the personal information we hold about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of;
• Limit use of sensitive personal information — we do not ask for it; and
• Non-discrimination — we will not treat you differently for exercising your rights.

You can update most account information directly in the application. To delete your account, get a copy of your data, or exercise any other right, email support@endpointblank.com. We will verify your request using the email address on your account. You may use an authorized agent; we may ask for proof of authorization. We respond within 45 days, extendable once by 45 days where the law allows.

In the past 12 months we collected the categories in Section 2, for the purposes in Section 3, and disclosed them only as described in Section 4. We did not sell or share them.

You can refuse the analytics cookies at any time by blocking or deleting cookies for this site in your browser, by using your browser's tracking-protection settings, or by installing Google's opt-out browser add-on. Refusing them does not affect your use of the Service.

8. International users

The Service is operated from the United States, and your information is stored and processed there. The Service is intended for use in the United States and is not offered to users in the European Economic Area, the United Kingdom, or Switzerland. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

9. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it promptly.

10. Changes to this Statement

We may update this Statement from time to time. We will post the revised version with a new effective date and, for material changes, notify account holders by email before they take effect.

11. Contact us

Questions or requests about this Statement or your personal information:

• Email: support@endpointblank.com
• Mail: Bengal Technologies LLC, Attn: EndPointBlank Privacy, 11212 251st Avenue, Trevor, WI 53179, USA

Wisconsin residents may also contact the Wisconsin Department of Agriculture, Trade and Consumer Protection about consumer-protection concerns.