Privacy Statement

1. Who this applies to

This Statement applies to visitors to endpointblank.com and to account holders who use the EndPointBlank application to manage API access, credentials, and monitoring. It covers both the personal information of our users and the operational data that account holders send to the Service.

2. Information we collect

Account information. When you register, we collect your name, email address, job title, and a securely hashed password. We also store your organization's name and domain and your display preferences (such as time zone and theme).

Organization and configuration data. As you use the Service we store the applications, endpoints, environments, access grants, API packages, groups, client invitations, and automation rules you create, along with API credentials, which are stored only as irreversible hashes.

Operational and log data. The Service ingests and stores monitoring data your applications send to it — including authentication attempts, authorization decisions, API request and response records, and error reports. This data may include request metadata, headers, and payload excerpts that you choose to send. EndPointBlank provides configurable masking rules that let you redact sensitive values before they are stored; applying them is within your control.

Billing information. Paid plans are processed by Stripe. We receive billing status, plan, and subscription details from Stripe, but we do not store full payment card numbers — those are handled directly by Stripe.

Communications. If you contact us (for example at support@endpointblank.com), we keep a record of that correspondence.

Cookies. We use a strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies.

3. How we use information

We use the information we collect to:

• provide, operate, secure, and maintain the Service;
• authenticate users and authorize API access;
• display the monitoring, logs, and analytics you configure;
• process payments and manage subscriptions;
• send transactional messages (such as account confirmation, email changes, and security notices) by email via Mailgun and, where you enable it, SMS via Sinch;
• respond to support requests; and
• detect, prevent, and investigate abuse, fraud, and security incidents.

4. How we share information

We do not sell your personal information. We share information only as follows:

• Service providers (sub-processors). We use trusted third parties to run the Service: Amazon Web Services (cloud hosting and database), Stripe (payments), Mailgun (email delivery), and Sinch (SMS delivery). They process data on our behalf under their own terms and security commitments.
• Within your organization. Data you create is visible to other members of your organization according to the roles and groups you configure.
• Legal and safety. We may disclose information if required by law or to protect the rights, safety, or property of EndPointBlank, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

5. Data retention

We retain account and configuration data for as long as your account is active. Operational and log data is retained according to the retention period of your plan, after which it is deleted or anonymized. When you delete your account, we delete or de-identify associated personal information within a commercially reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Security

We protect data in transit using TLS and store credentials and passwords only as irreversible hashes. Our infrastructure runs in a private network on Amazon Web Services with access restricted to the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can update most account information directly in the application, and you can request deletion of your account. To exercise any of these rights, contact us at support@endpointblank.com. We will respond within the time required by applicable law.

8. International users

The Service is operated from the United States, and your information will be processed there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

9. Children's privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

10. Changes to this Statement

We may update this Privacy Statement from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Statement.

11. Contact us

If you have questions about this Privacy Statement or our data practices, contact us at support@endpointblank.com .