Privacy policy

1. Who we are

endpointr is operated by SitePoint Systems ApS, registered in Denmark. Contact: privacy@endpointr.com. We act as the data controller for personal data we collect directly (account holders, billing contacts), and as a data processor for personal data routed through the gateway on behalf of our customers.

2. What we collect

• Account data: name, email, hashed password, organisation, billing address.
• Service credentials: API keys you store for upstream providers, sealed at rest with XSalsa20-Poly1305 (libsodium). The master key never lives in the database.
• Request metadata: timestamps, response codes, latency, provider used, byte counts. Used for billing, debugging, and abuse prevention.
• Request payloads: proxied through the gateway. Bodies are not persisted by default; opt-in logging exists for audit trails and is scoped to the customer that enabled it.
• Cookies: a single session cookie for the admin UI. No advertising or third-party trackers.

3. Why we process it

• To deliver the service you signed up for (contractual necessity, GDPR Art. 6(1)(b)).
• To bill, to honour tax/accounting law, and to keep audit records (legal obligation, Art. 6(1)(c)).
• To prevent abuse, secure the platform, and improve reliability (legitimate interest, Art. 6(1)(f)).

4. Who we share data with

Upstream providers you have configured (OpenAI, Anthropic, Stripe, etc.) receive the request payloads you direct at them — that is the point of the gateway. We share account/billing data with our payment processor and accountants as needed. We never sell personal data and never share it for advertising.

5. Where data lives

Primary infrastructure is hosted within the EU. Specific upstream calls go to whichever region the upstream provider operates in. If you require data residency guarantees, contact us before provisioning.

6. Retention

Account data is retained for the life of the account plus the period required by accounting law (5 years in Denmark). Request metadata is retained for 13 months unless you ask otherwise. Encrypted credentials are deleted when you delete them, and within 30 days of account closure.

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interest. Email privacy@endpointr.com and we will respond within 30 days. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

8. Security

Credentials are encrypted at rest with authenticated encryption (XSalsa20-Poly1305). TLS is enforced in transit. Admin access is scoped per customer, audit-logged, and protected by session expiry. No system is perfect — if you believe you have found a vulnerability, please disclose it to security@endpointr.com.

9. Changes

We will post material changes to this policy here and update the "last updated" date above. Continued use of the service after changes constitutes acceptance.