Privacy Policy

Endromeda ("Endromeda," "we," "our," or "us") operates the website endromeda.xyz and provides creator-focused digital products and services, including the Brand DNA Kit, Full Creator System, and Done-For-You Brand service.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding that information. It applies to all interactions with our website, products, and services.

By using our website or purchasing a product, you agree to this Privacy Policy. If you do not agree, please do not use our services.

We collect information in three ways: information you give us directly, information collected automatically, and information from third parties.

Information you provide directly:

• Contact & account information — name, email address, and Instagram handle when you purchase a product, fill out an inquiry form, or contact us.
• Purchase information — your chosen product, billing name, and email. Payment details (card number, CVV, expiration) are processed exclusively by Stripe and never stored on our servers.
• Communications — the content of emails, messages, or inquiries you send us.
• Business information — for the Done-For-You Brand service, we may collect information about your business, goals, audience, and brand to deliver the service.

Information collected automatically:

• Usage data — pages visited, time on site, referring URLs, browser type, device type, and IP address (anonymized where possible).
• Cookies & local storage — small files stored on your device to improve site functionality (see Section 6).

We do not collect sensitive personal data such as government IDs, health information, or financial account details (your payment card data goes directly to Stripe).

We will never use your data to train AI models, create profiles for advertising networks, or sell to data brokers.

We do not sell, rent, or trade your personal information — full stop.

We may share limited information only with the following trusted service providers, solely to operate our business:

• Stripe — payment processing. Stripe's Privacy Policy governs their use of your payment data.
• Supabase — secure database and authentication infrastructure (for app users).
• Email service provider — for transactional and marketing emails. Emails are sent only to addresses you provide.
• Vercel / hosting providers — to serve our website. These providers do not have access to your personal records.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of Endromeda, our customers, or the public.

In the event of a business acquisition or merger, your information may be transferred, and we will notify you via email or prominent website notice before your data is subject to a different privacy policy.

We retain your personal information only as long as necessary to fulfil the purposes described in this policy:

• Customer records — retained for 7 years for accounting and tax compliance, then securely deleted.
• Email communications — retained for up to 3 years, then deleted.
• Marketing preferences & opt-out records — retained indefinitely to honour your preferences.
• Website analytics data — retained in anonymized/aggregated form; raw IP-level data deleted within 14 months.

You may request deletion of your data at any time (see Section 7).

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary cookies — required for the website to function (e.g., session management, security). These cannot be disabled.
• Analytics cookies — help us understand how visitors use the site so we can improve it. These may include privacy-respecting analytics tools.
• Preference cookies — remember settings such as language or display preferences.

You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the website. Most browsers allow you to refuse new cookies, receive alerts when cookies are set, and delete existing cookies.

We do not use advertising cookies, retargeting pixels, or Facebook Pixel on our core landing page at this time.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion ("Right to be Forgotten") — request deletion of your personal data, subject to legal retention requirements.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we restrict how we process your data.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

California residents (CCPA): You have the right to know what personal information we collect, the right to delete it, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising these rights.

To exercise any right, email hello@endromeda.xyz with the subject line "Privacy Request." We will respond within 30 days.

Unsubscribing from emails: Every marketing email contains an unsubscribe link. Clicking it immediately removes you from our mailing list. Transactional emails (e.g., order confirmations) cannot be unsubscribed from while your account is active.

We take the security of your personal information seriously. Endromeda implements a layered set of technical and organisational measures designed to protect your data against unauthorised access, disclosure, alteration, and destruction.

Technical Controls

• Encryption in transit — All data exchanged between your browser and our services is protected by TLS 1.2 or higher (HTTPS). Unencrypted HTTP connections are rejected.
• Encryption at rest — Personal data stored in our database is encrypted at rest using AES-256. Passwords are never stored in plaintext — they are hashed with bcrypt before storage.
• Authentication tokens — Session tokens are short-lived JWTs with enforced expiry. Refresh tokens are rotated on each use and invalidated on logout.
• Row-level security (RLS) — Our Supabase database enforces row-level security policies so that authenticated users can only access their own records. No cross-user data leakage is possible by design.
• API key isolation — All calls to third-party AI APIs (including Anthropic) are made exclusively through server-side Supabase Edge Functions. API keys are stored as environment secrets and are never exposed to the client browser.
• Rate limiting — API endpoints are rate-limited to reduce exposure to brute-force and denial-of-service attacks.
• Input validation & sanitisation — All user-supplied input is validated and sanitised server-side to prevent injection attacks (SQL injection, XSS).

Organisational Controls

• Least-privilege access — Internal access to production systems and customer data is restricted to the minimum necessary. No shared credentials are used.
• Multi-factor authentication (MFA) — MFA is required for all internal accounts with access to production infrastructure.
• Sub-processor due diligence — We evaluate the security posture of all third-party services we use (Supabase, Stripe, Anthropic, Vercel). We only engage providers who maintain their own security programmes, certifications, or audits (e.g., Supabase is SOC 2 Type II certified; Stripe is PCI DSS Level 1 certified).
• Dependency audits — We regularly audit open-source dependencies for known vulnerabilities and apply patches promptly.
• Principle of data minimisation — We do not collect or retain personal data beyond what is necessary for the stated purpose.

Payment Security

Payment card data is handled exclusively by Stripe, a PCI DSS Level 1 certified payment processor. We never receive, process, or store your card number, CVV, or expiry date. Stripe's Privacy Policy and Terms govern the handling of your payment details.

Security Monitoring

• Automated alerts are configured to detect anomalous login attempts, unusual data access patterns, and infrastructure irregularities.
• Logs are retained for security auditing purposes and are accessible only to authorised team members.
• We perform periodic security reviews of our infrastructure, third-party integrations, and access policies.

Incident Response

Despite best efforts, no system is completely immune to security incidents. In the event we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify relevant supervisory authorities within 72 hours of becoming aware (as required by GDPR Article 33).
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights, including: a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.
• Document the incident and remediation steps taken.

Vulnerability Disclosure

If you discover a potential security vulnerability in our systems, we encourage responsible disclosure. Please report it to hello@endromeda.xyz with the subject line "Security Disclosure." We will acknowledge receipt within 48 hours and investigate promptly. We ask that you not publicly disclose any vulnerability until we have had a reasonable opportunity to investigate and address it.

Our website may contain links to third-party websites (e.g., Instagram, Stripe). This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of third parties and encourage you to review their policies before providing any personal information.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will delete it promptly. If you believe we have inadvertently collected information from a child, please contact us at hello@endromeda.xyz.

Endromeda operates globally and your data may be processed in countries outside your own, including the United States and European Economic Area. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or we transfer data only to recipients in countries deemed to provide adequate protection.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. We encourage you to review this page periodically.

Continued use of our website or services after changes take effect constitutes acceptance of the updated policy.

For any privacy questions, requests, or concerns, contact us directly:

Include your full name and email address in your request, and we will respond within 30 days. If you are located in the EU/UK and believe we have mishandled your data, you also have the right to lodge a complaint with your local data protection authority.