Privacy & Cookie Notice
This notice covers how Endcap handles the personal data of the publishers who use our platform directly. If you're a visitor to one of our publishers' own marketplaces or directories, this notice doesn't apply to you — that publisher's own privacy notice does.
Who we are
[Company legal name], registered in England and Wales at [address], is the controller for the personal data described here.
What we collect and why
- Tenant admin accounts (name, email, hashed password): to provide login access to the admin API. Necessary for performing our contract with you.
- Billing details: payment card details are never held by us — Stripe, our payment processor, collects and holds those directly. We hold your Stripe customer reference, subscription plan and status, and billing history for accounting and legal obligations.
- Audit logs of admin actions (who did what, when, from an IP-derived hash — never the raw IP): kept for security and accountability.
- Support correspondence: kept to respond to you and for our own records.
Who we share it with
Stripe (payment processing), our hosting/infrastructure provider, and our transactional email provider. [List the specific providers and their processing locations once selected.]
International transfers
[Complete once hosting/email/Stripe account region is confirmed.]
Your rights
Access, rectification, erasure, restriction, portability and objection under UK GDPR. Contact [privacy contact email] to exercise these.
Retention
Account data: for the life of your subscription plus [X] for legal/accounting purposes. Audit logs: retained on a documented schedule.