Endorr Privacy Policy

Section summaries in italics are for convenience only and are not legally binding.

Company details

1. Summary

Summary of this policy.

• We use your personal data to run Endorr, bill you, keep the service safe and, only if you agree, to send newsletters and improve our AI.
• To fight illegal content, such as child sexual abuse material, we act on reports and may use automated matching against lists of known illegal material. We don't routinely look through private files by hand. Where the law requires it, we preserve evidence and report to the authorities (section 4A).
• We never train our AI on your files unless you opt in. The opt-in checkbox is unticked by default, and you can change your choice at any time in Settings.
• Our AI runs on our own models. We don't send your files to third-party AI providers.
• Your files are stored in the EU by default.
• We don't sell your personal data.
• You can access, correct, export or delete your data, and you can complain to the Autoriteit Persoonsgegevens (the Dutch data protection authority).

2. Scope and our role

Summary: Sometimes we decide how your data is used (controller). Sometimes a business customer decides and we act for them (processor).

2.1 This policy covers the Endorr websites, Endorr Studio, FileFixxr, PixlPilot AI (including the PixlPilot API), PwrMockup, PrintReadySheets (when used through your Endorr account), Endorr Cloud and the Endorr Cloud for Windows app (together, the "Services").

2.2 When we are the controller. Endorr is the controller for:

• account data;
• organisation and membership data;
• billing data;
• support data;
• security and usage logs;
• marketing data;
• cookie and analytics data;
• files used for AI training with your opt-in consent (section 5); and
• safety and abuse-prevention processing, including reports, moderation decisions, automated detection, preserved evidence and reports to authorities (section 4A). We do this as a controller even for files that a customer controls, because we have our own legal obligations as a hosting provider.

2.3 When we are a processor. When we provide the Services, we process personal data inside the files our customers upload (for example client names, photos, addresses and logos with personal data) as a processor on the customer's behalf, only to provide the Services. For business customers, our Data Processing Agreement (https://endorr.com/dpa) governs that processing, and the business is the controller of that data. If your data is in files uploaded by a business, please contact that business first.

2.4 Where processing of files is our own. We become a controller for file contents only for the purposes listed in section 2.2: safety and abuse prevention, and AI training on content uploaded while opt-in consent was switched on (section 5).

3. What we collect

Summary: What you give us, what we collect automatically, and what we get from partners.

4. How we use your data and why we're allowed to

Summary: Each use has a legal basis under the GDPR.

Where we rely on legitimate interests, you can object (section 11). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4A. Safety, abuse detection and reporting to authorities

Summary: We fight illegal content in a targeted way. We report and preserve evidence where the law requires.

4A.1 What we do. To keep Endorr free of illegal content and enforce our Acceptable Use Policy, we:

• handle reports from users, rights holders, hotlines and authorities;
• may use automated tools that compare digital fingerprints (hashes) of files against lists of known illegal material (such as child sexual abuse material or terrorist content), scan for malware, and detect abuse patterns;
• review flagged or reported content; and
• take and record moderation decisions.

We do not routinely look through private files by hand. Staff look at a file only when it has been reported or flagged, for a specific investigation, at your request, or where the law requires it.

4A.2 Legal basis.

• We process this data to meet legal obligations (GDPR Art. 6(1)(c)), for example under the EU Digital Services Act, the EU Terrorist Content Online Regulation and Dutch law on child sexual abuse material.
• Where no specific legal obligation applies, we rely on our legitimate interests (Art. 6(1)(f)) in keeping the Services safe and lawful and in protecting victims and other users.
• We document the balancing of our interests against yours for each legitimate-interest purpose, and you can ask us for more information about it.
• Where this involves data about suspected criminal offences, we process it only within the limits of GDPR Art. 10 and the Dutch GDPR Implementation Act (UAVG): only to the extent necessary to handle the report or protect the Services and others, with restricted access, and we do not keep blacklists of suspected offenders beyond the account blocks described in our Acceptable Use Policy.

4A.3 Automated decisions. Some uploads may be blocked automatically, for example a file that matches known malware or known child sexual abuse material. Every decision to close an account is reviewed by a person. For suspected child sexual abuse material, the person reviews the match and account information, not the material itself. You can contest decisions through our appeal process (Terms of Service section 9.4) and ask for human review.

4A.4 Disclosure to authorities. We may share personal data and content with:

• Offlimits (Meldpunt Kinderporno, the Dutch hotline) and the police, when reporting apparent child sexual abuse material;
• police and public prosecutors, when we suspect a criminal offence involving a threat to life or safety (DSA Art. 18), or other serious crime;
• the ATKM (the Dutch authority for online terrorist and child sexual abuse material), when complying with its orders;
• other competent authorities and courts with valid legal orders; and
• for apparent child sexual abuse material stored in our US region, additionally the US National Center for Missing & Exploited Children (NCMEC).

We only share what is necessary, and we keep a record of each disclosure. For suspected child sexual abuse material, staff confirm the material only to the minimum extent needed and document that step; we do not actively search for such material beyond the automated measures in section 4A.1.

4A.5 Preserved evidence. When we remove serious illegal content, we may preserve the content and related data, such as account details, IP addresses, timestamps and share-link history, in restricted, access-logged storage. Only a few designated staff can access it, and only to the extent strictly necessary. See section 8 for how long we keep it.

4A.6 Limits on your rights. We do not limit your rights as a general rule. Only in an individual case, where informing you, or giving you access to or deleting data, would prejudice the prevention, investigation or prosecution of crime, or where an authority prohibits it, may we delay or restrict a specific right, to the extent and for as long as GDPR Art. 23 and the UAVG allow. We document each such decision.

5. AI training: only with your consent

Summary: Opting in is optional, off by default, and changeable at any time. It doesn't change the service you get.

5.1 Default: off. We do not use your files to train, test or improve our AI models unless you opt in. When you sign up, the AI training checkbox is unticked. It is separate from accepting the Terms, and you don't need to tick it to sign up. The Services are exactly the same whether you opt in or not.

5.2 What opting in covers. If you opt in, we may use files you upload while consent is on, and Outputs created from them, to train, evaluate and improve Endorr's own AI models, such as PixlPilot. We do not share these files with third-party AI providers.

5.3 Changing your choice. You can switch AI training consent on or off at any time in Settings → Privacy → AI training. If you withdraw consent:

• we stop using your files for future training;
• withdrawal does not affect training that already took place; and
• we do not need to retrain or delete models that were already trained.

We remove files collected under your consent from our training datasets within 4 weeks of withdrawal.

5.4 Records. We log when you gave or withdrew consent, with a timestamp, so we can show what you agreed to.

5.5 Organisations. For Enterprise and Custom organisations, AI training is off by default. Only an organisation admin can switch it on for the organisation. On every plan, the organisation's setting applies to files in that organisation, and each person's own setting applies to their personal workspace.

5.6 Third-party and client artwork. If you opt in, you confirm that you have the rights and permissions needed for us to use the files for training, including artwork you received from clients.

5.7 How our models were trained. Our models were trained before Endorr existed, only on Drukbaas B.V.'s own data. This included older material from Drukbaas customers, provided with their permission. No Endorr customer or account data has ever been used to train our models. Content uploaded to Endorr is used for training only if the user (or, for organisation files, the organisation admin) has opted in with the unticked AI-training checkbox at sign-up or the toggle in Settings, as described in this section. This also applies to files uploaded while an earlier default setting applied.

5.8 Retention of training data. Before training, we strip file metadata such as author names, EXIF data and file paths. We keep training copies for at most 3 years after collection, or until you withdraw consent (then removed within 4 weeks), whichever is sooner.

6. Who we share data with

Summary: Only the service providers we need, plus people you choose to share with. We never sell your data.

6.1 Sub-processors. We use the following service providers. They process personal data on our instructions under written agreements:

The current list, including any provider we add for detecting known illegal material, is at https://endorr.com/subprocessors. You can subscribe there to be notified of changes at least 30 days in advance.

6.2 No third-party AI. All AI processing runs on Endorr's own models. Your files are not sent to third-party AI services.

6.3 Other recipients.

• Your organisation: owners and admins can see members, activity and files in the organisation.
• People you share with: anyone with a share link can view and download the shared content until the link expires (7 days by default).
• Group companies: Drukbaas B.V. and, once incorporated, the separate Endorr company, as needed to run the Services.
• Google and Meta (only with cookie consent): if you accept analytics or advertising cookies, our websites load tags from Google (Google Tag Manager, Google Analytics and, when we run Google ads, Google Ads; provided by Google Ireland Limited) and Meta (the Meta Pixel; provided by Meta Platforms Ireland Limited). These tags collect data such as the pages you visit, device and browser information, IP address, cookie identifiers and conversion events (for example a sign-up or purchase). For Google Analytics, Google processes data on our behalf. For Google Ads and the Meta Pixel, Google and Meta also use the data for their own purposes as independent controllers, under their own privacy policies (https://policies.google.com/privacy and https://www.facebook.com/privacy/policy). For collecting data through these tags on our websites and transmitting it to Google or Meta, Endorr and Google or Meta (as applicable) are joint controllers. Endorr is responsible for obtaining your consent and for informing you; Google and Meta are responsible for their processing after they receive the data. You can exercise your rights with us or with them. The tags load only after you consent (Google Consent Mode v2, see section 12.2). Data may be transferred to Google LLC and Meta Platforms, Inc. in the United States, which are certified under the EU-U.S. Data Privacy Framework. You can withdraw consent at any time via "Cookie settings" (section 12).
• Authorities: police, public prosecutors, the ATKM and other competent authorities, where the law requires it, when complying with orders, or to report suspected serious crimes (section 4A.4).
• Buyers or successors: if the business is reorganised or sold, including the planned transfer to a separate Endorr company. We will notify you.

6.4 We do not sell your personal data.

7. International transfers

Summary: We keep data in the EU by default. Where data does leave, we use approved safeguards.

7.1 We store databases and files in the European Union by default. If your organisation chooses the US region, your files and databases are stored in the United States.

7.2 Some providers, or parts of their services, may process personal data outside the European Economic Area. For transfers to the United States, we rely on the EU-US Data Privacy Framework where the recipient is certified. Otherwise we use the European Commission's Standard Contractual Clauses, with additional measures where needed. For other countries we rely on an adequacy decision or SCCs. You can ask for a copy of the relevant safeguards at privacy@endorr.com.

8. How long we keep data

Summary: We keep data only as long as needed. Deleted files stay in the Trash for 14 days and are then permanently deleted.

Note: these deletion timelines don't apply to content and data we must preserve as evidence (section 4A.5).

Export. You can download your files in Endorr Studio at any time, or ask us for an export of your data as a ZIP file at privacy@endorr.com. We provide it within one month.

9. Security

Summary: Encryption, access controls, and Endorr manages the keys.

9.1 We protect your data with appropriate technical and organisational measures. These include encryption in transit (TLS) and at rest, with encryption keys managed by Endorr, access controls based on need, and monitoring.

9.2 No system is completely secure. Please use a strong, unique password, and tell us at privacy@endorr.com if you suspect unauthorised access.

10. Data breaches

Summary: If something goes wrong, we tell the regulator and you.

10.1 If a personal data breach occurs, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, where required by law. We inform affected users without undue delay where the breach is likely to result in a high risk to them.

10.2 Where we act as a processor, we notify the business customer without undue delay, as set out in the DPA, so it can meet its own obligations.

11. Your rights

Summary: You control your data.

11.1 Under the GDPR you have the right to:

• access your personal data and get a copy;
• correct inaccurate data;
• delete your data;
• restrict processing;
• data portability, i.e. receive your data in a usable format (we provide a ZIP export);
• object to processing based on legitimate interests, and to direct marketing at any time; and
• withdraw consent at any time (for AI training, newsletters or cookies), without affecting earlier processing.

11.2 You can manage most of this yourself in Endorr Studio (Settings, Files, Billing). Otherwise, email privacy@endorr.com. We reply within one month. In complex cases we may extend this by up to two more months and will tell you why. We may need to verify your identity.

11.3 If your data is in files uploaded by a business customer, we will refer your request to that business, which is the controller.

11.4 Complaints. You can complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or to the data protection authority in your country. We'd appreciate the chance to resolve your concern first at privacy@endorr.com.

12. Cookies and similar technologies

Summary: Essential cookies keep you signed in. Analytics and ad pixels run only if you accept them.

12.1 Essential cookies are needed for sign-in, security, load balancing and remembering your cookie and language choices. They cannot be switched off.

12.2 Analytics cookies and advertising pixels (Google Analytics and Google Ads tags through Google Tag Manager, and the Meta Pixel) are used only after you consent through our cookie banner. Until you accept, these tags do not load at all, and your choice is passed to Google through Google Consent Mode v2. See section 6.3 for how Google and Meta use the data. You can change your choice at any time via "Cookie settings" in the footer of every page. If you refuse, the Services work the same way.

12.3 Our separate Cookie Policy (https://endorr.com/cookies) lists the cookies, their providers, purposes and lifetimes.

12.4 Fonts. We host our web fonts ourselves, so loading our pages does not send your IP address to a font provider.

13. Marketing emails

Summary: Newsletters only if you opt in.

13.1 We send newsletters and marketing emails only if you opt in, for example with the unticked checkbox at sign-up. We send them ourselves, through our email provider Resend (section 6.1). Every email has an unsubscribe link, and you can also change this in Settings.

13.2 We still send emails that are needed to provide the Services, such as receipts, security alerts and notices about changes to our Terms.

14. Age limit

Summary: Endorr is for people aged 16 and over.

14.1 Endorr is not intended for anyone under 16. If we learn that someone under 16 has created an account, we will delete it.

14.2 Users aged 16 and 17 may only buy paid plans or tokens with the permission of a parent or guardian (Terms section 2.1A).

14.3 Pupils and students can use Endorr through their school or institution only under an agreement between Endorr and that institution, which sets out the institution's responsibilities.

15. Changes to this policy

Summary: We'll tell you about important changes.

We may update this policy. We will notify you of material changes by email or in Endorr Studio before they take effect. The "Effective date" at the top shows the current version. Previous versions are archived at https://endorr.com/legal/archive.

16. Contact

Privacy: privacy@endorr.com · Legal: legal@endorr.com · Abuse reports: abuse@endorr.com · Authorities (DSA): dsa@endorr.com · Post: Drukbaas B.V., Elektraweg 5, 3144 CB Maassluis, the Netherlands.