Privacy Policy

Endromeda operates endromeda.xyz and app.endromeda.xyz, and provides creator-focused digital products including the Brand DNA Kit, the Full Creator System, and the Done-For-You Brand service.

This policy explains what personal information we collect, why, who receives it, how long we keep it, and the rights you have over it. For the products where you are our business customer and we handle data on your behalf, the Data Processing Agreement governs and this policy describes the rest.

Captions and content you connect or upload may mention other people. You remain responsible for having a basis to share that with us; we process it only to produce your results.

We do not collect government identifiers, health data, or financial account details.

We do not sell personal information, share it with data brokers, or use it to build advertising profiles.

We do not use your content to train AI models, and the providers we use are engaged under terms that prohibit training on our data.

We do not sell, rent or trade personal information. It is shared only with the processors below, each under a contract limiting them to our instructions:

AI generation necessarily sends the relevant inputs — your brand answers, captions and content — to Anthropic, and to Google for image generation. This is how the product produces anything at all.

We may disclose information where the law requires it, or to protect rights and safety. If Endromeda is acquired or merges, you will be told by email before your data becomes subject to a different policy.

• Account and customer records — 7 years after the relationship ends, for accounting and tax, then deleted
• Instagram content we synced — kept while your account is connected, and deleted within 30 days of disconnection or account closure
• Generated content and audits — kept until you delete them or close your account
• Unfinished onboarding, where you never identified yourself — deleted after 12 months of inactivity
• Email communications — up to 3 years
• Marketing preferences and unsubscribe records — kept as long as needed to honour your choice
• Analytics — aggregated; raw records deleted within 14 months
• Encrypted backups — up to 90 days after deletion, then overwritten

You can request deletion at any time and we will action it within 30 days.

• Strictly necessary — your login session and security
• Preferences — settings and layout choices you have made
• Analytics — understanding how the product is used

Your browser controls cookies. We do not use advertising cookies, retargeting pixels, or the Meta Pixel.

You can ask us to give you a copy of your data, correct it, delete it, export it in a portable format, restrict or object to how we use it, and withdraw any consent you have given. Withdrawing consent does not affect what we did lawfully beforehand.

If you are in California, you also have the right to know what we collect, to have it deleted, to opt out of sale (we do not sell), and not to be treated differently for exercising those rights.

To exercise any of these, email hello@endromeda.xyz with the subject "Privacy Request". We respond within 30 days. If you are in the EU or UK you may also complain to your local data protection authority.

Every marketing email has an unsubscribe link that takes effect immediately. Service emails about your account cannot be switched off while the account is open.

You can disconnect Instagram at any time from your settings, which revokes our token and stops any further reading of your account.

Stripe handles all card data and is PCI DSS Level 1 certified. We never receive card numbers, CVV or expiry dates.

If a breach occurs that risks your rights, we notify the relevant supervisory authority within 72 hours of becoming aware, as GDPR Article 33 requires, and affected users without undue delay. Where we act as a processor for a business customer, we notify that customer within 48 hours — sooner, so they can meet their own 72-hour deadline. See the DPA.

Report a suspected vulnerability to hello@endromeda.xyz with the subject "Security Disclosure". We acknowledge within 48 hours.

No system is perfectly secure. Use a strong, unique password and enable the protections available to you.

We are based outside the United States but our processors are largely US-based, so your data will be processed there. Transfers out of the EEA rely on Standard Contractual Clauses, transfers out of the UK on the UK IDTA, and on the EU-US Data Privacy Framework where a provider is certified.

This policy covers Endromeda only. Where the product links to Instagram, Stripe or any other service, their own policies apply to what happens there.

Endromeda is not for anyone under 16. We do not knowingly collect their information and will delete it promptly if we discover it. Contact hello@endromeda.xyz if you believe a child has given us data.

We update this policy as the product changes. The revision date at the top always reflects the current version, and we email you before a material change takes effect. Continuing to use Endromeda after that means you accept the update.

Privacy questions and requests: hello@endromeda.xyz. Include your full name and the email on your account. We respond within 30 days.