Privacy Policy

1. Introduction

Endprompt ("we," "us," or "our") provides an API platform for versioned and observable large language model (LLM) endpoints (the "Service"). This Privacy Policy explains how we collect, use, and protect personal data when you use the Service, including our websites at endprompt.ai and app.endprompt.ai.

Endprompt is operated by Sopro LLC, a United States company. Operational management and decision-making occur in the United Kingdom.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and contact details
• Email address
• Company information
• Billing information
• API credentials

2.2 Usage Information

When you use the Service, we collect:

• API usage metrics
• Request and response logs (which may include Customer Content)
• IP address and device information
• Performance and diagnostic data

2.3 Cookies

We use cookies to:

• Maintain login sessions
• Understand usage
• Improve functionality

You can manage cookies through your browser settings.

2.3.1 Cookies Used by the Sopro Plugin

The Sopro Plugin uses cookies to enhance website performance, functionality, and analytics. Below is a summary of the cookies used by the plugin.

Regular Cookies

3. How We Use Personal Data

We use personal data to:

• Provide and operate the Service
• Process API requests and return outputs
• Monitor performance, security, and reliability
• Prevent fraud and misuse
• Manage accounts and billing
• Provide customer support
• Improve the Service

"Customer Content" refers to data submitted through the API, including prompts and outputs. Customer Content may contain personal data.

We process Customer Content solely to provide the Service and in accordance with your instructions. We do not use Customer Content to train foundation models unless expressly agreed in writing.

When processing Customer Content on your behalf, we act as a data processor. For account, billing, website, and marketing data, we act as a data controller.

The Service generates automated outputs using machine learning models. We do not use such outputs to make decisions that produce legal or similarly significant effects about individuals.

Where required by law, we will enter into a Data Processing Addendum with customers.

4. Legal Bases (UK GDPR / EEA)

Where applicable, we rely on:

• Contract – to provide the Service
• Legitimate interests – to secure, maintain, and improve the Service
• Legal obligations – to comply with applicable laws
• Consent – where required (e.g., certain marketing communications)

5. Data Sharing

We share personal data only where necessary:

• With service providers (e.g., cloud infrastructure and payment processors) under contractual safeguards
• Where required by law
• In connection with a business transfer

We do not sell or share personal information for advertising purposes.

5.1 Third-Party Data Processors

We engage carefully selected third-party partners and service providers who process personal data on our behalf in compliance with GDPR. From time to time, we appoint digital marketing agencies to conduct outreach and marketing activities on our behalf. As part of these activities, personal data may be processed in accordance with applicable data protection laws.

Our appointed data processors include:

6. International Transfers

Personal data may be processed outside your country, including in the United States. Where required, we rely on approved transfer mechanisms such as Standard Contractual Clauses or equivalent safeguards.

7. Data Retention

We retain personal data only as long as necessary.

Customer Content (including API prompts and outputs) is stored in a recoverable format during the active subscription period and for up to 90 days after the expiration, cancellation, or termination of the applicable subscription plan. After this period, it is deleted or irreversibly anonymized unless retention is required by law.

Account and usage data are retained during the active subscription and for up to 90 days thereafter, unless a longer retention period is required by law.

Customers may request earlier deletion, subject to legal obligations.

8. Data Security

We implement appropriate technical and organizational measures, including:

• Encryption in transit and at rest
• Access controls
• Authentication safeguards
• Rate limiting and security monitoring

9. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Request data portability
• Withdraw consent where applicable

To exercise your rights, contact: [email protected]

Where we process personal data within Customer Content on behalf of a customer, data subjects should contact the relevant customer directly. If we receive such a request, we will notify the relevant customer as required by law.

If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO). If you are in the European Economic Area, you may complain to your local supervisory authority.

10. Children

The Service is not intended for children under 13 (or under 16 where required by applicable law). We do not knowingly collect personal data from children.

11. Changes

We may update this Privacy Policy from time to time. Updated versions will be posted on our website.

12. Contact