Endler Privacy Policy

1. Important information and who we are

This privacy policy explains how The AI Building Lab CO Limited, trading as Endler, collects and uses your personal data when you use Endler: the app, your connected WhatsApp account, and your connected calendars.

Endler is for your own personal use. We act as the controller of your personal data throughout. Unlike some privacy policies you may have seen, there is no separate business customer on whose behalf we process your data.

Endler is not intended for children. You must be at least 18 to use Endler (see our Terms of Use), and we do not knowingly collect personal data from anyone under 18.

Where this policy refers to "Third Party Providers", we mean the companies that supply the services Endler is built on, such as cloud hosting, AI processing, sign-in, and network providers.

Controller

The AI Building Lab CO Limited, trading as Endler (a company in the process of being incorporated in England and Wales), registered office 4 Queens Road, London SW19 8ND, is the data controller responsible for your personal data ("Endler", "we", "us", or "our" in this policy).

If you have any questions about this policy, or want to exercise any of your rights, contact us at legal@endler.io, with your email subject prefixed "Privacy Policy".

2. The personal data we collect

We group the personal data we collect as follows.

Account data. When you sign up, we collect your first name, surname, email address, phone number, and locale/home time zone. We ask for your date of birth to confirm you are old enough to use Endler.

Message data. Endler connects to your own WhatsApp account, with your permission, to read your messages and detect plans. We process the text content of your WhatsApp messages (we never access photos, voice notes, or other media). We collect identifiers and display names of people you message with. We also collect technical session data to keep your connection alive.

Endler only ever reads your WhatsApp messages. It never sends messages, posts, or takes any action on WhatsApp on your behalf.

Google Calendar data. If you connect Google Calendar, we collect your Google account identifier and email address, and the access tokens needed to manage your calendar events. Our product uses it to read, create, update and delete events. We also track the events we have created on Google (titles, times, location and description).

Apple Calendar data. If you connect Apple Calendar, we collect your Apple Account email address, an app-specific password that you generate for Endler, and the location and name of the calendar you choose for Endler to write to. Our product uses it to read, create, update and delete events. We also track the events we have created on Apple Calendar (titles, times, location and description).

Device and notification data. If you enable push notifications, we store a device identifier and the technical subscription details your browser gives us so we can send you notifications.

Technical data. Like any web service, our servers process technical information such as your IP address as part of normal operation and security (for example, in server logs).

Other people's information. If your WhatsApp messages or calendar events mention or involve other people (for example, "dinner with Sarah"), we will process the personal data of those people too, such as their name, as part of detecting and creating your plans. We only do this because you have asked Endler to read your own messages; we do not have a direct relationship with those individuals, and we do not use their information for any purpose beyond helping you.

3. How we use your personal data

Legal basis

We rely on one or more of the following legal bases to use your personal data:

• Performance of a contract: to provide you with the Endler service you have signed up for.
• Legitimate interests: where it is necessary to run and secure our business, and we have judged this does not unfairly affect your rights.
• Legal obligation: where we must use your data to comply with the law.
• Consent: where we have asked for, and you have given, your specific agreement, for example to send you certain notifications.

Purposes

4. How Endler uses AI to process your messages

Detecting plans from your messages is Endler's core feature, and it relies on AI (large language models) to read message text and work out what is being planned.

We run our own private inference servers, and that is where your messages are processed. During times of peak load we offload to Third Party Providers. They must adhere to strict non-retention and no-training policies.

Only message text is used for this processing.

5. International transfers

We host Endler's core infrastructure in the United Kingdom. Some of the Third Party Providers we work with are based outside the UK, or operate infrastructure outside the UK, including in the United States, and may process your data there as part of providing their services to us. Where this happens, we put appropriate legal safeguards in place, such as the UK's International Data Transfer Agreement or Standard Contractual Clauses, to protect your data to a standard equivalent to UK law.

6. How long we keep your data

We keep your personal data only for as long as we need it. Account data lasts as long as your account, and connection data lasts as long as that connection. Messages are kept as a rolling window of the most recent messages in each conversation and are deleted automatically as newer ones arrive, except that we keep some messages for longer where we need them for the purposes described in this policy. We may keep some data for longer where the law requires it, or to establish, exercise or defend a legal claim.

7. Your rights, and how to exercise them

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data (see the table in section 3 for details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
  • If you want us to establish the data's accuracy;
  • Where our use of the data is unlawful but you do not want us to erase it;
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please contact us at legal@endler.io, with your email subject prefixed "Privacy Policy".

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would appreciate the chance to address your concern directly first, so please contact us before you do.

8. Cookies and similar technologies

Endler uses one essential cookie to keep you signed in. We do not use this or any other cookie for advertising, analytics, or tracking, so we do not need your consent for it.

We also store a small amount of information on your device for when you are offline; this stays on your device.

9. Keeping this policy up to date

We may update this policy from time to time. Please check back to see the current version. This one was last updated on 6 September 2026.

10. Contact us

legal@endler.io