Privacy
Last updated: May 2, 2026
endless (“we”, “us”) builds websites and sets up AI lead follow-up automation for small businesses. This page explains what information we collect, how we use it, and the choices you have. We try to keep it short and plain. If anything is unclear, email us at privacy@endlessreplies.com.
Information we collect
- Account & contact. Your name, business name, email, and phone when you purchase or book a call.
- Billing.Order details and last-four card digits via Stripe. We never store full card numbers — Stripe handles that as a PCI-DSS Level 1 processor.
- Website content. Text, images, logos, and brand assets you supply for us to build your site.
- Lead & conversation data. If you buy AI follow-up, the messages your leads send you and the replies we draft. Used solely to run the automation you paid for.
- Usage data. Server logs (IP, user agent, timestamps) for security and debugging, plus aggregate page-view metrics from Vercel Analytics. The marketing site does not set tracking cookies.
- Communications. Emails you send us, demo bookings via Cal.com, and waitlist signups.
How we use it
- To deliver what you bought: build your website, set up the follow-up automation, and reply on your behalf when new leads land.
- To bill you and prevent fraud.
- To send transactional email (receipts, delivery updates, changes you need to know about).
- To improve endless in aggregate — never to build profiles on individual users.
- To meet legal obligations and respond to lawful requests.
AI and model training
We do not use your data to train AI models. When we generate a reply to a lead on your behalf, we send the relevant message text and your brand voice samples to our model provider under a zero-retention agreement: the provider does not log inputs or outputs and does not use them to train their models. Your data is processed only to return the draft reply.
Service providers
We share data with the third parties below, only to the extent each needs to do its job:
- Stripe — payment processing.
- Twilio (or similar) — SMS delivery for follow-up messages.
- Anthropic — AI model provider (zero-retention).
- Vercel — application hosting and privacy-friendly analytics.
- Cloudflare — DNS and email routing.
- Cal.com — call booking.
We do not sell your data, and we do not share it with advertisers.
Data retention
Once your website is delivered, we retain the source files and content for as long as you may need us for revisions (typically 12 months). For AI follow-up, we retain lead conversation data while the automation is active on your account. On written request, we delete workspace data within 30 days. Account and billing records are kept for up to 7 years to meet tax and accounting requirements.
Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Internal access is restricted by role and reviewed periodically. Production secrets are stored in a secret manager, never in source control. No system is perfectly secure — if we ever discover a breach affecting your data, we will notify you without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal information, and to withdraw consent. To exercise any of these rights, email privacy@endlessreplies.com. We respond within 30 days.
International transfers
Our infrastructure runs in the United States. If you use endless from outside the US, your data will be transferred to and processed there under appropriate safeguards (such as Standard Contractual Clauses where required).
Children
endless is a B2B service and is not directed to anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
If we make a material change, we’ll email you at least 30 days before it takes effect. The “Last updated” date above always reflects the current version.
Contact
Questions, requests, or anything else: privacy@endlessreplies.com.