Privacy Policy

This Privacy Policy explains how Ender Turing OÜ ("Ender Turing", "we", "us") collects, uses, and protects personal information when you visit our website, use our products, or interact with our team.

We're a B2B software company. Our customers are businesses; the personal data we handle falls into two distinct categories — (1) data about visitors and prospects on our website, and (2) data inside our customers' contact-center deployments. These two categories are governed differently. Most of this policy is about category 1.

For data inside customer deployments, we act as a data processor — the customer is the controller. See our Data Security page for the technical details and the standard DPA we sign with every Enterprise customer.

We collect personal data only when there's a clear business reason to. Specifically:

• Contact form & demo requests: name, business email, company name, role, contact-center size, message content. Submitted voluntarily when you fill in our forms.
• Newsletter subscriptions: email address. Submitted voluntarily.
• Calendar bookings: name, email, meeting time, optional notes. Submitted via our scheduling tool (Cal.com).
• Customer accounts: name, email, role, employer, billing details (for paying customers). Required to operate your account.
• Website analytics: aggregated, pseudonymous data about how visitors use our site — pages visited, time on page, referrer, device type. Collected via privacy-respecting analytics tools.
• Cookies: a minimal set of strictly-necessary cookies plus optional analytics cookies you can decline. See Cookies below.

We do not collect: race, ethnicity, religion, political views, sexual orientation, health data, biometric data, or government IDs from website visitors. If a customer chooses to upload such data into their contact-center deployment, our role is governed by the DPA — not this policy.

We use personal data only for the purposes you'd expect, with explicit lawful basis under GDPR:

• Responding to inquiries — to answer the message you sent us, schedule the demo, or process the application. (Lawful basis: legitimate interests / contract.)
• Operating customer accounts — billing, support, and product delivery. (Lawful basis: contract.)
• Sending transactional email — order confirmations, security alerts, service updates. (Lawful basis: contract.)
• Sending our newsletter and product updates — only with your explicit opt-in, and never more than once per month. Unsubscribe with one click. (Lawful basis: consent.)
• Reaching out to business contacts — a few emails to people whose work our product serves; see Business contacts we reach out to below. (Lawful basis: legitimate interests.)
• Improving the website — aggregated analytics to understand which content helps and which doesn't. (Lawful basis: legitimate interests.)
• Compliance & security — fraud prevention, legal obligations, audit trails. (Lawful basis: legal obligation / legitimate interests.)

We do not sell personal data, run behavioural ad networks, or share data with brokers.

Business contacts we reach out to. We may email you at work if your role involves running or buying contact-center, quality-assurance or operations tools, the work our product serves. Here is what that involves:

• What we hold — your name, work email, company and role, where we found your details, and our emails with you. Nothing else.
• Where it comes from — your company's website, professional directories, a business-contact data provider, or our own records from earlier contact with you or your company.
• Why, and on what basis — to offer you something relevant to your job (lawful basis: legitimate interests). We send at most three emails and stop as soon as you reply.
• Who else handles it — our CRM (Attio) and our email-outreach provider, which processes it in the United States under EU Standard Contractual Clauses.
• How long we keep it — 6 months after our last email if you don't reply. If you ask us to stop, we keep only your email address and the date, so we never contact you again.
• Your choice — you can object at any time: reply "stop" to any of our emails or write to privacy@enderturing.com, and we stop the same day. The rights in § 6 apply to you wherever you are, because we are an EU company.

We share personal data with vendors only when necessary to operate the service. Each is bound by a Data Processing Agreement and EU Standard Contractual Clauses where applicable.

Current sub-processors:

• AWS (cloud hosting, EU regions: Frankfurt, Warsaw)
• GCP (cloud hosting, EU regions: Frankfurt — for select workloads)
• Cloudflare (website hosting, DNS, security, Turnstile, and Event Gateway routing)
• Google Analytics 4 and Ahrefs Web Analytics (website measurement and performance analysis)
• Attio (CRM records, attribution, sales follow-up, and lifecycle state)
• Instantly (email outreach to business contacts; processes in the United States under EU Standard Contractual Clauses)
• MillionVerifier (checks that a business email address can receive mail before we write to it; based in Hungary, with verification servers in the EU, the UK, Canada and the United States)
• Cal.com (demo scheduling)
• Webflow (our former website host; still stores contact-form submissions sent before September 18, 2026)
• Resend (requested and permissioned email delivery)
• Google Workspace (email and documents)
• Stripe (payment processing)

The full sub-processor list with descriptions is maintained on the Data Security page. We notify Enterprise customers in advance of any new sub-processor we add to the list that handles their data.

Our cookie footprint is small and split into two clear categories:

• Strictly necessary — session cookies, authentication, CSRF tokens. Required for the site to function. Set without consent.
• Analytics & preferences — used to understand site traffic and remember choices like language. Optional, opt-in only. Decline at any time via the cookie banner.

We do not use third-party advertising cookies, retargeting pixels, or social-media trackers (no Facebook Pixel, no Google Ads pixel, no LinkedIn Insight Tag) unless you've explicitly opted in via a clearly labelled checkbox.

If you're in the EU/EEA, UK, or California (and similar jurisdictions), you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data ("right to be forgotten") in most cases
• Restrict or object to processing
• Receive a portable copy of your data
• Withdraw consent for marketing at any time
• Lodge a complaint with your local data-protection authority

To exercise any of these, email privacy@enderturing.com. We respond within 30 days, faster in most cases. We may ask for proof of identity to protect against fraudulent requests.

We keep personal data only as long as necessary for the purpose it was collected — and no longer. Concretely:

• Inquiry messages — 24 months after last contact, then deleted
• Newsletter subscribers — until you unsubscribe, then 30 days for audit, then deleted
• Business contacts we reached out to — 6 months after our last email if you didn't reply, then deleted; after an objection, only your email address and the date, kept so we never contact you again
• Customer-account data — duration of contract + 6 years for tax / legal compliance
• Conversation data inside customer deployments — controlled by the customer's retention settings, governed by the DPA
• Website analytics — aggregated only, no individual records retained beyond 14 months

By default, all personal data we process stays in the European Union (Frankfurt or Warsaw regions). For Enterprise customers, region selection is contractual.

If we ever need to transfer data outside the EU/EEA — for example, to a US-based sub-processor — we use European Commission Standard Contractual Clauses (SCCs) plus appropriate supplementary measures. We don't transfer customer-conversation data outside the EU without explicit written authorization.

Business-contact data used for outreach (§ 3) is processed in the United States by our email-outreach provider on that basis.

Ender Turing is a B2B product. Our website and services are not directed to anyone under 16. We don't knowingly collect personal data from children. If you believe a child's data has reached us, contact privacy@enderturing.com and we'll delete it.

We update this policy when what we do with personal data changes; the date and version at the top show the current one.

If a change affects personal data we already hold about you (a new purpose, new recipients, a transfer outside the EU, a new controller, or a change to how you can use your rights), we tell you in a message about that change alone: by email where we have your address, otherwise on this site. We do so in good time before it applies, so you can object, and we ask for your consent where the law requires it.

Questions about this policy? Want to exercise a right above? Want a copy of our DPA?

Our Data Protection Officer:

• Email: privacy@enderturing.com
• Postal: Ender Turing OÜ, Kõivu tee 36, 12112 Tallinn, Estonia

If you're not satisfied with our response, you can lodge a complaint with the Estonian Data Protection Inspectorate (or your local supervisory authority in the EU).