Skip to main content
Platform Review
PricingSign in
← All platforms
Developer / Coding · endorlabs.com

Endor Labs

Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.

Overall riskHIGHReviewed 2026-08-31
Creator: medium · GRC: high · Counsel: medium
creator band
Severe
enterprise · Caution
Dealbreaker · Third-party sublicensing
Exhibit A · Terms of Service · verbatim

No rights or licenses are granted except as expressly set forth herein. Company shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the SaaS Services any suggestions, enhancement requests, recommendations or other feedback provided by Customer relating to the operation of the SaaS

cited by the third-party sublicensing dealbreaker — tap for the citation
79 verified findings13 policy surfaces2/2 core docs verified
Risk triage

Watch: audit rights dpa residency

Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.

0
high
32
medium
30
low
2/2
docs
Trains on your data?
Training possible — conditions or opt-outs apply
from 1 cited finding
Who owns outputs?
You own your outputs
from 1 cited finding
Commercial use?
Commercial use allowed
from 3 cited findings
Every rating:verbatim-citedsnapshot-datedchange-loggedHow we keep ratings honest →
Risk by role
Select a role to tailor the summary and reorder the findings below.

Scores derived from 33 enriched findings — same verbatim citations as below. AI-generated, not legal advice.

What this means for you
  • Endor Labs's training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
  • Output ownership has conditions — review the commercial use and license carve-outs before building on these outputs.
  • Data handling is conditional — 7 privacy or retention clauses warrant review before using Endor Labs at scale.

Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.

How to read this page: Overall risk rates what Endor Labs's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.

Creator lens
Your prompts, your outputs, your IP
SEVERE
Dealbreaker — Third-party sublicensing. Rights in your content can be passed on to third parties beyond service operation. see the clause

Based on 118 verified, verbatim-cited findings below — read the citations.

Enterprise lens
Data use, retention, subprocessors, audit
CAUTION
Dealbreaker — Third-party sublicensing. Rights in your content can be passed on to third parties beyond service operation. see the clause

Based on 142 verified, verbatim-cited findings below — read the citations.

Automated assessment against a published rubric — not legal advice.

Fully verifiedDeveloper / Coding

Fully verified — complete core corpus captured and read in full.

Document status
  • Privacy Policy
    Verified - read in full - 50 citationsstaticLast captured 2026-08-31
  • Terms of Service
    Verified - read in full - 29 citationsstaticLast captured 2026-08-31
Tier conditions

Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.

plan language
Prompt / input ownership

Establishes the procedure for legally compelled disclosure of Proprietary Information, requiring prior notice to the Disclosing Party and reasonable assistance in contesting disclosure, and allocating cost reimbursement obligations where the Disclosing Party does not contest the disclosure.

"If the Receiving Party is compelled by law to disclose Proprietary Information of the Disclosing Party, it shall provide the Disclosing Party with prior notice of such compelled disclosure (to the extent legally permitted) and reasonable as..."
plan language
Prompt / input ownership

Obligates the Company to use commercially reasonable efforts to provide SaaS Services and technical support during standard business hours; grants Customer a conditional right to use the services upon registration, and reserves Company's right to refuse or cancel inappropriate passwords.

" 1.1 SaaS Services . Subject to the terms of this Agreement, Company will use commercially reasonable efforts to provide Customer the SaaS Services. As part of the registration process, Customer will identify at least one administrative use..."
plan language
Training on your content

Grants Company the permission to use Customer's data to enhance the SaaS Services and for development, diagnostic, and corrective purposes, and to disclose such data in aggregate or de-identified form in connection with its business, establishing a data use right over Customer-provided information.

" enhance the SaaS Services and for other development, diagnostic and corrective purposes in connection with the SaaS Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connec..."
plan language
Commercial use

Imposes an obligation on the Company to use commercially reasonable efforts to provide the SaaS Services and reasonable technical support during standard business hours; also imposes an obligation on the Customer to establish administrative credentials, and reserves the Company's right to refuse or cancel passwords it deems inappropriate.

" 1.1 SaaS Services . Subject to the terms of this Agreement, Company will use commercially reasonable efforts to provide Customer the SaaS Services. As part of the registration process, Customer will identify at least one administrative use..."
plan language
Privacy & data use

Defines the user as a direct source of personal data collection through account creation, interactive tool use, free-form text boxes, surveys, and direct email contact, establishing the scope of user-provided data collection.

" We collect Personal Data about you from the following categories of sources: You When you provide such information directly to us. When you create an account or use our interactive tools and Services. When you voluntarily provide informa..."
📍 Privacy Policy › “Categories of Sources of Personal Data”Jump to exact text →
plan language
Privacy & data use

Identifies government public records as a category of source from which personal data is collected, defining the scope of third-party sourced data collection practices.

" Public Records From the government or other sources."
📍 Privacy Policy › “Categories of Sources of Personal Data”Jump to exact text →
plan language
Privacy & data use

This segment identifies payment data as a category of personal data processed on the basis of contractual necessity under GDPR, functioning as a definitional enumeration of data categories tied to a specific lawful processing ground.

" The “Our Commercial or Business Purposes for Collecting Personal Data” section above explains how we use your Personal Data. We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing inclu..."
📍 Privacy Policy › “Personal Data Use and Processing Grounds”Jump to exact text →
plan language
Privacy & data use

Grants the company permission to collect, use, and disclose all categories of personal data for legal compliance purposes, including fulfilling legal obligations, preventing illegal activities, protecting rights and safety, enforcing agreements, and responding to claims, with disclosure extending to government and law enforcement.

" In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms inclu..."
📍 Privacy Policy › “Other Permitted Purposes for Processing Personal Data”Jump to exact text →

Evidence appendix

Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.

High - 0
Medium - 32
Tier-specific - 1
Total citations - 79
Severity
Surface
Document
Tier
Tier differences
free planCautionHigh
"The free trial shall commence upon the activation of the Customer's account and shall continue for the duration specified by the Company (including on the Order Form). Upon expiration of the free trial period, unless otherwise agreed upon by the parties, Customer's access to the SaaS Services will be terminated unless Customer and Company enter into an Order Form to subscribe to a paid plan. Notwithstanding anything else, the Company reserves the right to modify or terminate the free trial at any time without prior notice.  Company’s obligations under Section 1.2, the first sentence of Section 2.1, and Section 3.1 of this Agreement will not apply during any free trial period.  ‍ "
Source: Terms of Service- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Establishes the procedure governing free trial commencement, duration, and termination; restricts Customer's continued access upon trial expiration unless a paid Order Form is executed, and reserves Company's right to modify or terminate the free trial without notice, creating a tier distinction between trial and paid access.

AI-generated interpretation, not legal advice.

Training on your content
CautionHigh
" enhance the SaaS Services and for other development, diagnostic and corrective purposes in connection with the SaaS Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its business. "
Source: Terms of Service- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Grants Company the permission to use Customer's data to enhance the SaaS Services and for development, diagnostic, and corrective purposes, and to disclose such data in aggregate or de-identified form in connection with its business, establishing a data use right over Customer-provided information.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" At Endor Labs Inc. (the “Company,” “us,” “we,” or “our”), we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Site, Saas Services, or other products or services (collectively, the “Services”) in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and disclose your information as described in this Privacy Policy.   Remember that your use of our Services is at all times subject to our Product Terms of Use and our Website Terms of Use (together, the “Terms of Use”), which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use.  As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. We will alert you of material changes by placing a notice on our Site, by sending you an email and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes."
Privacy Policy › “April 9, 2024”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment introduces the Privacy Policy, defines the covered entities ('Company,' 'us,' 'we,' 'our'), identifies the scope of services, and establishes user consent to collection, use, and disclosure of personal data as described in the policy. It also incorporates by reference the Product Terms of Use and Website Terms of Use, creating a binding obligation on the user and on the company regarding data handling practices.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data– usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s).  Please note that because of our use of Cookies, the Services do not support “Do Not Track” requests sent from a browser at this time. We use the following types of Cookies: Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable. Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region). "
Privacy Policy › “Tracking Tools, Advertising, and Opt-Out”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment discloses the platform's use of cookies and similar tracking technologies to collect user browser, visit, and usage data, and supplements that data with third-party information, establishing the scope of data collection practices and the platform's obligation to inform users of these practices.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" We may use session replay technology in order to identify and resolve customer issues, to monitor and analyze how you use our Services, to better understand user behavior, and to improve our Services. By continuing to use the Services, you consent to the use of session replay technology. If you would like to change your settings with respect to session replay technology, you can access your Cookie management settings by clicking [LINK]."
Privacy Policy › “Session Replay Technology”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment grants the platform permission to use session replay technology for issue resolution, usage monitoring, and service improvement, and deems continued use of the services as user consent to this data collection, while providing a procedure for opting out via cookie settings.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages visitors view on our Services and how long visitors are viewing pages on the Services. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Services’ content for those who engage with our advertising. For example, Google LLC (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and disclose information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google’s use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/. Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information about this, please see the section below titled “Information about Interest-Based Advertisements.” You can decide whether or not to accept Cookies through your internet browser’s settings. "
Privacy Policy › “Tracking Tools, Advertising, and Opt-Out”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment describes the use of performance and analytical cookies, including third-party services like Google Analytics, to collect data on visitor behavior and advertising campaign performance, informing users of specific data collection and sharing practices with analytics subprocessors.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" Marketing the Services Marketing and selling the Services. Showing you advertisements, including interest-based, online behavioral or targeted advertising."
Privacy Policy › “Our Commercial or Business Purposes for Collecting Personal Data”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Grants the platform permission to use personal data for marketing, selling services, and delivering interest-based and behavioral advertising, establishing a lawful commercial basis for targeted advertising data use.

AI-generated interpretation, not legal advice.

Moderation & enforcement
CautionHigh
" 4.1 Fees . Customer will pay Company the then applicable fees described in the Order Form for the SaaS Services in accordance with the terms therein (the “ Fees ”). On a quarterly basis, Company will perform an audit to determine if Customer is in compliance with the license usage limits of this Order. Upon completion of an audit, Company will notify Customer of any additional licenses that need to be purchased to bring the license usage into compliance. Any such additional licenses will be billed as of the audit date, co-terminus with and incorporated into the Order Form, and charged at a pro-rated amount based on a 10% premium on the annual per unit extended price of the Order Form. ‍ Company reserves the right to change the Fees or applicable charges and to institute new charges and Fees at the end of the Initial Service Term or then-current renewal term, upon thirty (30) days prior notice to Customer (which may be sent by email). If Customer believes that Company has billed Customer incorrectly, Customer must contact Company no later than 60 days after the closing date on the first billing statement in which the error or problem appeared, in order to receive an adjustment or credit. Inquiries should be directed to Company’s customer support department.  All fees under this Agreement are nonrefundable except as otherwise set forth herein. 4.2 Payment Terms . Company may choose to bill through an invoice, in which case, full payment for invoices issued in any given month must be received by Company thirty (30) days after the mailing date of the invoice (excluding amounts under reasonable and good faith dispute). "
Source: Terms of Service- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Obligates Customer to pay fees as specified in the Order Form, establishes a quarterly audit procedure for license compliance, and provides that additional licenses identified in audits will be billed retroactively at the audit date and incorporated into the Order Form.

AI-generated interpretation, not legal advice.

Data retention
CautionHigh
" We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally. For example: We retain your profile information and credentials for as long as you have an account with us. We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently."
Privacy Policy › “Data Retention”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment imposes an obligation on the platform to retain personal data only as long as necessary for service provision or business purposes, and specifies criteria for determining retention periods, while permitting longer retention for legal compliance, dispute resolution, fee collection, or applicable law requirements.

AI-generated interpretation, not legal advice.

Confidentiality
CautionHigh
"No rights or licenses are granted except as expressly set forth herein. Company shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the SaaS Services any suggestions, enhancement requests, recommendations or other feedback provided by Customer relating to the operation of the SaaS Services. 3.4 Publicity . Customer agrees that Company has the right to reveal the fact that Customer is using the SaaS Services, including by displaying Customer’s name and logo in Company’s website and other marketing materials. ‍ "
Source: Terms of Service- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Grants Company a royalty-free, worldwide, transferable, sublicensable, irrevocable, perpetual license to use or incorporate Customer feedback into the SaaS Services; also grants Company the right to publicize Customer's use of the services including displaying Customer's name and logo in marketing materials.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, the Company, or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes. We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent. "
Privacy Policy › “Other Permitted Purposes for Processing Personal Data”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Permits collection, use, and disclosure of all categories of personal data to government and law enforcement bodies to fulfill legal obligations, enforce agreements, protect rights and safety, and respond to legal claims, establishing a lawful basis for compliance-driven data processing and disclosure.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.  "
Privacy Policy › “Data that is Not Personal Data”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment grants the platform permission to create aggregated, de-identified, or anonymized data from personal data and to use and disclose such data for business purposes including analyzing, building, and improving services, which constitutes a permitted use of user-derived data for platform development and commercial purposes.

AI-generated interpretation, not legal advice.

Prompt / input ownership
High
"If the Receiving Party is compelled by law to disclose Proprietary Information of the Disclosing Party, it shall provide the Disclosing Party with prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at Disclosing Party’s cost, if the Disclosing Party wishes to contest the disclosure. If the Receiving Party is compelled by law to disclose the Disclosing Party’s Proprietary Information as part of a civil proceeding to which the Disclosing Party is a party, and the Disclosing Party is not contesting the disclosure, the Disclosing Party will reimburse the Receiving Party for its reasonable cost of compiling and providing secure access to such Proprietary Information. 3.2 Proprietary Rights . Customer shall own all right, title and interest in and to the Customer Data. Company shall own and retain all right, title and interest in and to (a) the SaaS Services and Software, all improvements, enhancements or modifications thereto, (b) any software, applications, inventions or other technology developed in connection with any additional services or support, (c) any data that is based on or derived from the Customer Data and provided to Customer as part of the SaaS Services, and (d) all intellectual property rights related to any of the foregoing.    3.3 Service Improvements . Notwithstanding anything to the contrary, Company shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the SaaS Services and related systems and technologies (including, without limitation, information concerning Customer Data and data derived therefrom), and Company will be free (during and after the term hereof) to (i) use such information and data to improve and"
Source: Terms of Service- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Establishes the procedure for legally compelled disclosure of Proprietary Information, requiring prior notice to the Disclosing Party and reasonable assistance in contesting disclosure, and allocating cost reimbursement obligations where the Disclosing Party does not contest the disclosure.

AI-generated interpretation, not legal advice.

Privacy & data use
High
" Legitimate Interest:  We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties: Profile or Contact Data "
Privacy Policy › “Other Identifying Information that You Voluntarily Choose to Provide”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment identifies device and IP data as a category of personal data processed on the basis of legitimate interests under GDPR, functioning as a definitional enumeration of data categories tied to the legitimate interest lawful processing ground.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" When you use the Services and such information is collected automatically. Through Cookies (defined in the “Tracking Tools, Advertising and Opt-Out” section below). If you download our mobile application or use a location-enabled browser, we may receive information about your location and mobile device, as applicable. If you download and install certain applications and software we make available, we may receive and collect information transmitted from your computing device for the purpose of providing you the relevant Services, such as information regarding when you are logged on and available to receive updates or alert notices."
Privacy Policy › “Categories of Sources of Personal Data”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Permits automatic collection of personal data through cookies, location-enabled browsers, and installed applications when users interact with the services, establishing lawful basis for automated and device-based data collection.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" We may also de-identify or anonymize Personal Data to further our legitimate interests.  Examples of these legitimate interests include (as described in more detail above): Providing, customizing and improving the Services. Marketing the Services. Corresponding with you. Meeting legal requirements and enforcing legal terms. Completing corporate transactions. Consent:  In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.  Other Processing Grounds:  From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest."
Privacy Policy › “Other Identifying Information that You Voluntarily Choose to Provide”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Grants the company permission to de-identify or anonymize personal data and process it for legitimate interests including service provision, marketing, legal compliance, and corporate transactions, and establishes consent as a legal basis for certain processing activities.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" Geolocation Data such as IP-address-based location information. "
Privacy Policy › “Parties You Authorize, Access or Authenticate”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

Defines the category of geolocation data (IP-address-based location information) collected, establishing what personal data is subject to collection and processing obligations.

AI-generated interpretation, not legal advice.

Privacy & data use
High
" The “Our Commercial or Business Purposes for Collecting Personal Data” section above explains how we use your Personal Data. We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below. Contractual Necessity:  We process the following categories of Personal Data as a matter of “contractual necessity”, meaning that we need to process the data to perform under our Terms of Use with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data. Profile and Contact Data"
Privacy Policy › “Personal Data Use and Processing Grounds”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-08- View source
Permalink to this finding →
Automated analysis

This segment identifies payment data as a category of personal data processed on the basis of contractual necessity under GDPR, functioning as a definitional enumeration of data categories tied to a specific lawful processing ground.

AI-generated interpretation, not legal advice.

Common questions about Endor Labs's policies

Does Endor Labs train its AI models on your data?
Training possible — conditions or opt-outs apply — based on 1 verified finding from Endor Labs's published policy. Informational only, not legal advice.
Who owns the content you create with Endor Labs?
You own your outputs — based on 1 verified finding from Endor Labs's published policy. Informational only, not legal advice.
Can you use Endor Labs's output commercially?
Commercial use allowed — based on 3 verified findings from Endor Labs's published policy. Informational only, not legal advice.

Clause detail — protections, your obligations, and coverage

Every clause below is a verbatim quote from Endor Labs's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.

✅ Protections found

6 verified clauses

Clauses in Endor Labs's policies that work in your favour — commitments the platform made to you.

  • Data retentiondeletion rights & post-termination survival
    5.1 Term . Subject to earlier termination as provided below, this Agreement is for the Initial Service Term as specified in the Order Form and shall be automatically renewed for additional periods of the same duration as the Initial Service Term (collectively,…

    Defines the Initial Service Term and automatic renewal procedure, establishes 30-day notice requirement for non-renewal, and provides termination for cause rights including immediate termination for nonpayment, governing…

    • Auto-renew cancel window: 30 days before term end
  • Privacy & data use
    You have certain rights with respect to your Personal Data, including those set forth below. If you have any questions about these rights, or would like to submit a request, please email us at privacy@endor.ai . Please note that in some circumstances, we may n…

    Confers data subject rights to EU, UK, and Swiss residents regarding their personal data, establishes the procedure for submitting requests via email, and reserves the company's right to decline requests that are frivolo…

    • Designated security contact: privacy@endor.ai
    📍 Privacy Policy › “EU, UK and Swiss Data Subject Rights”Jump to exact text →
  • Confidentiality
    3.1 Obligations and Exclusions . Each party (the “ Receiving Party ”) understands that the other party (the “ Disclosing Party ”) has disclosed or may disclose business, technical or financial information relating to the Disclosing Party’s business (hereinafte…

    Defines 'Receiving Party', 'Disclosing Party', and 'Proprietary Information', specifying that Company's proprietary information includes non-public SaaS Service details and Customer's includes non-public data provided to…

  • Prompt ownership
    1.1 SaaS Services . Subject to the terms of this Agreement, Company will use commercially reasonable efforts to provide Customer the SaaS Services. As part of the registration process, Customer will identify at least one administrative username and password fo…

    Obligates the Company to use commercially reasonable efforts to provide SaaS Services and technical support during standard business hours; grants Customer a conditional right to use the services upon registration, and r…

  • Privacy & data useads & tracking use
    Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety…

    This segment grants users the right to manage or disable cookies through browser settings, providing a procedure for exercising opt-out preferences while noting that doing so may impair service functionality.

    📍 Privacy Policy › “Tracking Tools, Advertising, and Opt-Out”Jump to exact text →
  • Privacy & data use
    Portability :  You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible. Objection :  You can contact us to let us know that you object to the fu…

    Enumerates specific data subject rights including data portability, objection to processing, restriction of processing, and the right to lodge a complaint with a supervisory authority, creating legally actionable entitle…

    📍 Privacy Policy › “EU, UK and Swiss Data Subject Rights”Jump to exact text →

📋 Rules you must follow

2 verified clauses

What Endor Labs requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.

  • Moderation & enforcementconduct restrictions
    2.1 General Restrictions . Customer shall use commercially reasonable efforts to prevent unauthorized access to or use of the SaaS Services and notify Company promptly of any such unauthorized access or use. Customer shall not, directly or indirectly: reverse…

    Imposes multiple use restrictions on Customer prohibiting reverse engineering, decompilation, modification, creation of derivative works, and unauthorized access to the SaaS Services and Software, and requires Customer t…

  • Commercial useconduct restrictions
    build a similar or competitive product or SaaS Services, (g) disclose any review, benchmarking or comparative study of the SaaS Services or Services Data to any third party without Company’s prior written approval, (h) post, transmit, link to, or otherwise dis…

    Continues the list of use restrictions, explicitly prohibiting Customer from building competitive products, disclosing benchmark results without written approval, distributing unlawful or inappropriate content, and attem…

What the policies actually cover

11 topics
  • Product telemetry & usage tracking6 clauses
  • Advertising & tracking1 protective6 clauses
  • Sensitive data (biometric, location, health)1 clause
  • Government & law-enforcement disclosure1 clause
  • Trains by default, opt-out available1 clause
  • Damages & liability cap2 clauses
  • Indemnity direction2 clauses
  • Terms can change at any time2 clauses
  • Deletion rights & post-termination survival1 protective2 clauses
  • Feedback ownership1 clause
  • Conduct restrictions2 obligations2 clauses

53 further verified clauses are cited on this page but not yet assigned a topic.

Cross-clause notes

Cross-referenceacross documents

Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “Data Retention” addresses how long content is retained, and the Terms of Service, § 3.3 addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.

Cross-referenceacross documents

The Terms of Service, § 3.1 describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “How We Disclose Your Personal Data” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.

Ambiguity — Cautionacross documents

Verified retention clauses point in different directions: the Privacy Policy, Privacy Policy › “Data Retention” describes broad or open-ended retention, while the Terms of Service, § 5.1 describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.

Automated cross-reference against the published rubric — not legal advice.

Clause intelligence

Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.

389
clauses
96
patterns
96
stances
privacy sharing · 67ip license · 17legal burden · 8data retention · 2tier conditionality · 2
data retentionMEDIUMPrivacy Policy › “Data Retention”

The clause allows indefinite, perpetual, or necessity-based retention.

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we...
Open source citation
data retentionMEDIUMPrivacy Policy › “Data Retention”

The clause allows indefinite, perpetual, or necessity-based retention.

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we...
Open source citation
ip licenseHIGH§ 9.3

The clause includes sublicensable, transferable, or assignable rights.

Customer agrees to review the latest version of the Agreement on the Company’s website periodically to remain aware of any non-material modifications to the Agreement about which Customer is not alerted by the Company. The Agreement available on the web site will be dated so as to make clear what version is currently in force. Any use of the SaaS Services after alteration of the Agreement will constitute acceptanc...
Open source citation
ip licenseHIGH§ 9.3

The clause includes sublicensable, transferable, or assignable rights.

Customer agrees to review the latest version of the Agreement on the Company’s website periodically to remain aware of any non-material modifications to the Agreement about which Customer is not alerted by the Company. The Agreement available on the web site will be dated so as to make clear what version is currently in force. Any use of the SaaS Services after alteration of the Agreement will constitute acceptanc...
Open source citation
ip licenseHIGH§ 3.3

The clause includes sublicensable, transferable, or assignable rights.

No rights or licenses are granted except as expressly set forth herein. Company shall have a royalty-free, worldwide, transferable, sublicenseable, irrevocable, perpetual license to use or incorporate into the SaaS Services any suggestions, enhancement requests, recommendations or other feedback provided by Customer relating to the operation of the SaaS Services. 3.4 Publicity . Customer agrees that Company has th...
Open source citation

Tier matrix

Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.

TierSurfaceVerdictRiskCitations
All applicable tierscommercial useworsensHIGH5
All applicable tiersgoverning law disputesworsensHIGH2
All applicable tiersindemnity liabilityconditionalMEDIUM8
All applicable tiersmoderation enforcementworsensHIGH7
All applicable tiersprivacy data useworsensHIGH9
All applicable tierssubprocessors data sharingconditionalMEDIUM4
Freeoutput ownershipworsensHIGH2
Freeprompt ownershipworsensHIGH2
Standardcommercial useconditionalMEDIUM6
Team / Businessdata retentionconditionalMEDIUM2
Team / Businessprivacy data useconditionalMEDIUM2
Team / Businesssubprocessors data sharingconditionalMEDIUM1

Policy evolution

Open full timeline

Before/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.

changedlow materialityJun 17Jul 20, 2026

legal burden changed from medium/liability limited to medium/indemnity.

Before · medium
COMPANY DOES NOT WARRANT THE RESULTS OF USE OF THE SAAS SERVICES, AND CUSTOMER ASSUMES ALL RISK AND RESPONSIBILITY WITH RESPECT THERETO. CUSTOMER SHOULD NOTE THAT IN USING THE SAAS SERVICES, SENSITIVE INFORMATION WILL TRAVEL THROUGH THIRD PARTY INFRASTRUCTURES WHICH ARE NOT UNDER COMPANY’S CONTROL (SUCH AS A THIRD-PARTY SERVERS AND THE INTERNET). COMPANY MAKES NO WARRANTY WITH RESPECT TO THE SECURITY OF SUCH THIRD-PARTY INFRASTRUCTURES. CERTAIN FEATURES OF THE SAAS SERVICES MAY UTILIZE ARTIFICIAL INTELLIGENCE ("AI") COMPONENTS, PRIMARILY FOR ERROR INTERPRETATION AND TROUBLESHOOTING PURPOSES. HOWEVER, ENDOR LABS DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF AI-GENERATED INFORMATION AND THERE MAY BE LIMITATIONS IN THEIR USE CASES AND FUNCTIONALITIES DUE TO FACTORS SUCH AS DATA QUALITY AND TECHNICAL CONSTRAINTS. CUSTOMER IS ADVISED TO INDEPENDENTLY CONFIRM INFORMATION AND CONSULT WITH PROFESSIONALS AS NECESSARY. FURTHER INFORMATION IS SET FORTH IN THE DOCUMENTATION.
Before citation
After · medium
2.2 Compliance with Applicable Laws . Customer represents, covenants, and warrants that Customer will use the SaaS Services only in compliance with applicable laws and regulations. Customer hereby agrees to indemnify and hold harmless Company against any damages, losses, liabilities, settlements and expenses (including without limitation costs and attorneys’ fees) in connection with any claim or action that arises from an alleged violation of this Section 2 or otherwise from Customer’s use of SaaS Services. Although Company has no obligation to monitor Customer’s use of the SaaS Services, Company may do so and may prohibit any use of the SaaS Services it believes may be (or alleged to be) in violation of this Section 2. ‍ 2.3 Third Party Equipment . Customer shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the SaaS Services, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, “ Equipment ”). Customer shall also be responsible for maintaining the security of the Equipment, Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of Customer account or the Equipment with or without Customer’s knowledge or consent. 2.4 Suspension . Company may suspend provision of the SaaS Services if: (i) the SaaS Services are being used in material violation of this Agreement; (ii) suspension of the SaaS Services is necessary to protect Company’s network or Company’s other customers; (iii) the use of the SaaS Services by Customer may expose Company or its affiliates to liability; or (iv) suspension is required by law.
After citation
Aug 31, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at privacy@endor.ai. Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Services do not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com .
Open timeline citation
Aug 31, 2026data sharingHIGH

Latest stance: sale or sell on privacy data use

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties. You can exercise this right by contacting us at privacy@endor.ai with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.
Open timeline citation
Aug 31, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below. Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include: Hosting, technology and communication providers. Security and fraud prevention consultants. Support and customer service vendors. Product fulfillment and delivery providers.
Open timeline citation
Aug 31, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.
Open timeline citation

Capture recency

  • Privacy Policy:Last captured 2026-08-31· verified 2026-08-31
  • Terms of Service:Last captured 2026-08-31· verified 2026-08-31

Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.

↑ 319 more findings this quarter vs last (390 vs 71). First scan: June 2026.

Claim this profile

Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Endor Labs's policies — no human edits the data.

Need this for procurement or legal diligence?

Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.

Every finding above is a verbatim quote from Endor Labs's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.

📢 POLICY UPDATES ALERT

AIRIN Brief

Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.