This policy describes how Endolum GmbH processes personal data on the marketing website at endolum.io and the legal basis for that processing. It complies with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR). Each Endolum product (Sentinel, Hacked, Academy) ships with its own privacy policy that covers the data processed inside that product.
Endolum GmbH, Oberdorfstrasse 8, 8853 Lachen SZ, Switzerland. Commercial register UID CHE-297.991.738. Contact: contact@endolum.io.
The contact and partner application forms collect the name, email address, subject, and message you submit, plus optional fields where the form asks for them (company name, expected client volume). The data is used to reply to your message and is retained for as long as the conversation is active, plus a reasonable archival period for follow up.
Routine access logging is disabled. Failed requests and requests taking at least 5 seconds can create an operational record containing the route pattern, method, status, duration, request identifier, and timestamp. It does not contain the raw URL, IP address, or user agent. Application logs are kept for up to 7 days and are used to diagnose errors and protect the service. Request identifiers can connect these logs to the corresponding technical request record.
We record website request paths, methods, response codes, time to response headers, timestamps, request identifiers, country, referrer hostnames, and supplied user agents in our own Business software. These records help us find errors, slow routes, missing pages, crawler activity, and automated probes. Client categories are inferred from supplied user agents and can be spoofed. The IP address is used only for a local country lookup and is then discarded. No IP address, query string, fragment, cookie, or persistent visitor identifier is stored in these records. Health checks, analytics submissions, and requests carrying Global Privacy Control or Do Not Track signals are excluded. Technical request records are retained for 90 days.
Endolum measures site usage in its own Business software. Each record can contain the page path, site language, browser locale and time zone, country, external referrer host, traffic category, campaign tags, full user agent, browser family, operating system family, device class, viewport size range, visible engagement time, maximum scroll depth, and the type of a successfully submitted form. The country is resolved from the request IP address against a database held on our server. The address is discarded after this lookup and is neither stored in analytics nor sent to the database provider. A VPN or proxy can cause the recorded country to represent its exit address.
The analytics record contains no IP address, cookie, persistent visitor identifier, query string, or fragment. A random page event identifier attaches engagement and a form result to the same page load. A separate random visit identifier connects pages opened in 1 browser tab within 30 minutes. It is kept in session storage, expires after 30 minutes without activity, and cannot connect a later visit or another tab. Global Privacy Control and Do Not Track signals disable this measurement. The records are stored with the rest of our Business data in Germany and are used to understand site usage.
The site uses strictly necessary storage for operation and abuse prevention. Page view analytics keeps its random visit identifier and last activity time in session storage. It uses an advertising attribution cookie only after you grant advertising consent.
| Cookie | Type | Purpose |
|---|---|---|
| First party session and CSRF cookies | Strictly necessary | Set when you submit a form (contact, partner application). Maintain the form session and prevent cross site request forgery. Cleared at the end of the session. |
Google reCAPTCHA cookies (_GRECAPTCHA and similar) |
Strictly necessary | Set by Google reCAPTCHA on form pages to distinguish humans from bots and stop abuse. Loaded under legitimate interest in network security. See section 3 for the third party detail. |
Analytics visit session (endolum_analytics_visit in session storage) |
Aggregate measurement | Connects page views opened in 1 browser tab within 30 minutes. It contains a random identifier and last activity time, then disappears when the tab closes. |
Website appearance (endolum_website_theme in localStorage) |
Display preference | Stores your chosen light or dark mode in this browser after you use the theme switch. It contains only the theme name, stays until you clear website data, and is not sent to our servers. |
Consent record (endolum_consent_v1 in localStorage) |
Strictly necessary | Stores your cookie preference so the banner does not reappear on every page. Created only after you make a choice. |
Advertising attribution (endolum_attribution) |
Advertising, consent required | Set only after you grant advertising consent. Stores a Google Ads click identifier or OpenAI Ads referral identifier, campaign tags, landing path, referrer, and first visit time. It is sent through registration and checkout so a completed purchase can be attributed to an ad. Lifetime is 90 days. |
OpenAI Ads identifiers (__oppref, __obref) |
Advertising, consent required | Set by the OpenAI Measurement Pixel only after you grant advertising consent. Stores the OpenAI ad referral and browser references for conversion attribution. Revoking consent removes them. |
The marketing site loads the third party assets listed below.
| Service | Provider | Reason |
|---|---|---|
| Google Ads | Google Ireland Limited | Used to measure advertising performance. After you grant advertising consent, a Google click identifier can be stored and sent with a completed purchase. No Google Analytics script is used. Data may be transferred to Google LLC in the United States. Google Privacy Policy. |
| OpenAI Ads | OpenAI Ireland Ltd. | Used to measure which OpenAI ad led to a completed purchase. The OpenAI Measurement Pixel loads only after you grant advertising consent and stores its referral identifier in a first party cookie. After payment, the referral identifier is sent with the product, currency, net purchase value, and a stable order identifier. We do not provide the Pixel with the buyer's name, email address, or another customer identifier. OpenAI Privacy Policy. |
| Google reCAPTCHA | Google Ireland Limited | Used on the contact and application forms to defend against automated abuse. Treated as strictly necessary because it is a security control. Google receives the IP address, user agent, and a behaviour signal that helps decide whether to challenge the request. Google Privacy Policy. |
| Google Fonts | Google Ireland Limited | Loads the Inter Tight and JetBrains Mono webfonts from Google's CDN. The request reveals your IP address and user agent to Google. Google does not set cookies through this delivery path. |
| Cal.com booking | Cal.com | Used when you click through to book a partner call. The booking page is hosted by Cal.com. We do not embed the booking widget inline on this site. |
You can withdraw or change your advertising consent at any time through the Cookie preferences link in the footer.
| Purpose | Legal basis |
|---|---|
| Replying to messages submitted through the contact form | Pre contractual measures and legitimate interest |
| Responding to partner program applications | Pre contractual measures |
| Operational logging, security, and abuse prevention (including reCAPTCHA) | Legitimate interest |
| Limited page view analytics operated by Endolum | Legitimate interest in understanding site usage, with no stored IP address or persistent visitor identifier |
| Advertising performance measurement through Google Ads and OpenAI Ads | Consent (granted through the cookie banner, can be withdrawn at any time) |
| Compliance with statutory retention obligations | Legal obligation |
The marketing site and Endolum page view records are hosted in Germany within the EU/EEA. Google Ads and Google reCAPTCHA are operated by Google Ireland Limited, with Google LLC in the United States as a sub processor. OpenAI Ads conversion data for Swiss users is processed by OpenAI Ireland Ltd. and may be processed by OpenAI affiliates or sub processors outside Switzerland or the EEA. These onward transfers use applicable adequacy decisions or standard contractual clauses. Where another provider processes data outside Switzerland or the EEA, we rely on an adequacy decision, standard contractual clauses, or your explicit consent for the specific transfer.
The Endolum products use additional sub processors that may receive data outside the EU/EEA, including Anthropic in the United States for AI assisted report generation inside Sentinel. The product specific privacy notices linked in section 9 describe these transfers in detail, and the complete list is published at endolum.io/sub-processors.
Under the revFADP and, where it applies, the GDPR, you have the right to:
To exercise any of these rights, contact contact@endolum.io. We respond within 30 days.
If you believe your data protection rights have been violated, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland. If the GDPR applies to your situation, you may also lodge a complaint with a supervisory authority in the EU or EEA.
Each Endolum product publishes its own privacy notice that covers the data processed inside the product:
The full list of sub processors used across all Endolum products and the marketing site is maintained at endolum.io/sub-processors.
We may update this policy from time to time. The version date is shown at the top of the page. Material changes are reflected in the date and the changed sections.
For privacy related questions or requests, write to contact@endolum.io or to Endolum GmbH, Oberdorfstrasse 8, 8853 Lachen SZ, Switzerland.