Privacy policy

1. Who we are

Endon is the maker of the Endon emotional wellbeing app. We are registered in Greece and act as the data controller for all personal data processed through the App. Contact: customer@endonspace.com. You also have the right to lodge a complaint with the Hellenic Data Protection Authority: www.dpa.gr

2. What data we collect

When you register we collect account information (email, display name, date of birth confirmation, country, language, password). Through use of the app we collect wellbeing content (conversations, journal entries, mood check-ins), usage data (session times, features used), and technical data (device type, OS, app version, IP address retained for max 90 days then anonymised). We do not store your card details.

3. Your emotional data

Conversations, journal entries, and mood data are special category personal data under GDPR Art. 9. We process this data only with your explicit consent, only to provide the Endon service, never for advertising, and never sold to any third party. You can withdraw consent and delete this data at any time.

4. How we use your data

To provide the Endon service (contract); to process emotional wellbeing content (explicit consent Art. 9(2)(a)); for crisis detection (vital interests Art. 9(2)(c)); to personalise your experience (legitimate interests); to improve the app using de-identified data only (legitimate interests); for legal compliance (legal obligation).

5. How long we keep your data

• Conversation content: until you delete it, plus 7 days.
• Mood scores: 2 years.
• Crisis flag records: 5 years.
• Account information: duration of account, plus 30 days.
• Payment records: 7 years (Greek tax law).
• Technical logs: 90 days, then anonymised.
• Anonymised aggregate data: indefinitely.

6. Who we share your data with

We do not sell your data. We share only with: service providers bound by Data Processing Agreements; clinical team for safety reviews (anonymised summaries only); legal authorities when required by law; emergency services where necessary to protect life.

7. International transfers

We primarily store and process your data within the EU/EEA on Supabase servers in Europe (europe-west4). Your data does not routinely leave the EU. Where any transfer is necessary, Standard Contractual Clauses approved by the European Commission are in place.

8. Security measures

• End-to-end encryption on all conversations and journal entries.
• AES-256 encryption at rest.
• TLS 1.3 in transit.
• EU-based servers.
• Row-level security.
• Strict access controls.
• Regular penetration testing.
• Audit logging.
• DPIA completed before launch.

9. Your GDPR rights

Right of access; right to rectification; right to erasure (available directly in the app); right to restriction; right to data portability; right to object; right to withdraw consent; right to complain to the Hellenic Data Protection Authority (www.dpa.gr). Contact: customer@endonspace.com. We respond within one month.

10. Children

Endon is for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. Contact customer@endonspace.com if you believe a person under 18 has provided data.

11. Changes to this policy

We will notify you of material changes through the app with at least 30 days notice before changes take effect.