Last updated: September 28, 2026
To run the marketplace (payments, escrow, shipping, disputes), keep it safe (fraud detection, malware scanning, moderation), personalize your feed and the ads you see on Endo, comply with tax and legal obligations, and communicate with you about your account and transactions.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by the California Privacy Rights Act. We collect no biometric information. Ad targeting happens on our platform using our data, advertisers pick audiences (like "Sur-Ron owners") and never receive your identity, garage, or search history.
We share data only with service providers who need it to operate the service, and we name every one of them: Stripe (payments, escrow and payouts), EasyPost and the carriers you pick (shipping labels and tracking), Twilio (SMS verification) and Resend (transactional email), Fly.io and Cloudflare (hosting, storage and network security), Google Analytics 4 and PostHog (product analytics, with session recording turned off, so your screen and keystrokes are never recorded), Google Firebase Cloud Messaging (push notifications), Komoot Photon (address lookup when you type in the location picker), and the USGS National Map (the topographic map tiles behind listing maps). It also goes to the counterparty to your transaction (e.g., your shipping address goes to the seller's label), and where required by law or to prevent harm. We cooperate with law enforcement on stolen-goods investigations.
We keep each category of data only as long as needed for the purpose we collected it: account data while your account is active, transaction and dispute records for the period tax and payments law requires (typically 7 years), security logs up to 24 months, and chat for the life of the related deal plus the dispute window. When you delete your account we delete or de-identify your personal information except records the law requires us to keep. We use encryption in transit, hashed credentials, access controls, and audit logging. If a breach affects your personal information we will notify you and regulators as the law requires. No system is perfectly secure, report concerns to security@endo.market.
Depending on your state (including California under the CCPA/CPRA, plus Colorado, Connecticut, Virginia, Utah, and others) you have the right to: know what personal information we have collected about you and receive a copy in a portable format; correct inaccurate information; delete your information; opt out of ads personalization (in account settings) and of any sale or sharing of personal information (we do neither); and limit the use of sensitive personal information (we use your phone number and approximate location only to run the service, never to profile you).
To exercise any right, email privacy@endo.market or use the in-app tools (account settings has ads personalization and Delete account). We verify requests against your verified email or phone, respond within 45 days, and never discriminate for exercising your rights. An authorized agent may submit a request on your behalf with proof of authorization. If we deny a request you may appeal by replying to our decision, and we answer appeals within 45 days; California residents may also contact the California Privacy Protection Agency.
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, your province's private-sector privacy law govern how we handle your personal information. Endo Market is not offered in Quebec. We collect, use and share personal information only for the purposes described in this policy, with your consent or as the law otherwise allows, and we keep it only as long as those purposes require.
Cross-border processing. Endo Market is operated from California. Your personal information is stored and processed in the United States by Endo Powersports LLC and the service providers named in this policy (payments, shipping, messaging, hosting, analytics), and is subject to US law, including lawful access requests by US authorities, while it is there. By using the service from Canada you consent to this transfer.
Your rights. You may ask what personal information we hold about you, ask for access to it, and ask us to correct it. You may withdraw consent for optional uses (ads personalization, marketing email) in Settings or by email, subject to legal and contractual restrictions; withdrawing consent for information we need to run your account or complete an order means we may not be able to provide that service. We respond within 30 days and tell you if we need longer.
Privacy officer. Our privacy officer is responsible for our compliance and can be reached at privacy@endo.market. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada.
We use essential cookies and browser storage for sign-in, security, and remembering trusted devices. For product analytics we use two service providers: Google Analytics 4 and PostHog (US cloud). Optional product analytics stay off until you explicitly enable them in Privacy choices, available in Settings and About and legal. You can withdraw consent there at any time; withdrawal stops future optional analytics events. The choice is saved for this browser or device, separately from marketing email preferences. To make search and alerts understand misspellings and nicknames, search queries and the text of new listings may be processed by Anthropic (Claude API, US). Anthropic returns the interpretation and does not use this data to train its models. They set their own cookies and receive usage data such as pages viewed, searches run, buttons and links you interact with, device type, and approximate location derived from your IP address. Google Analytics runs in measurement-only mode: IP addresses are anonymized, and Google Signals and ads personalization are both switched off, so what you do here is not used to target advertising to you on other sites. PostHog builds a person profile only for signed-in accounts, not for anonymous visitors. Neither provider is an advertising network, and we use no cross-site tracking pixels. If your browser sends a Global Privacy Control or Do Not Track signal, neither one loads at all, no analytics cookie is set and no data is sent. To keep bots from creating accounts, the sign-up form runs Cloudflare Turnstile, a bot check that looks at browser and device signals under Cloudflare's privacy policy. It is not an advertising service and it does not load if you never open the sign-up form.
Photo files can include embedded location information. Remove private GPS and other EXIF metadata before uploading.
Your browsing location helps calculate nearby results. Listing maps use approximate area coordinates, not the delivery address. City and country searches are sent to Komoot Photon; identifying a selected map area sends rounded coordinates to that service. Map tiles come from OpenStreetMap, which receives the map area requested and normal network information such as your IP address and browser details. We do not include your Endo account ID in these map or search requests. Avoid entering private information into city search. These services have their own privacy policies and availability limits.
We send transactional texts only: verification codes and security alerts to your verified phone. We do not send marketing texts. Message and data rates may apply. Account and transaction emails are part of the service; any marketing email will include a working unsubscribe link and we honor opt-outs promptly.
Endo is for adults 18+. We do not knowingly collect data from minors; suspected underage accounts are removed and their data deleted.
The service is operated from California and directed to users in the United States and Canada (excluding Quebec). Material changes will be announced in-app or by email, with the date above updated. AI use: Endo uses automated and AI-assisted systems for content moderation, pricing estimates (Endo Book) and first-pass dispute triage. To keep the market safe, the text and photos of listings, photos, messages, reviews and dispute evidence are screened by Anthropic (Claude API, US), which does not use this data to train its models. Message text may also be scored by TypeSafe (Jev classifier, US) while we evaluate a second moderation check; its scores do not act on anyone. Consequential decisions, account bans and dispute outcomes, get human review. Contact: privacy@endo.market ยท Endo Powersports LLC (California).