Last updated: October 15, 2026
Endo Market is operated by Endo Powersports LLC, 1975 Estrella Court, San Luis Obispo, California 93405, United States. This policy covers the Endo Market website and apps. Downloads and browsing are available more broadly than accounts and financial services; privacy rights can apply even where transactions are unavailable. Contact [email protected] for a privacy request, or use [email protected] as an alternative way to reach us.
To run the marketplace (payments, escrow, shipping, disputes), keep it safe (fraud detection, malware scanning, moderation), personalize your feed and the ads you see on Endo, comply with tax and legal obligations, and communicate with you about your account and transactions.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by the California Privacy Rights Act. Payment and seller identity verification may be handled by Stripe under its own privacy notice; do not send identity documents through marketplace chat. Ad targeting happens on our platform using our data, advertisers pick audiences (like "Sur-Ron owners") and never receive your identity, garage, or search history.
Recipients used for the features described here include Stripe (payments, seller verification and payouts), EasyPost and selected carriers (shipping labels and tracking), Apple and Google (sign-in when you choose them), Twilio (SMS verification), Resend (email), Fly.io and Cloudflare (hosting, storage and network security), Google Analytics 4 and PostHog (optional product analytics, with session recording turned off), Google Firebase Cloud Messaging (push notifications), Anthropic and TypeSafe (the AI processing described below), Komoot Photon (place search and reverse geocoding), and OpenStreetMap (map tiles). Providers may have independent legal duties and their own privacy notices. Necessary fulfilment information also goes to the transaction counterparty, such as the address needed for a shipping label. Information may be disclosed where required by law or to prevent harm. We cooperate with lawful stolen-goods investigations.
We keep each category of data only as long as needed for the purpose we collected it: account data while your account is active, transaction and dispute records for the period tax and payments law requires (typically 7 years), security logs up to 24 months, and chat for the life of the related deal plus the dispute window. When you delete your account we delete or de-identify your personal information except records the law requires us to keep. We use encryption in transit, hashed credentials, access controls, and audit logging. If a breach affects your personal information we will notify you and regulators as the law requires. No system is perfectly secure, report concerns to [email protected].
Depending on your state (including California under the CCPA/CPRA, plus Colorado, Connecticut, Virginia, Utah, and others) you have the right to: know what personal information we have collected about you and receive a copy in a portable format; correct inaccurate information; delete your information; opt out of ads personalization (in account settings) and of any sale or sharing of personal information (we do neither); and limit the use of sensitive personal information (we use your phone number and approximate location only to run the service, never to profile you).
To exercise any right, email [email protected] or use the in-app tools (account settings has ads personalization and Delete account). We verify requests against your verified email or phone, respond within 45 days, and never discriminate for exercising your rights. An authorized agent may submit a request on your behalf with proof of authorization. If we deny a request you may appeal by replying to our decision, and we answer appeals within 45 days; California residents may also contact the California Privacy Protection Agency.
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, your province's private-sector privacy law govern how we handle your personal information. Quebec account and transaction access is excluded; this does not remove any privacy rights that apply to browsing information. We collect, use and share personal information only for the purposes described in this policy, with your consent or as the law otherwise allows, and we keep it only as long as those purposes require.
Cross-border processing. Endo Market is operated from California. Information processed in the United States is subject to US law, including lawful authority access. Our map and other service providers may handle requests in other locations under their notices. Endo remains accountable for personal information processed on its behalf under applicable law; use of the service is not a waiver of privacy rights.
Your rights. You may ask what personal information we hold about you, ask for access to it, and ask us to correct it. You may withdraw consent for optional uses (ads personalization, marketing email) in Settings or by email, subject to legal and contractual restrictions; withdrawing consent for information we need to run your account or complete an order means we may not be able to provide that service. For Canadian access requests, we respond within 30 calendar days. A permitted extension requires the notice, reasons and complaint information required by applicable law.
Privacy officer. Our privacy officer is responsible for our compliance and can be reached at [email protected]. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada.
If you are in the European Economic Area, United Kingdom or Switzerland, Endo Powersports LLC is the controller of personal data described in this policy. We process account and transaction data to perform our contract with you; safety, fraud prevention, service security and marketplace improvement for our legitimate interests; records and disclosures to meet legal obligations; and optional analytics or marketing with your consent. Where we rely on legitimate interests, we consider the effect on your rights and use only the data reasonably needed for that purpose.
International processing. Endo operates from the United States and the providers named above may process data in the United States and other countries. Those locations may have different data-protection laws. Where applicable law requires a transfer safeguard, we and our providers use an approved transfer mechanism for the relevant processing. Provider privacy notices describe their independent processing and locations.
Your rights. Subject to applicable exceptions, you may ask us to access, correct, delete, restrict or provide a portable copy of your personal data, and you may object to processing based on legitimate interests. You may withdraw consent for optional analytics or marketing at any time without affecting earlier lawful processing. Email [email protected] to exercise a right. You may also complain to the data-protection authority where you live or work, or where you believe an infringement occurred.
If you are in Australia, Australian privacy law applies to the extent it covers our handling of your personal information. You may ask for access to or correction of personal information we hold about you by emailing [email protected]. Tell us what you need and provide enough information for us to verify the request safely.
We operate from the United States and the providers named above may process information outside Australia. We take reasonable steps required by applicable law when disclosing personal information overseas. If you have a privacy complaint, email [email protected] first so we can investigate and respond. You may also contact the Office of the Australian Information Commissioner.
We use essential cookies and browser storage for sign-in, security, and remembering trusted devices. For product analytics we use two service providers: Google Analytics 4 and PostHog (US cloud). Optional product analytics stay off until you explicitly enable them in Privacy choices, available in Settings and About and legal. You can withdraw consent there at any time; withdrawal stops future optional analytics events. The choice is saved for this browser or device, separately from marketing email preferences. To make search and alerts understand misspellings and nicknames, search queries and the text of new listings may be processed by Anthropic (Claude API, US). Anthropic returns the interpretation and does not use this data to train its models. The optional analytics providers set their own cookies and receive usage data such as page paths, search interactions, buttons and links you interact with, device type, and approximate location derived from your IP address. Google Analytics runs in measurement-only mode: IP addresses are anonymized, and Google Signals and ads personalization are both switched off, so what you do here is not used to target advertising to you on other sites. PostHog builds a person profile only for signed-in accounts, not for anonymous visitors. Campaign labels, click identifiers, URL query strings and fragments are removed from the usage measurements configured in our client. Neither provider is an advertising network, and we use no cross-site tracking pixels. If your browser sends a Global Privacy Control or Do Not Track signal, neither one loads at all, no analytics cookie is set and no data is sent. To keep bots from creating accounts, the sign-up form runs Cloudflare Turnstile, a bot check that looks at browser and device signals under Cloudflare's privacy policy. It is not an advertising service and it does not load if you never open the sign-up form.
Campaign signup measurement stays off until you separately enable it in Privacy choices. With that choice, we keep campaign labels and click identifiers from your current visit in browser storage for up to 30 days. After you create an account, we send that first campaign attribution to our own server to count signups by source. Existing usage analytics consent does not enable this purpose. Withdrawing this choice removes the local campaign record and stops future campaign sends; it does not erase a send already received by our server. Global Privacy Control and Do Not Track keep this purpose off too. Click identifiers are not included in our aggregate campaign reports and are not sent to advertising networks by this feature.
Photo files can include embedded location information. Remove private GPS and other EXIF metadata before uploading.
Your browsing location and radius help calculate nearby results. Locate me asks your browser or device for location; the resulting coordinates can be more precise than a public listing map and are used in your location and radius controls. You can search for a city instead. Listing maps use approximate area coordinates, not the delivery address. City and country searches are sent to Komoot Photon; reverse-geocoding requests round coordinates to three decimal places to obtain a place label, while the location controls retain the original fix for nearby results. Map tiles come from OpenStreetMap, which receives the map area requested and normal network information such as your IP address and browser details. We do not include your Endo account ID in these map or search requests. Avoid entering private information into city search. These services have their own privacy policies and availability limits.
We send transactional texts only: verification codes and security alerts to your verified phone. We do not send marketing texts. Message and data rates may apply. Account and transaction emails are part of the service; any marketing email will include a working unsubscribe link and we honor opt-outs promptly.
Endo is for adults 18+. We do not knowingly collect data from minors; suspected underage accounts are removed and their data deleted.
The service is operated from California. Downloads and public browsing may be available outside the countries supported for account admission or financial services. A display preference does not grant transaction eligibility or remove privacy rights. Material changes will be announced in-app or by email, with the date above updated. AI use: Endo uses automated and AI-assisted systems for content moderation, pricing estimates (Endo Book) and first-pass dispute triage. To keep the market safe, the text and photos of listings, photos, messages, reviews and dispute evidence are screened by Anthropic (Claude API, US), which does not use this data to train its models. Message text may also be screened by TypeSafe (Jev classifier, US) as part of moderation. Dispute processing uses automated rules and AI-assisted recommendations as well as human review of escalated and contested cases. An automated result is not a guarantee of accuracy; use the report or support route to challenge a result. Contact: [email protected] ยท Endo Powersports LLC (California).