Privacy Policy — Endless Pro Studios
Applicable to: All Endless Pro Studios software products Governing law: Primary framework — NDPR 2019; global coverage (see §4 and closing note) Last updated: 2026-10-23
1. Who We Are
Endless Pro Studios (registered as Endless Pro Solutions, CAC BN No. 3593482) is a software studio — a team of developers building software that improves performance across every sphere of business, from retail and commerce to education and beyond.
- Contact: [email protected] (legal & privacy) · [email protected] (support) · [email protected] (billing)
- Website: https://endlesspro.dev
When this policy says "we", "us", or "our", it means Endless Pro Studios.
2. What This Policy Covers
This policy explains what personal data we collect when you:
- Visit our website (endlesspro.dev)
- Purchase or use a licence for any Endless Pro Studios software product
- Contact our support team
It does not cover data that you store within our software on your own hardware or server. Any business data, records, or content you enter into our products lives entirely on your own machine or server. We never see it, receive it, or have access to it. See §8 for detail.
3. Data We Collect and Why
3a. Licence and Account Data
When you purchase a licence, we collect:
| Data | Why we collect it |
|---|---|
| Full name | To address your licence and send your purchase confirmation |
| Email address | To deliver your licence key, send payment and subscription reminders, and respond to support requests |
| Business / organisation name | To personalise your licence record |
| Country | To determine the applicable pricing for your region |
| Payment reference number | To match your payment to your licence record |
We do not store your card number, bank details, or any payment credentials. All payment processing is handled by Paystack (see §6). We only receive a payment reference and confirmation status from Paystack.
3b. Licence Activation and Check-In Data
Our licence server (hosted at license.endlesspro.dev) collects the following
each time your software activates or checks in:
| Data | Why we collect it |
|---|---|
| Licence key | To verify your licence is valid |
| Machine fingerprint (a one-way hash — not personally identifiable) | To enforce the machine limit on your licence tier and detect fraudulent use |
| Software version | To provide version-appropriate support |
| IP address | For fraud detection and rate limiting only. Not stored long-term. |
| Check-in timestamp | To track licence activity and calculate grace periods |
The machine fingerprint is a one-way cryptographic hash of hardware identifiers. It cannot be reversed to identify you or your hardware. It is used only to count and manage authorised machines on your licence.
We do not receive, store, or process any of the operational data you manage within the software — no inventory items, no sales records, no student names, no fee records, no attendance data, no grades, no staff data. That data never leaves your machine or server.
3c. Website and Communications Data
When you visit our website or contact us:
| Data | Why we collect it |
|---|---|
| Email address (if you contact us) | To respond to your enquiry |
| Name (if you contact us) | To address you correctly |
| Browser / device type (analytics) | To understand how people use our website and improve it |
| Pages visited, time spent (analytics) | Aggregated, anonymised — privacy-respecting analytics that do not track individuals across sites |
We do not use Google Analytics. We do not place third-party advertising trackers on our site.
4. Legal Basis for Processing
Under our primary data protection framework and equivalent frameworks in other jurisdictions (see §4 and the closing note), we process your personal data on the following bases:
| Processing activity | Legal basis |
|---|---|
| Delivering your licence and purchase confirmation | Contract — necessary to fulfil your purchase |
| Licence validation and check-in | Contract — necessary to provide the licensed software service |
| Fraud detection and rate limiting | Legitimate interests — protecting our service and other customers from abuse |
| Responding to support requests | Contract / Legitimate interests |
| Website analytics (aggregated, anonymised) | Legitimate interests — improving our service |
| Sending payment reminders and renewal notifications | Contract — necessary for subscription and instalment plan management across all applicable products |
| Sending product update announcements | Legitimate interests — you may opt out at any time |
5. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Licence and account records | For the life of your licence + 3 years after expiry or last activity |
| Payment references | 7 years (standard accounting retention under CAMA) |
| Machine fingerprints | For the life of the licence + 1 year |
| Check-in timestamps | 12 months rolling |
| IP addresses (check-in/fraud) | 30 days |
| Support correspondence | 3 years after resolution |
| Website analytics | Aggregated data only — no individual retention |
6. Payment Processing — Paystack
All payments are processed by Paystack (a licensed payment service provider regulated by applicable financial authorities).
When you pay, you are interacting with Paystack's checkout page. Paystack collects and processes your card or bank details directly — we never see or store them.
Paystack's privacy policy: https://paystack.com/privacy
Fee disclosure: Paystack adds a processing fee to your transaction. The fee is displayed on the Paystack checkout page before you confirm payment. The applicable fee rate depends on your payment method and region — this is shown to you before you confirm.
7. Sharing Your Data
We do not sell your personal data. We share it only in these circumstances:
| Recipient | What is shared | Why |
|---|---|---|
| Paystack | Your email address and purchase amount | To process your payment and send payment confirmation |
| Resend (email delivery) | Your email address and name | To deliver your licence key and system emails |
| Railway (infrastructure) | Licence and check-in data as described in §3b | Our licence server runs on Railway's infrastructure |
| Legal authorities | Whatever is legally required | Only when compelled by a valid court order or regulatory requirement under applicable law |
We require all processors to handle your data securely and in accordance with applicable data protection law.
8. Your Data in Our Software — Important Clarification
Our software products are offline-first — they run on your own hardware and do not require a permanent internet connection to operate. This means your operational data stays with you at all times.
Any data you enter into our products — inventory records, sales data, student records, staff accounts, school fees, attendance data, exam results — is stored in a local database on your own machine or server. It is never transmitted to Endless Pro Studios. If you uninstall the software, your data remains on your hardware until you delete it.
We are not a data processor of your customers', students', or staff data. You are the sole data controller for that data. Your obligations under NDPR (and any other applicable data protection law) in relation to that data are your own — not ours.
9. Your Rights
Under the NDPR 2019 and, where applicable, the GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data (subject to legal retention requirements — see §5)
- Object to processing based on legitimate interests
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time where processing is consent-based
- Lodge a complaint with the data protection supervisory authority in your country
To exercise any of these rights, email: [email protected] We will respond within 30 days.
10. Security
We protect your personal data using:
- TLS encryption in transit for all connections to our servers
- Bcrypt password hashing for all admin accounts
- One-way hashing for machine fingerprints (cannot be reversed to identify hardware)
- Role-based access control on our licence server admin panel
- Infrastructure with managed Postgres and Redis, with encryption at rest
If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.
11. Cookies
Our website uses only essential functional cookies (session management). We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.
12. Children
Our products are business and institutional software. School2X is licensed to schools as an institution — the school is the data controller for any student data processed on their own server. We do not collect any data directly from students.
13. Changes to This Policy
We may update this policy when our products or practices change. Material changes will be communicated by email to licence holders and posted on our website.
14. Contact
[email protected] — privacy questions, data subject requests, legal matters [email protected] — general support [email protected] — billing and payment matters
Endless Pro Studios · https://endlesspro.dev
Our privacy practices are built on the core principles shared by modern data protection law worldwide: lawfulness, transparency, purpose limitation, data minimisation, accuracy, security, and individual rights. Our primary compliance framework is the NDPR 2019 and its 2020 Implementation Framework.
For customers in other jurisdictions, we operate with awareness of and respect for the applicable frameworks in your region, including but not limited to:
- EU/EEA: General Data Protection Regulation (GDPR)
- United Kingdom: UK GDPR and Data Protection Act 2018
- South Africa: Protection of Personal Information Act (POPIA)
- Kenya, Ghana and other African states: applicable national data protection laws
- Brazil: Lei Geral de Proteção de Dados (LGPD)
- India: Digital Personal Data Protection Act 2023 (DPDP)
- Singapore / SE Asia: Personal Data Protection Act (PDPA) and equivalent national laws
- Australia: Privacy Act 1988 (as amended)
- Canada: PIPEDA and provincial equivalents
- United States: applicable state privacy laws (CCPA and others)
We collect only what is necessary, use it only for the purposes stated in this policy, protect it with appropriate security measures, and honour your rights regardless of where you are based. If your jurisdiction's law grants you rights that go beyond what is described here, we will honour those rights on request.