Endpoint IndexPrivacy Policy
How Endpoint Index handles personal data: Cloudflare's cookieless analytics, Google Analytics only with your consent, correction emails, vendor links and vendor enquiries.
Contents
Effective date: 1 November 2026 Operator: named in our Terms of Use Contact: contact@endpointindex.com
Who we are
Endpoint Index (endpointindex.com) is an independent database of SMB endpoint security products. The company that operates it is named in our Terms of Use.
What data we collect
Site visitors
Endpoint Index uses Cloudflare Web Analytics, a cookieless analytics service. It does not set cookies, use fingerprinting, or track individual visitors across sites; we see aggregate page views, referrers, and page-load performance only.
Endpoint Index also uses Google Analytics 4, but only after you choose Accept all on the cookie banner shown on your first visit, or switch Analytics on under Cookie settings and save. Until then, and whenever Analytics is off, nothing from Google loads on this site. If you accept, Google sets analytics cookies on endpointindex.com (names beginning _ga) that last up to 13 months, and we see page views, referrers, countries and device types in aggregate. Google Analytics 4 does not store IP addresses. We do not use Google's advertising features, and the consent settings this site sends to Google deny advertising storage and personalisation. You can change your choice at any time with the Cookie choice link in the footer; switching Analytics off deletes the _ga cookies this site set. Neither analytics service is used to identify an individual visitor.
The site also stores your theme and cookie choices in your browser. These are essential to the site working as you set it, carry no identifier, and are not shared with anyone.
Error reports
When you email a correction to contact@endpointindex.com (for example via a "Report an error" link), we receive your email address and the content of your message. We use this data solely to investigate and resolve the reported issue. We do not add your email to any mailing list. Corrections are retained for as long as the relevant entity data exists in the database.
Vendor enquiries
When you email contact@endpointindex.com, we receive your name, email address, company name (if given), and the content of your message. This data is used solely to process your enquiry (profile claims, corrections, or sponsorship requests). We do not share vendor contact details with third parties.
Vendor listing applications
When a vendor applies at /for-vendors/list/, we collect the applicant's name, job title, work email and, optionally, a phone number, together with the product details and profile text they enter. Cloudflare records the country the request came from. We use this to confirm the applicant represents the vendor, review the application, and send confirmation and payment details. The personal details are stored in our application database (hosted by Cloudflare) and emailed to our team inbox; they are never published. Only the profile text and logo are published, and only for an approved listing. We keep application records while the listing is active and afterwards for as long as our accounting obligations require.
The application form uses Cloudflare Turnstile to check that it is being used by a person. Turnstile processes technical information such as your IP address and browser characteristics for that purpose only.
Payment for paid plans is currently arranged by invoice after approval. We do not collect card details on this site.
Links to vendor websites
Links to vendor websites are ordinary links, not affiliate links, and carry no referral tracking from us. Once you are on a vendor's site, its own privacy policy applies.
Sponsorship
Vendors may pay for Claimed, Featured and Category Sponsor placements. They are always labelled and never affect data, scores, rankings, or editorial judgments. See For vendors and the editorial policy.
Data processors
| Processor | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, CDN, DDoS protection | IP addresses (server logs, retained per Cloudflare policy) |
| Cloudflare Web Analytics | Cookieless web analytics | Aggregate page views, referrers, and performance metrics; no cookies |
| Google Analytics 4 | Web analytics, only after you accept | Analytics cookies, page views, referrers, approximate location and device type; no IP addresses stored |
| Cloudflare Email Routing and our email provider | Receiving corrections and vendor enquiries | Sender email, message content |
Data retention
- Analytics: Cloudflare's aggregate data is retained according to Cloudflare's retention policy. Google Analytics event data is retained for 14 months and then deleted by Google.
- Corrections: Retained for as long as the entity data is in the database, then deleted.
- Vendor enquiries: Retained for the duration of the business relationship, then deleted within 12 months of last contact.
Your rights
If you have sent us personal data by email and wish to exercise your rights under GDPR, CCPA, or equivalent legislation (access, correction, deletion, portability), contact contact@endpointindex.com.
Changes
We may update this policy. Material changes will be noted on this page with an updated effective date.