EnderLab

Privacy Policy

Last updated 23 August 2026

1. Data controller

The controller of your personal data is North Pixel spółka z ograniczoną odpowiedzialnością, the operator of EnderLab (enderlab.app).

North Pixel sp. z o.o.
ul. Augustyna Szamarzewskiego 21/2, 60-514 Poznań, Poland
KRS: 0001250825, NIP: 7812113399, REGON: 545113877
Contact: [email protected]

For any privacy matter - access, deletion, or a question about this policy - write to [email protected].

2. What we collect

  • Account data. When you sign in with Discord or Google we receive your email address, display name, avatar image URL and the provider's account identifier. We never receive your password.
  • Project content. The prompts you write, the chat history of each project, the generated source files, and the project settings (loader, Minecraft version, AI model).
  • Build data. Compiler logs and the .jar files produced for your projects.
  • Usage data. Per generation: the model used, token counts and cost. This is what your allowance is measured against.
  • Payment data. Which plan you bought, the amount, the payment status, the transaction identifier from the payment provider, and when it was paid. We do not receive or store card or bank details.
  • Technical data. Your IP address and browser user agent, used for server logs and passed to the payment provider for its anti-fraud checks when you start a checkout.

3. Why we process it, and on what legal basis

  • To provide the service - running generations, storing your projects, compiling builds, keeping you signed in. Legal basis: performance of a contract, art. 6(1)(b) GDPR.
  • To handle payments and activate plans. Legal basis: performance of a contract, art. 6(1)(b) GDPR.
  • To enforce allowances and prevent abuse - usage metering, rate limits, detecting attacks on the service. Legal basis: our legitimate interest in keeping the service available and financially sustainable, art. 6(1)(f) GDPR.
  • To meet accounting and tax obligations. Legal basis: legal obligation, art. 6(1)(c) GDPR.
  • To handle complaints you send us. Legal basis: legal obligation and legitimate interest, art. 6(1)(c) and 6(1)(f) GDPR.

4. Who else processes your data

We share data only with the providers we need to run the service:

  • OpenRouter (AI inference, United States). Your prompts, chat history and the project files being worked on are sent there so a large language model can produce the code. Do not paste secrets - passwords, API keys, licence keys - into a prompt.
  • SimPay, operated by Payments Solution Sp. z o.o. (payments, Poland). At checkout we send your email address, IP address and user agent so the transaction can be created and screened for fraud.
  • Discord and Google act as identity providers when you choose to sign in with them, under their own privacy policies.
  • Our hosting provider, which stores the service data.

We do not sell your data, we do not share it for advertising, and we do not use your project content to train our own models.

5. Transfers outside the EEA

Our AI provider processes data in the United States. Such transfers are made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to that provider.

6. How long we keep it

  • Account, projects, chat and builds - for as long as your account exists. Deleting a project removes its files, chat history and builds immediately and permanently.
  • Payment and accounting records - for the period required by Polish tax law, currently 5 years from the end of the accounting year, even after an account is closed.
  • Usage records - kept as long as needed to enforce allowance periods.

There is currently no self-service account deletion in the interface. Email [email protected] and we will delete your account and its content, keeping only what the law requires us to retain.

7. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict processing, or object to processing based on legitimate interest;
  • receive your data in a portable format.

To exercise any of these, write to [email protected]. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

8. Cookies

EnderLab uses only the cookies it needs to function. There is no analytics, no advertising and no third-party tracking on this site.

  • enderlab_session - keeps you signed in. Set after sign-in, expires after 7 days, HttpOnly.
  • oauth_state - a short-lived random value that protects the sign-in round-trip against cross-site request forgery. Expires after 10 minutes, HttpOnly.

9. Security

Session cookies are HttpOnly and, in production, sent only over HTTPS. Project data is scoped to its owner: every request for a project, build or download is checked against the signed-in account. Payment notifications from the provider are signature-verified before a plan is activated.

10. Changes to this policy

We may update this policy when the service or the law changes. The date at the top always shows the current version. See also our Terms of Service.

← Back to EnderLab