Privacy Policy
Last updated: 22 October 2026
Expodite ("Expodite", "we", "us" or "our") operates the export operations platform available through our website and web application (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.
Expodite is a business-to-business platform. Much of the information the Service holds is data our customers — exporters and their teams — enter about their own operations, including about the foreign buyers they trade with. Where we process that data on a customer's behalf, the customer is the controller of it and we act as their processor, under their instructions and the agreement between us.
We are aware of Egypt's Personal Data Protection Law No. 151 of 2020 and, because our customers' buyers and users are frequently outside Egypt, we apply GDPR-aware practices throughout this Policy, even where Egyptian law alone would not require them.
1. Information we collect
We collect the following categories of information:
- Account and contact details — name, work email, phone number, company name, role and language preference, given when an account is created or when you contact us.
- Signup verification data — when you create an account yourself, the email address you verify, the 6-digit code and link used to confirm it, and abuse-prevention signals (an IP address, hashed rather than stored in the clear, and a captcha check) used to confirm a signup is not automated.
- Customer business data — the export operations records our customers enter into the Service on their own behalf and on their buyers': buyers and their contacts, export orders, quotes, shipments, documents, letters of credit, cost lines and payments. This is processed as a processor, under the customer's instructions, and may include personal data about a customer's own staff, and about their buyers' contacts abroad, that the customer is responsible for having a lawful basis to give us.
- Usage and device data — log data such as IP address, browser and device type, pages viewed and timestamps, collected automatically when the Service is used.
- Cookies and analytics data — see "Cookies and analytics" below.
- Communications — information you give us when you request a demo, contact sales, or reach support.
2. Our role, and the legal bases we rely on
For account, usage and communications data, Expodite is the controller, and we process it: to perform our contract with you (running the account you hold and the Service you use), for our legitimate interests (keeping the Service secure, understanding how it is used, and improving it), to comply with a legal obligation (such as a request from an authority), and, where you have given it, on your consent (such as a marketing email you can opt out of at any time).
For customer business data, our customer is the controller and we are the processor, acting only on their documented instructions, under the terms of our agreement with them. If you are a buyer, contact or member of staff whose details appear in a customer's account, your relationship for that data is with the customer, and this section explains our own role in processing it on their behalf, not a separate legal basis of our own.
For assistant conversations, Expodite is the controller: we decide how long they are kept, and we use them, on our legitimate interests, to answer questions, support users, maintain quality and security, and improve the Service (see "The assistant" below). This includes the copies of customer records that an answer showed, which are kept as part of the conversation.
4. How we share information
We do not sell personal data. We share information only as described here, with sub-processors bound to protect it under a written agreement:
- Hosting and infrastructure — cloud hosting and content-delivery providers that store and run the Service.
- Bot and abuse protection — a captcha provider (for example Cloudflare Turnstile) used only on our public sign-up and support forms, and on the assistant, to confirm a submission is not automated.
- AI model provider — Anthropic (Claude API), which processes the questions typed into the Expodite assistant, the earlier turns of the same conversation, and the data retrieved to answer them (Expodite's published data and, in the app, the organisation's own records the user may open), to produce the answer and, when we run our monthly topic analysis (each month with enough questions), to group questions by topic; it does not use them to train models and deletes them within 30 days, or keeps them for up to 2 years if its safety systems flag them.
- Email and communications — providers that send account, notification and support email on our behalf.
- File and document storage — providers that store the documents a customer generates or uploads in the Service.
- Error monitoring and observability — providers that help us detect and diagnose faults in the Service.
- Within your organisation — customer business data is visible to users in the same customer account, according to the roles and branch permissions that customer configures.
- Legal and safety — where required by law, regulation or legal process, or to protect the rights, property or safety of Expodite, our customers or the public.
- Business transfers — in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.
5. International transfers
Expodite's customers export internationally, and their buyers, carriers and banks are typically outside Egypt, so information may be processed and stored in a country other than the one you are in. Where we transfer personal data across a border, we take steps designed to keep it protected consistently with this Policy and with applicable law, including, where relevant, standard contractual safeguards with the receiving party.
6. Data retention
We retain account and usage data for as long as your account is active and as needed to provide the Service, meet our legal obligations, resolve disputes and enforce our agreements. Customer business data is retained according to the customer's instructions and their agreement with us. When a customer closes their account, we keep their business data archived rather than deleting it; nobody can sign in to a closed account, and we remove archived data only where the law or a legal order requires it. The account details of a closed account's users are kept archived with it.
Assistant conversations are kept as described in "The assistant" below.
7. Security
We use technical and organisational measures designed to protect information, including encryption in transit, access controls and role-based, branch-scoped permissions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your rights
Depending on your location and Egypt's Personal Data Protection Law No. 151/2020, the GDPR or another applicable law, you may have rights to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below or through our support. Where the personal data relates to customer business data we hold as a processor, please direct your request to that customer, and we will assist them as required by our agreement with them; if that customer's account is closed, contact us directly, and we will handle the request as the law and our agreement with the customer require.
9. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18.
10. Third-party links
The Service and this website may link to third-party websites or services, including government platforms such as Nafeza and GOEIC, that we do not control. This Policy does not apply to those third parties, and we encourage you to review their own privacy notices.
11. Free document tools
Our website offers free document tools that let anyone generate an export document — a proforma invoice, a packing list and similar — without an account. This section explains what happens to what you type into them, and governs the tools where it differs from the sections above.
The live preview stores nothing. While a form is filled in, the document is rendered and shown back as you type; that preview is not written to our database and is cached nowhere along the way. Information is stored only at the moment a finished PDF is requested by email.
When a PDF is requested by email, we store:
- The email address and contact name given — required because the document is delivered by email and never downloaded from the page.
- The document data typed in — the form submission exactly as sent, including every line item and the exporter, shipment, banking and buyer details on the document.
- A hashed IP address — combined with a secret value so only the resulting hash is stored, never the address itself, so we can recognise abuse without tracking anyone.
- The browser's user-agent string, the page that referred the visitor, the generated PDF, and whether the email was sent successfully.
12. Your buyer's details in the document tools
The tools ask for a buyer's name and address, and optionally their tax ID and similar registration numbers. That person or company has not visited our site and has no relationship with us. The exporter using the tool is responsible for having a lawful basis to give us their buyer's details, and by submitting them confirms that they do. We process them for one purpose only: rendering the document requested. We do not market to a buyer named this way, do not contact them, and do not build a profile of them. They are retained only as part of the submission and are deleted with it.
13. Retention, use and deletion for the document tools
We keep a tool submission for up to 365 days from the day it is made, and do not retain it beyond that period.
We use these submissions to render and email the requested document, to detect and prevent abuse of a free, unauthenticated service, and to understand how the tools are used so we can improve them and the wider Service.
To have a submission deleted before its retention period ends, or to ask what we hold for a given email address, write to privacy@expodite.trade, and we will delete it.
What the browser keeps: to save retyping it on the next document, the tool remembers the user's own identity block — company name, address, contact details, and registration numbers — in local storage on that device, until it is cleared. We deliberately keep nothing else there: a buyer's details are never stored in the browser, and neither are bank details such as an IBAN or SWIFT/BIC. Bank details put on a document are used to render it and, like the rest of the submission, are stored on our servers only when a PDF is requested by email.
14. The assistant
The Expodite assistant answers questions about export rules, products and Expodite, on this website and in the app.
- What is kept — the questions typed into the assistant, exactly as typed, its answers and the sources and records it showed (as they were at the time), and any feedback given. In the app, each conversation is linked to the user's account and to their organisation. Website conversations are not linked to any account, and we set no cookie for them.
- How long — Expodite decides how long assistant conversations are kept. The current period is 5 years for website conversations and 5 years for app conversations, from the last message in a conversation (default: five years for both).
- Who sees them — in the app, a conversation is shown to the user who had it, not to other members or admins of the organisation; the organisation's owner and admins can download all of its members' conversations in the organisation's data export. Expodite staff may review conversations, together with the user and organisation they belong to, for support, quality, security and improving the Service. Every such access is recorded in our audit log.
- Removing from the list — a user can remove a conversation from their list of earlier conversations. This hides it from that list; it does not delete it, and the organisation's data export still includes it.
- Organisation accounts — when an organisation closes its account, the account is archived, not deleted: its assistant conversations are kept with it under the same retention period, and Expodite staff can still see them. They are removed earlier only by a legal request handled by Expodite. The organisation's data export includes them.
- Personal-data requests — to ask for access to, correction of or deletion of personal data in assistant conversations, contact support or write to privacy@expodite.trade. For a website conversation, give the conversation reference shown under the chat; without it, we can delete a conversation you describe but cannot send you its content. A correction is made by deleting the conversation or message concerned.
- Network addresses — network addresses are kept only as a keyed hash that we can link back to an address for 48 hours, and, for a blocked network, under a separate key while the block lasts plus 90 days. They are pseudonymised, not anonymous.
- Challenge — the website assistant uses Cloudflare Turnstile to confirm a visitor is not automated; its data handling is described in Cloudflare's Turnstile privacy terms.
- Automated assistant — the assistant is automated, answers from Expodite's data, and can be wrong.
15. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the date above and, where appropriate, give additional notice. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
16. Contact us
Questions about this Policy or our privacy practices can be sent to privacy@expodite.trade.
Questions before you sign up?
Talk to us about your data, your contract, or anything on this page — before you commit to anything.