Privacy Policy

Overview

Mohamed Karrach, operating EXPOZOR, based in Morocco, is the data controller for EXPOZOR. EXPOZOR operates a public waitlist and an early-access, account-based expense tracking workspace. Signed-in users can manually enter expenses, import mapped CSV data, create categories and budgets, and review recurring records. We do not sell personal data, collect bank login credentials, connect to financial institutions, custody funds, or initiate payments.

What we collect and store

• Waitlist information: email address, signup source, referrer when provided by the browser, locale, communication consent, and signup time.
• Account information: name, email address, password hash, display currency, monthly target, account timestamps, and active session records.
• Legal acceptance records: the Terms and Privacy Policy versions accepted, acceptance time, and confirmation that the user meets the minimum age.
• Workspace records: named manual accounts, opening balances, expenses, income, internal transfers, reconciliation snapshots, close periods, merchant and description text, amounts, dates, categories, budgets, recurring records, and demo-workspace state.
• Import records: an import label, row counts, duplicate and skipped-row counts, and the approved transactions created from an import. CSV files are parsed in your browser; only the normalized rows and fields you approve are sent to the server for review and storage. The original file and ignored columns are not uploaded by the import flow.
• Security and request data: request headers needed to prevent abuse, pseudonymous rate-limit identifiers, and administrator audit records.

What we do not collect or connect

• Bank login credentials, passwords, PINs, or bank-connection tokens.
• Bank account or routing numbers for the manual ledger.
• Data from Plaid, MX, Open Banking, or financial-institution APIs.
• Payment card numbers, card security codes, or billing details.
• Receipt images, screenshots, location history, or biometric data.
• Government identification documents.
• Advertising or third-party analytics identifiers.

How we use data

• To operate, secure, and support your EXPOZOR workspace.
• To calculate the budgets, summaries, and recurring signals you request.
• To import approved records and provide downloadable exports.
• To confirm waitlist signup and send communications you requested.
• To avoid duplicate waitlist records for the same email address.
• To prevent abuse, investigate errors, and respond to support requests.

Legal bases

• Contract and pre-contract steps: administering a requested invitation, creating an account, and providing the workspace and exports.
• Consent: optional product-update messages and any other use for which we specifically request consent.
• Legitimate interests: securing the service, preventing abuse, diagnosing errors, and maintaining a reliable audit trail, where those interests do not override individual rights.
• Legal obligations: retaining or disclosing limited information when applicable law validly requires it.

Services that help us operate

Waitlist and workspace records are stored with our PostgreSQL database provider. Our hosting provider runs the web application. If email sending is enabled, we use an email service provider for confirmation or product-update messages. See our Subprocessors page for the current list.

International data transfers

EXPOZOR uses service providers that may process data outside Morocco, including in the United States. We require contractual and security commitments from providers and will complete any required CNDP notification and foreign-transfer procedure before opening real-data processing to the public. Where European data-protection law applies, we will also use a recognized transfer mechanism and describe it here.

Data retention

Workspace records remain available until you delete individual records or delete your account. Waitlist-only records are retained while early access is active and for no longer than 24 months after the last related interaction unless you renew your interest; you may request deletion sooner. Rate-limit records expire with their configured abuse-prevention window. We may retain a narrowly limited record for longer when required to comply with law, resolve a dispute, document consent or withdrawal, or investigate abuse.

Your choices

Age eligibility

EXPOZOR is intended only for people who are at least 18. We do not knowingly collect personal data from children or minors. Contact privacy@expozor.com if you believe an ineligible person submitted information.

Morocco data-protection notice

The required CNDP processing receipt and foreign-transfer authorization will be published here before EXPOZOR opens public personal-data processing. Until both steps are completed, the production site must keep waitlist and account enrollment closed and offer only the sample-data demo.

Security

Passwords are protected with scrypt and a unique salt. Account sessions use random tokens stored as hashes, and production session cookies are HTTP-only, secure, and same-site. The site is also configured with HTTPS, HSTS, a Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy. We do not claim an external security certification.

Cookies

The public waitlist does not require an account cookie. Signed-in workspaces use one essential session cookie. EXPOZOR does not currently use advertising or third-party analytics cookies. See our Cookie Policy for more detail.

Contact