Privacy Policy

Overview

Mohamed Karrach, operating EXPOZOR, based in Morocco, is the data controller for EXPOZOR. EXPOZOR operates a live, account-based expense-tracking web application. Signed-in users can manually enter expenses, import mapped CSV data, create categories and budgets, and review recurring records. We do not sell personal data, collect bank login credentials, connect to financial institutions, custody funds, or initiate payments.

What we collect and store

• Legacy pre-launch enrollment information: for people who registered interest before public account creation opened, we may retain the email address, signup source, browser-provided referrer, locale, communication consent, and signup time until deletion or the retention period described below.
• Account information: name, email address, password hash, display currency, monthly target, account timestamps, and active session records.
• Legal acceptance records: the Terms and Privacy Policy versions accepted, acceptance time, and confirmation that the user meets the minimum age.
• Workspace records: named manual accounts, opening balances, expenses, income, internal transfers, reconciliation snapshots, close periods, merchant and description text, amounts, dates, categories, budgets, recurring records, and demo-workspace state.
• Import records: an import label, row counts, duplicate and skipped-row counts, and the approved transactions created from an import. CSV files are parsed in your browser; only the normalized rows and fields you approve are sent to the server for review and storage. The original file and ignored columns are not uploaded by the import flow.
• Security and request data: request headers needed to prevent abuse, pseudonymous rate-limit identifiers, and administrator audit records.
• Optional receipt and voice capture: when this feature is enabled and you choose to use it, receipt images or audio recordings, transcripts, extracted expense details, your review corrections, merchant preferences, and the timezone and time of capture. Uploaded content is processed by OpenAI to extract and categorize expenses. Source files are kept in private object storage.

What we do not ask for or connect

• Bank login credentials, passwords, PINs, or bank-connection tokens.
• Bank account or routing numbers for the manual ledger.
• Data from Plaid, MX, Open Banking, or financial-institution APIs.
• Payment card numbers, card security codes, or billing details.
• Location tracking or biometric identification data.
• Government identification documents.
• Advertising or third-party analytics identifiers.

Receipts may contain personal or payment information. Crop or remove unnecessary information before uploading. Voice capture is used for expense transcription, not voice identification.

How we use data

• To operate, secure, and support your EXPOZOR workspace.
• To calculate the budgets, summaries, and recurring signals you request.
• To import approved records and provide downloadable exports.
• To extract and categorize expenses from receipt or voice captures you submit.
• To create your account and send communications you requested.
• To prevent abuse, investigate errors, and respond to support requests.

Legal bases

• Contract and pre-contract steps: creating an account, providing the one-month free trial, and operating the workspace and exports.
• Consent: optional product-update messages and any other use for which we specifically request consent.
• Legitimate interests: securing the service, preventing abuse, diagnosing errors, and maintaining a reliable audit trail, where those interests do not override individual rights.
• Legal obligations: retaining or disclosing limited information when applicable law validly requires it.

Services that help us operate

Account and workspace records are stored with our PostgreSQL database provider. Our hosting provider runs the web application. If email sending is enabled, we use an email service provider for account, security, or product-update messages. See our Subprocessors page for the current list.

International data transfers

EXPOZOR uses service providers that may process data outside Morocco, including in the United States. We require contractual and security commitments from providers and apply appropriate safeguards required by applicable law. Where European data-protection law applies, we will also use a recognized transfer mechanism and describe it here.

Data retention

Receipt images remain until you remove their capture or delete your account. Raw audio is scheduled for removal after an expense is saved or after 24 hours. Unfinished uploads expire after 24 hours. Transcripts and extracted details remain with the capture. Removing a capture immediately removes application access to its files; physical deletion happens through a retryable cleanup process after upload links expire and may take longer during an outage. Deleting an expense does not automatically delete its receipt. JSON exports include separate authenticated file download links; download those files before deleting your account. AI-provider retention is governed by the configured provider account and applicable terms.

Workspace records remain available until you delete individual records or delete your account. Legacy pre-launch enrollment records are retained for no longer than 24 months after the last related interaction unless you renew your interest; you may request deletion sooner. Rate-limit records expire with their configured abuse-prevention window. We may retain a narrowly limited record for longer when required to comply with law, resolve a dispute, document consent or withdrawal, or investigate abuse.

Your choices

Age eligibility

EXPOZOR is intended only for people who are at least 18. We do not knowingly collect personal data from children or minors. Contact privacy@expozor.com if you believe an ineligible person submitted information.

Security

Passwords are protected with scrypt and a unique salt. Account sessions use random tokens stored as hashes, and production session cookies are HTTP-only, secure, and same-site. The site is also configured with HTTPS, HSTS, a Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy. We do not claim an external security certification.

Cookies

Signed-in workspaces use one essential session cookie. EXPOZOR does not currently use advertising or third-party analytics cookies. See our Cookie Policy for more detail.

Contact