Skip to content

Home/Privacy Policy

Exporb Privacy Policy

How we collect, use, and protect your information

Last updated: June 27, 2026 · Effective: June 27, 2026

01

1. Overview

Exporb is a contact management platform designed for trade show professionals. We process personal information to provide you with tools for:

  • Recording and transcribing conversations with business contacts
  • Scanning and digitizing business cards
  • Analyzing interactions using artificial intelligence (AI)
  • Managing contact databases and collaboration with team members
  • Syncing data across devices with offline capabilities

Important: You Are a Data Controller

When you collect contact information from third parties (e.g., booth visitors), you are the data controller under GDPR/CCPA. You are responsible for:

  • Obtaining consent before recording conversations
  • Informing contacts about data collection and processing
  • Honoring their privacy rights (access, deletion, etc.)
  • Complying with applicable privacy laws in your jurisdiction
02

2. Information We Collect

Account Data vs. Customer Data — Controller / Processor Roles

Aeon Kosmos LLC acts as the data controller with respect to Account Data — personal data you provide about yourself or your account, including names, email addresses, billing details, subscription status, and usage analytics collected via our web subscriptions (Stripe), iOS App Store subscriptions, and platform interactions.

We act as the data processor with respect to Customer Data — audio recordings of trade-show conversations, AI-generated transcriptions, business-card images, and extracted contact details (e.g., names, emails, phone numbers about third parties) that you upload and process using our platform. As processor, we handle Customer Data strictly per your instructions as controller, limited to providing the Service, and we do not use Customer Data for our own purposes. A Data Processing Agreement is available on request to support your obligations under GDPR, UK GDPR, and similar laws.

EU Representative (GDPR Art. 27): Aeon Kosmos LLC is a US-registered controller. We currently operate under the small-scale exemption in GDPR Art. 27(2): processing is occasional, conducted on a small scale, and does not include special-category data or data likely to result in a risk to the rights and freedoms of natural persons. We will appoint an EU representative when scale or customer requirements warrant. EU/EEA data subjects may contact us directly at privacy@exporb.com for any GDPR-related request and will receive a response within 30 days.

2.1 Information You Provide

Account Information:

  • Email address (required for email-based account creation)
  • Password (hashed and encrypted)
  • Name and company name
  • Phone number, job title, bio, LinkedIn URL (optional)
  • Location: country, city, timezone, language preference
  • Telegram user ID, username, and phone number (when you sign in with Telegram)

Business Information:

  • Industry, company size, annual revenue range
  • Team size, number of events per year
  • Trade show budget range
  • Referral source (how you found us)

Third-Party Contact Data (You Control):

  • Contact names, emails, phone numbers, companies
  • Business card images and scanned data
  • Audio recordings of conversations
  • Notes, tags, and custom fields
  • Attachments and files you upload

2.2 Information We Collect Automatically

  • Usage Data: Login times, features used, device type, platform (iOS/Android/Web)
  • Technical Data: IP address, browser type, app version, timezone
  • Performance Data: Error logs, crash reports (see Section 5)
  • Cookies & Local Storage: Authentication tokens, offline data cache, preferences (see Section 12)

2.3 Local Device Storage

Exporb stores data locally on your device to enable offline functionality. This includes cached contact data, audio recordings, business card images, and application preferences. This local data syncs with our servers when you are online and is cleared when you sign out.

03

3. How We Use Your Information

We use your personal information for the following purposes:

Service Delivery:

  • Create and manage your account
  • Provide contact management and collaboration tools
  • Sync data across your devices
  • Process audio recordings and business card scans
  • Generate AI-powered transcriptions and insights

Communication:

  • Send service-related emails (password resets, account notifications)
  • Send Telegram bot notifications about captured contacts and account activity (for users who sign in with Telegram)
  • Respond to support requests and inquiries
  • Send marketing emails (only when you explicitly opt in via Settings. Every marketing email contains an unsubscribe link. You can withdraw consent anytime in Settings.)

Security & Legal:

  • Detect and prevent fraud, abuse, and security incidents
  • Enforce our Terms of Service
  • Comply with legal obligations (subpoenas, court orders)

Improvement & Analytics:

  • Analyze usage patterns to improve features
  • Monitor app performance and fix bugs
  • Develop new features based on user needs
05

5. Third-Party Services & Data Sharing

We work with trusted third-party service providers ("data processors") to operate Exporb. These providers fall into the following categories:

Cloud Infrastructure & Database (Supabase)

Supabase provides our cloud database, authentication, and file storage (contacts, audio recordings, business card images, selfie photos). All user data including account information, contacts, media files, and subscription records is stored with Supabase. Data is stored in the European Union. Supabase maintains SOC 2 Type II compliance and a signed Data Processing Agreement is on file.

AI & Machine Learning Services (Google)

Google's AI API is used for AI-powered contact analysis, audio transcription summaries, and business card text extraction. Contact names, meeting notes, audio transcripts, and business card images are sent to Google's API for processing. Data is processed via Google's paid API tier and is not used for model training per our API terms. Data is processed in the United States.

Application Monitoring (Sentry)

Sentry provides error tracking and application performance monitoring. When errors occur, Sentry receives technical data including error messages, stack traces, browser/device information, and a pseudonymized user ID. We apply automated PII scrubbing to remove email addresses, phone numbers, and IP addresses before data is sent. Session replay is disabled. Data is processed in the European Union.

Hosting & Serverless (Vercel)

Vercel provides web hosting and serverless API functions. All HTTP requests pass through this infrastructure, which may log IP addresses, request URLs, and response times. Our serverless functions (payment processing, AI proxy, data export, account deletion) execute in the European Union. A signed Data Processing Agreement is on file.

Content Delivery & Security (Cloudflare)

Cloudflare provides DNS, content delivery, and DDoS protection for our service. All traffic to Exporb passes through Cloudflare's network, which caches static assets at edge locations worldwide and filters malicious requests. Cloudflare may process IP addresses and request metadata as part of its security and CDN functions. Cloudflare also provides privacy-focused web analytics (Cloudflare Insights) that do not use cookies or collect personal data — analytics are aggregated from edge server logs and include page views and visit duration without tracking individual users across sites. Data is processed at Cloudflare's global points of presence. A signed Data Processing Agreement is on file.

Background Job Processing (trigger.dev)

trigger.dev runs our background AI enrichment jobs — processing business card scans, audio transcriptions, and contact data analysis through Google's AI API. trigger.dev workers have access to the minimum contact data necessary to complete enrichment tasks and do not retain data after job completion. Data is processed in the United States under Standard Contractual Clauses.

Payment Processing (Stripe)

Stripe is our PCI DSS Level 1 compliant payment processor for subscription billing. Stripe receives your email address, billing information, and payment card details. We store only a Stripe Customer ID in our database — full payment card numbers are never stored on our servers. Data is processed in the United States.

Email Marketing (lemlist)

When you explicitly opt in to marketing communications, lemlist receives your email address to deliver product updates, tips, and best practices. lemlist acts as our data processor under a contractual agreement. You can unsubscribe via the link in any marketing email or in Settings at any time. Data is processed in the European Union.

Email Delivery (Resend)

Resend is our email infrastructure provider. It delivers transactional emails (password resets, account notifications, welcome emails), email campaigns, and follow-up emails to your contacts. Resend receives the recipient email address and email content for delivery. Resend acts as our data processor under a contractual agreement. Data is processed in the United States.

Product Analytics (PostHog)

PostHog helps us understand how you use Exporb so we can improve it. When analytics consent is granted, PostHog collects page views, feature usage, session duration, and device/browser information. Session replay is disabled. Autocapture (automatic click tracking) and heatmaps are disabled. A pseudonymized user ID is used for tracking, and profiles are only created for authenticated users. No contact data or personal information beyond usage patterns is shared with PostHog. Requests are reverse-proxied through our own domain to avoid interference from privacy-protecting browser extensions. Data is processed in the European Union. A signed Data Processing Agreement is on file.

Mobile Application (Apple iOS)

Exporb is available as a native iOS app. The mobile app may request access to your device camera (for business card scanning and selfie photos), microphone (for conversation recording), photo library, speech recognition, and local storage. Media captured through the app is stored locally on your device and synced to our cloud when online. Apple may collect app usage analytics as described in Apple's Privacy Policy.

Sign in with Telegram

If you choose Sign in with Telegram, Telegram shares with us your Telegram user ID, first name, last name, username, and phone number. We use these only to create and authenticate your account. When you capture contacts or perform key account actions, our bot sends you notifications via Telegram — including summaries of captured contacts. You can stop bot notifications at any time by blocking the bot in Telegram. See Telegram's privacy policy at telegram.org/privacy.

Sign in with Apple

If you choose Sign in with Apple, Apple shares with us your Apple ID, your name (only on first sign-in if you grant it), and either your real email or a private relay address generated by Apple. We use these only to create and authenticate your account. When you delete your account, we revoke the Apple refresh token via Apple's REST API per App Store Review Guideline 5.1.1(v). See Apple's privacy notice at apple.com/legal/privacy/data/en/sign-in-with-apple.

Apple In-App Purchases

Subscriptions purchased inside the iOS app use Apple's In-App Purchase system. Apple processes the payment under your Apple ID — we never see your payment card details. A subscription infrastructure provider receives the purchase receipt from Apple, validates it, and notifies our servers which entitlements you have. RevenueCat receives a pseudonymous user identifier and the purchase metadata; it does not receive contact data or personal information beyond the entitlement it manages. You can manage or cancel your iOS subscription at any time in Settings → Apple ID → Subscriptions on your device — at least 24 hours before the next renewal to avoid being charged.

Google Play Billing (Android)

Subscriptions purchased inside the Android app use Google Play Billing. Google processes the payment under the Google account associated with your device — we never see your payment card details. RevenueCat also receives the Play purchase receipt from Google, validates it, and notifies our servers which entitlements you have. RevenueCat receives a pseudonymous user identifier and the purchase metadata; it does not receive contact data or personal information beyond the entitlement it manages. Manage or cancel your Android subscription at any time in Google Play Store → Subscriptions on your device, or at play.google.com/store/account/subscriptions — at least 24 hours before the next renewal to avoid being charged.

App Tracking Transparency (iOS)

On supported iOS versions, the app may show Apple's App Tracking Transparency prompt before any feature that would identify you across other companies' apps or websites. We do not use IDFA, fingerprinting, or any cross-app/cross-site tracking. The prompt only appears as an additional consent layer on top of our standard privacy controls. Choosing "Ask App Not to Track" does not reduce app functionality.

Data Processing Agreements: We maintain Data Processing Agreements (DPAs) or equivalent contractual protections with our third-party processors where available. Most processors above process data within the EU/EEA. For processors that transfer data outside the EU/EEA (Stripe, Google, Telegram, Resend, trigger.dev, and Cloudflare in the United States), we rely on the European Commission's Standard Contractual Clauses (SCCs, 2021/914) plus supplementary measures including AES-256 encryption-at-rest, TLS 1.2+ in transit, pseudonymization of extracts, and transfer-impact assessments per Schrems II. Where applicable, we also rely on the EU-US Data Privacy Framework certification of the receiving sub-processor.

Sub-processor Change Notification

We will not engage any new or replacement sub-processor that has access to Customer Data without providing customers at least 30 days' prior notice by email to the account administrator and updating this Privacy Policy. Customers may object to a proposed sub-processor on legitimate privacy grounds within 10 days of notice; if we cannot resolve the objection, the customer may terminate the affected service without penalty for the unused portion of the term.

We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. Your contact data is yours alone.

06

6. AI Processing & Automated Decision-Making

How We Use AI

We use artificial intelligence services to:

  • Transcribe audio recordings of your conversations
  • Extract contact information from transcripts and business cards
  • Generate summaries, sentiment analysis, and actionable insights
  • Identify key topics, pain points, and opportunities

What This Means for Your Data:

  • Audio files are sent to secure third-party AI services for processing
  • Our AI providers do NOT use your data to train their models (per our data processing agreements)
  • Audio is processed in real-time and not retained by AI providers after transcription
  • We store transcripts and analysis results securely in our database

No AI Model Training on Customer Data — Binding Commitment

Aeon Kosmos LLC commits that no audio, text, image, or derived data submitted by customers (Customer Data, including voice recordings, transcriptions, business-card images, and extracted contacts) is used to train, fine-tune, or improve any AI model — neither our own models nor those of any third-party provider. Google's AI API is invoked solely in zero-retention inference mode under our paid API tier; per Google's API terms, paid-tier inputs and outputs are not used for training. No Customer Data enters any training dataset operated by Aeon Kosmos or any sub-processor.

GDPR Article 9 — Special-Category Data in Audio Recordings

Audio recordings of trade-show conversations may contain special category data under GDPR Article 9 (e.g., biometric voice characteristics, health information, political opinions, religious beliefs, racial or ethnic origin, sexual orientation, or trade-union membership disclosed during a conversation). Where you upload such audio, you (as data controller) warrant that you have a lawful basis for processing under Article 9(2) — typically explicit consent from the data subject under Article 9(2)(a). We process such recordings solely on your documented instructions as processor, with strict minimization, and we do not generate persistent voice biometrics. We strongly recommend that you avoid recording sensitive topics without explicit consent and that you delete recordings containing special-category data once their immediate business purpose has been fulfilled.

Automated Decision-Making

We do NOT use AI for automated decisions that significantly affect you (e.g., no automated account suspensions or pricing changes). All AI outputs are for your informational use only. You remain in full control of how you use the insights. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — Exporb does not engage in such processing.

EU AI Act Compliance

Under Regulation (EU) 2024/1689 (the EU AI Act, in force August 2026), our use of artificial intelligence is classified as limited-risk AI: it generates content (transcripts, summaries) and is clearly disclosed as AI-generated. We provide this notice in compliance with Article 50. You may opt out of AI features by not recording audio or scanning business cards, and the rest of Exporb's functionality remains fully available. We do not deploy any AI system Article 5 prohibits (manipulation, social scoring, real-time biometric identification, etc.) and we do not operate any high-risk AI system as defined in Annex III.

07

7. Audio Recording & Third-Party Consent

Your Legal Responsibility

You are solely responsible for complying with applicable laws when recording conversations, including:

  • All-Party Consent US States: California, Connecticut, Delaware, Florida, Hawaii, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, and Washington require consent from ALL parties to a conversation before recording.
  • One-Party Consent (US Federal & remaining states): Federal Wiretap Act (18 U.S.C. § 2511) generally permits recording with at least one party's consent, but the strictest applicable state law governs interstate calls.
  • Illinois Biometric Information Privacy Act (BIPA): If a conversation is recorded in Illinois and processed for voice biometric identification, BIPA may require additional written consent. We do not generate persistent voice biometrics from your recordings.
  • GDPR (EU/EEA/UK): Recording requires lawful basis under Article 6 (typically consent). Conversations involving health, religion, or other Article 9 categories require explicit consent.
  • Germany: § 201 StGB criminalizes secret recording. France: Article 226-1 Code Pénal requires both-party consent. UK: Investigatory Powers Act 2016 — generally one-party but employer/business calls may require notice.
  • Canada: Criminal Code §184 generally one-party, but Quebec Law 25 (in force September 2024) imposes stricter consent and cross-border rules.
  • Other Jurisdictions: Recording laws vary widely — consult a qualified attorney in your jurisdiction and the jurisdiction(s) of all participants before recording.

Best Practices

  • Always inform the other person before starting a recording
  • Obtain explicit verbal consent (recorded in the audio) or written consent
  • Respect requests to stop recording or delete recordings
  • Ensure recordings are used only for legitimate business purposes
  • Avoid recording sensitive topics (health, political opinions) without explicit consent

Exporb's Role: We provide the tools, but you control the recording. By using Exporb, you warrant that you have the necessary rights and consents to record and process audio.

08

8. Data Retention

We retain your personal information as follows:

Active Accounts

Account data and contact information retained indefinitely while your account is active.

Deleted Accounts

After account deletion, we retain data for 30 days (recovery period), then permanently delete all personal information, except:

  • Anonymized analytics (no personal identifiers)
  • Legal/financial records (tax compliance, 7 years)
  • Backups (deleted within 90 days)

Audio Recordings

You can delete individual recordings anytime. Deleted audio is permanently removed from our systems within 24 hours.

Third-Party Data Retention

  • Sentry (Error Monitoring): Error data is retained for 90 days, then automatically deleted
  • PostHog (Product Analytics): Analytics data is retained for 12 months, then automatically deleted
  • Vercel (Hosting Logs): Server logs are retained for up to 30 days
  • Cloudflare: Edge server logs for web analytics are aggregated and retained for up to 30 days; security logs (bot detection, DDoS) are retained for up to 72 hours
  • trigger.dev: Background job run logs are retained for up to 90 days; temporary job payloads containing contact data are deleted on job completion
  • Stripe: Payment records are retained as required by tax and financial regulations (typically 7 years)
  • Supabase (Cloud Database): Data is retained until account deletion, plus 30-day recovery period and 90-day backup retention
09

9. Your Privacy Rights

You have the following rights regarding your personal data:

▸ Right to Access

Request a copy of all personal data we hold about you.

▸ Right to Rectification

Correct inaccurate data (you can edit most data in Settings).

▸ Right to Erasure

Delete your account and all associated data permanently.

▸ Right to Data Portability

Export your data in machine-readable format (JSON/CSV).

▸ Right to Object

Object to processing based on legitimate interests (e.g., marketing).

▸ Right to Restrict Processing

Limit how we process your data while disputes are resolved.

▸ Right to Withdraw Consent

Withdraw consent for marketing or optional features anytime.

▸ Right to Lodge a Complaint

File a complaint with your local data protection authority.

How to Exercise Your Rights — Request Procedure

Submit your request to support@exporb.com with:

  • Subject line: "Privacy Rights Request — [Type]"
  • The email address associated with your account
  • The specific right(s) you wish to exercise

Identity Verification:

To prevent unauthorized disclosure or deletion, we will verify your identity before acting on a request. For Account Data, verification is typically by replying from the account email or completing a password-reset link. For requests involving sensitive content or large exports, we may additionally require a government-issued ID match or, for team accounts, approval by the account administrator. We will not respond to a request without successful verification.

Response Timeline:

We respond to verified requests within one (1) month of receipt under GDPR Article 12(3) and within 45 days under CCPA, extendable once by an additional two months (GDPR) or 45 days (CCPA) for complex or numerous requests, with notice to you. We provide a tracking ID on submission so you can follow up.

Customer Data Requests (B2B Customers):

If a data subject contacts us about Customer Data (e.g., a contact whose details a customer captured at a trade show), we route the request to the customer (as data controller) within 48 hours and assist the customer in fulfilling it as their processor.

10

10. Data Security

We implement industry-standard security measures to protect your data:

Encryption

All data encrypted in transit and at rest using industry-standard encryption.

Access Control

Strict data isolation ensures you only see your own data.

Password Security

Passwords are securely hashed and never stored in plain text.

Application Security

Protection against common web vulnerabilities and attacks.

Monitoring

Continuous monitoring for errors and security issues.

Regular Backups

Automated backups with point-in-time recovery capabilities.

Data Breach Notification

In the event of a confirmed personal-data breach, we follow this notification cascade:

  • Supervisory authorities: within 72 hours of becoming aware (GDPR Article 33), unless the breach is unlikely to result in a risk to rights and freedoms.
  • Affected B2B customers (controllers of Customer Data): without undue delay (typically within 24–48 hours of confirmation), with the breach facts, categories of data and records affected, likely consequences, and mitigation taken.
  • Affected data subjects directly: without undue delay where the breach is likely to result in a high risk to rights and freedoms (GDPR Article 34), via email where feasible, otherwise via in-app notice and a public notice on exporb.com.
  • US state notifications: within the timeframes required by each applicable state breach-notification statute (typically 30–60 days). California residents are notified per Cal. Civ. Code § 1798.82.

We maintain a confidential incident log of all breaches and near-miss events, and we cooperate with regulators on request.

11

11. International Data Transfers

Exporb is operated by Aeon Kosmos, LLC, a Delaware-based company. Your data may be transferred to and processed in the United States and other countries where our service providers operate.

EU-US Data Transfers

For users in the EEA, UK, or Switzerland, we rely on the following safeguards:

  • Standard Contractual Clauses (SCCs): Our Data Processing Agreements with US-based service providers include EU-approved SCCs.
  • Adequacy Decisions: Some data flows may rely on EU Commission adequacy decisions (where applicable).
  • Additional Safeguards: Encryption, pseudonymization, and access controls minimize risks of government surveillance.

If you have questions about data transfers, contact us at support@exporb.com.

12

12. Cookies & Tracking Technologies

We use cookies and similar technologies to provide and improve our service. For full details, see our Cookie Policy.

Essential Cookies (Always Active)

  • Authentication: Keeps you logged in
  • Offline Storage: Local browser storage for offline data sync
  • Preferences: Remembers your settings (dark mode, language)

Optional Cookies (Requires Consent)

  • Analytics: Error tracking and performance monitoring
  • Product Analytics: Page views and feature usage
13

13. Children's Privacy

Exporb is a business tool and is not directed at children. The Service is intended for use by individuals at least 16 years of age (18 in jurisdictions requiring older consent ages).

COPPA Compliance (United States)

Exporb does not knowingly collect or solicit personal information from anyone under the age of 13. If we learn we have collected personal information from a child under 13 without verified parental consent, we will delete that information as quickly as possible. If you believe we may have any information from or about a child under 13, please contact us at support@exporb.com.

GDPR Age of Digital Consent (EU/EEA/UK)

In the EU and UK, GDPR Article 8 requires parental consent for users under 16 (some member states have lowered this to 13). Because Exporb is a business tool, we do not process data from any user we know to be under 16 in these regions, and we have not implemented age-verified parental consent flows.

14

14. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know

Request disclosure of personal information collected, used, and shared (see Section 2).

Right to Delete

Request deletion of your personal information (see Section 9).

Right to Opt-Out of Sale

We do NOT sell your personal information. No action needed.

Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights (no price differences, service denials, or quality degradation).

Do Not Sell or Share My Personal Information

We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising. If you wish to exercise your right to opt out of any future sale or sharing of personal information, you can do so from your Privacy Settings page or by contacting us at support@exporb.com.

To exercise your rights, email support@exporb.com with "CCPA Request" in the subject line.

14b

14b. Other US State Privacy Rights

If you reside in a US state with a comprehensive privacy law, you may have rights similar to those described in Section 14 (CCPA). The following state laws are currently in force and we honor equivalent rights for residents of these states:

  • Virginia — VCDPA (in force 2023)
  • Colorado — CPA (in force 2023)
  • Connecticut — CTDPA (in force 2023)
  • Utah — UCPA (in force 2023)
  • Texas — TDPSA (in force 2024)
  • Oregon — OCPA (in force 2024)
  • Montana — MCDPA (in force 2024)
  • Iowa — ICDPA (in force 2025)
  • Delaware — DPDPA (in force 2025)
  • New Jersey — NJDPA (in force 2025)
  • Tennessee — TIPA (in force 2025)
  • Indiana — INCDPA (in force 2026)
  • Kentucky — KCDPA (in force 2026)
  • Maryland — MODPA (in force 2026)
  • Minnesota — MCDPA (in force 2025)
  • Rhode Island — RIDTPPA (in force 2026)

Rights Granted Across These States

  • Right to access — confirm whether we process your personal data and receive a copy
  • Right to correct — request correction of inaccurate personal data
  • Right to delete — request deletion of personal data we hold about you
  • Right to data portability — receive your data in a portable format
  • Right to opt out of (a) sale of personal data, (b) targeted advertising, and (c) profiling for decisions producing legal or similarly significant effects
  • Right to appeal — challenge our refusal to act on a request

We do not engage in the sale of personal data, targeted advertising, or profiling that produces legal effects, so the opt-out right is satisfied by our default behavior. Email support@exporb.com with your state and the right you wish to exercise. We will respond within 45 days (extendable to 90 with notice). If we deny your request, you may appeal to the same address; we will respond to appeals within 60 days.

14c

14c. International Privacy Rights

Brazil (LGPD)

If you reside in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018), including: confirmation of processing, access to your data, correction, anonymization, blocking, deletion, data portability, and withdrawal of consent. Aeon Kosmos LLC acts as the data controller. To exercise your rights, contact support@exporb.com with subject line "LGPD Request." We will respond within 15 days. You may also file a complaint with Brazil's data protection authority (ANPD) at gov.br/anpd.

Quebec, Canada (Law 25)

If you reside in Quebec, you have rights under An Act to modernize legislative provisions as regards the protection of personal information (Law 25, in force September 2024), including: access, correction, deletion, the right to data mobility, and the right to know about cross-border transfers and automated decision-making. We do not currently provide a French-language version of this Privacy Policy — please contact us if you require translated materials. To exercise your rights, contact support@exporb.com. We will respond within 30 days. You may also file a complaint with the Commission d'accès à l'information at cai.gouv.qc.ca.

Other Canadian Provinces (PIPEDA)

For residents of Canadian provinces other than Quebec, the Personal Information Protection and Electronic Documents Act (PIPEDA) grants similar rights of access, correction, and complaint. The Office of the Privacy Commissioner of Canada is the regulator: priv.gc.ca.

Australia (Privacy Act 1988)

Australian residents have rights under the Privacy Act 1988 and the Australian Privacy Principles. Contact us with "APP Request" in the subject line. The Office of the Australian Information Commissioner (OAIC) is the regulator: oaic.gov.au.

15

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features.

How We Notify You:

  • We will update the "Last updated" date at the top of this page
  • For material changes, we will email you at your registered email address
  • Continued use of Exporb after changes constitutes acceptance

We recommend reviewing this policy periodically for any changes.

16

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Aeon Kosmos, LLC

Email

support@exporb.com

(Response time: 24-48 hours for privacy requests)

Mailing Address

9169 W State St, Ste 3694

Garden City, ID 83714

USA

Legal Entity

Aeon Kosmos, LLC

Registered in Delaware, USA

EU/UK Data Protection Representative:

If we reach significant EU/UK user base, we will appoint a GDPR representative. Currently, contact us at the email above for all privacy inquiries.