Privacy Policy

1. Who we are

Ekspo is made by Criotech (“we”, “us”). We are the data controller for the information described here. You can reach us at support@ekspoai.com.

2. The short version

• Audio is transcribed on your computer and never uploaded.
• Transcripts, answers and your profile are stored only on your computer.
• To write an answer, the app sends the question or screenshot, the last few transcript lines and your profile to our servers and on to our AI provider, Anthropic.
• On our servers we keep your account email, your subscription status, payment metadata from Paystack (never card numbers) and usage counts for billing.
• “Delete account” inside the app cancels your subscription and removes your server data.

3. What we collect and store on our servers

Account

Your email address and a hashed password (or the identifier from another sign-in method we offer), the date you signed up, and the identifier of the computer used for the free trial so we can enforce one trial per computer.

Subscription and payment metadata

Which plan you are on, when it started, renews or was cancelled, and the records Paystack sends us about each payment: a transaction reference, amount, currency, status, date, and the card brand and last four digits or bank name if Paystack provides them. Card numbers, CVV and bank log-in details go directly to Paystack. We never see or store them.

Usage metering

A count of the answers generated on your account, with timestamps, the type of request (spoken question, typed question or screenshot) and the plan it was counted against. This is used for billing, fair-use limits and abuse prevention. The metering record does not include the content of the question, transcript or answer.

Support

If you email us, we keep the correspondence so we can help you and refer back to it.

4. What is processed for each answer

When the app writes an answer, it sends this to our servers:

• the question it detected or that you typed, or the screenshot of the region you selected (Pro);
• the recent transcript lines, a short window of the conversation so the answer fits the context;
• your profile: the resume, job description and notes you added inside the app.

Our server checks your plan and usage, then forwards the request to Anthropic, our AI provider, which generates the answer and returns it. In this role Anthropic acts as a processor on our instructions, under its commercial terms, and does not use the content to train its models. We send only what is needed for the answer. We do not send audio, and we do not send your whole transcript.

The screenshot you select may contain whatever is on your screen at that moment, including other people’s names or messages. Select only what you want explained.

5. What stays on your computer

• Audio. Captured from your computer’s audio output and transcribed locally by a speech-recognition model that runs on your machine. The audio is not recorded to disk by Ekspo and is never uploaded.
• Transcripts. Saved in a folder on your computer that you control. We have no copy.
• Answers and your profile. Stored locally by the app. Your profile is sent with each answer request (section 4) but is not stored on our servers.

These files are yours. Deleting your account does not delete them; uninstalling the app or deleting its data folder does. Because they are on your computer, your own backups (such as Time Machine or iCloud) may include them.

6. How long we keep things

• Account, subscription and usage records: for as long as your account exists, then deleted when you delete the account (section 8). Copies in our provider’s backups are overwritten on their normal schedule, typically within 30 days.
• Answer requests: the content of a request is processed to produce the answer and is not kept in our database. Short-lived server logs used for debugging and abuse prevention may hold request metadata (timestamps, sizes, errors) for up to 30 days.
• Payment records: transaction metadata may be kept for up to six years after the payment to meet accounting and tax obligations, even after the account is deleted.
• Support email: up to two years after the conversation ends.

7. Why we are allowed to process this

Under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (NDPR) we rely on: performance of our contract with you (running the app, writing answers, billing); our legal obligations (tax and accounting records); and our legitimate interests in keeping the service secure, preventing abuse and enforcing the one-trial-per-computer rule. We do not sell your data and we do not use it for advertising.

8. Deleting your data

Open Ekspo, go to your account and choose Delete account. This cancels any active subscription and removes your account, subscription and usage records from our servers. It does not remove the transcripts, answers and profile stored on your computer; those are yours to keep or delete. If you cannot get into the app, email us from the address on the account and we will delete it for you.

9. Who else processes your data (subprocessors)

We use these providers to run Ekspo. Each one only receives what its job needs.

Some of these providers are outside Nigeria. Where personal data leaves Nigeria we rely on the provider’s contractual commitments and the safeguards allowed by the NDPA and NDPR. We will update this list if we add or change a provider.

10. This website

The website sets no advertising or tracking cookies. The browser sign-in page (/desktop-login) uses browser storage to complete your sign-in and hand a one-time code back to the app. Vercel, which hosts the site, keeps standard request logs for security.

11. Security

Data travels over encrypted connections (HTTPS). Server data is stored with providers that encrypt it at rest, and access is limited to the people who need it to run the service. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the regulator as the law requires.

12. Your rights

Under the NDPA and NDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data (the in-app Delete account button does this);
• restrict or object to certain processing;
• give you your data in a portable format;
• withdraw consent where we rely on it.

Email support@ekspoai.com and we will respond within the time the law allows. You also have the right to complain to the Nigeria Data Protection Commission.

13. Children

Ekspo is for people aged 18 and over. We do not knowingly collect data from children; if you think we have, contact us and we will delete it.

14. Changes

We may update this policy as the product changes. The date at the top shows the latest version. If a change is significant we will tell you by email or inside the app before it takes effect.

15. Contact

Privacy questions and requests: support@ekspoai.com, or see the contact page.