Privacy Policy

• Account Data: When you register, we collect your name, email address, company name, and a hashed password. We also store your subscription status and plan, and account timestamps (creation, last update, password change).
• Uploaded Documents: The PDFs you upload for conversion, along with the extracted line items, claim number, property address, insured name, phone number, email address, carrier name, and conversion totals we process from them. We also generate and store the resulting ESX files for re-download.
• Usage Data: Conversion counts, feature usage, API request logs, and file metadata (file names, sizes, status).
• Payment Data: Billing is processed entirely by Stripe. ESXPress never sees or stores your full credit card number. We receive only subscription status, plan tier, and transaction metadata from Stripe.
• Technical Data: IP address, browser type, and device information, collected via standard server logs for security and performance monitoring.

• Process PDF documents into Xactimate ESX files and store the output for re-download
• Manage your account, subscriptions, and billing
• Send service-related emails (password resets, billing notices, deletion confirmations)
• Monitor and improve service performance and security
• Enforce usage limits based on your subscription plan
• Comply with legal obligations and prevent fraud or abuse

We do NOT sell, rent, lease, or share your personal data with third parties for their marketing purposes. Ever. We do not use your documents or data for advertising, and we do not train AI models on your documents (see Section 4).

ESXPress uses third-party AI providers to read and extract line items from the documents you upload:

• DeepSeek (deepseek-chat) — LLM text extraction of line items from the text of uploaded scope PDFs.
• Google Gemini (gemini-flash-latest) — performs OCR / vision analysis on photos and images (for example, Photo-Scope damage detection and image-based scope reading).

When you upload a PDF or photo, the relevant document content is transmitted to these providers solely to generate output for your account. We do not use your documents to train AI models, we do not fine-tune models on customer documents, and we do not sell or share your documents for third-party model training. AI output can be wrong — you are solely responsible for reviewing every line item, price, and total before submitting to any carrier, adjuster, or customer. See our AI Disclosure for details.

Separately, and only with your consent at signup, the layout structure of your scope PDFs (section names, column patterns — never personal information) may be added to our anonymized product-improvement dataset. This is described in Section 8 below, and you may opt out at any time.

Subprocessors

In addition to the AI providers above, the following subprocessors may process data in connection with the Service:

• Stripe — Payment processing and billing. Stripe handles all card payments; we never see or store full card numbers.
• Supabase — PostgreSQL database hosting for account and conversion data.
• Cloudflare — DNS, CDN, and DDoS protection in front of esxpress.org.
• Hostinger — VPS hosting of the application server and uploaded files (Germany datacenter).
• SMTP email relay (Google Workspace, smtp.gmail.com) — Delivery of transactional email (password resets, billing notices, deletion confirmations).
• Mailgun — Email delivery event webhooks (delivery, bounce, and complaint processing).
• Slack — Slack bot integration for workspace commands (only for tenants that connect a Slack workspace).

Each subprocessor processes data under its own privacy policy and applicable data-processing terms. We review and update this list as providers change.

Your data is stored in a Supabase (PostgreSQL) database and on our secured VPS (Hostinger, Germany datacenter). Uploaded files are stored on the application server’s disk.

• Conversion data: Conversions and their metadata (line items, totals, claim info) are retained for the life of your account. This is what powers your History and re-download.
• Optional file retention window: If enabled on your account, source PDFs and generated ESX files are purged once they are older than your retention window (configurable between 1 and 30 days). A daily purge job deletes those files; your conversion metadata remains in the database. By default, files are kept until you delete them.
• Deleted conversions: When you delete a conversion, it is soft-deleted and permanently purged after 90 days.
• Account deletion: When you request account deletion, your account is deactivated immediately and your personal data is permanently purged within 90 days (see Section 7).
• API keys: API keys are stored hashed; the raw key value is never stored and cannot be retrieved after creation.
• Anonymized data: Anonymized, aggregated data may be retained for analytics and service improvement after deletion.

We use the following third-party services. Each processes data under its own privacy policy:

• Stripe — Payment processing. Stripe Privacy Policy
• Supabase — Database hosting. Supabase Privacy Policy
• Cloudflare — DNS, CDN, and DDoS protection. Cloudflare Privacy Policy
• DeepSeek — AI text extraction of line items from uploaded PDFs. DeepSeek Privacy Policy
• Google Gemini — OCR and vision analysis of uploaded photos and images. Google Privacy Policy
• Mailgun — Email delivery event webhooks (delivery, bounce, and complaint processing). Mailgun Privacy Policy
• SMTP (Google Workspace) — Transactional email delivery via our configured SMTP relay (smtp.gmail.com). Google Workspace Privacy
• Slack — Slack bot integration for workspace commands. Slack Privacy Policy

ESXPress uses only essential cookies required for the service to function:

• Authentication cookies — JWT tokens to keep you logged in (httponly, secure, SameSite=Lax).
• CSRF tokens — Security cookies to prevent cross-site request forgery.
• Local storage — Used to remember your tour completion status and UI preferences. Not transmitted to our servers.

We do NOT use tracking cookies, analytics cookies, advertising cookies, or any third-party tracking pixels.

We implement industry-standard security measures:

• All traffic encrypted via TLS (HTTPS)
• Passwords hashed using bcrypt (never stored in plaintext)
• JWT tokens signed and verified server-side
• CSRF protection on all state-changing endpoints
• Rate limiting on authentication and API endpoints
• Database access restricted to application servers only
• Regular security audits and dependency updates
• Incident Response & Breach Notification (72 hours): We operate a formalized incident-response workflow for security incidents affecting your data:
  • Detection: Security monitoring, automated alerts, and user reports are continuously reviewed for potential incidents.
  • Containment & Assessment: Upon detection, we contain the incident, preserve evidence, and assess scope, root cause, and impact on personal data.
  • Customer Notification: In the event of a confirmed breach affecting your personal data, affected customers are notified within 72 hours of confirmation. Notifications describe the nature of the incident, the categories of data involved, the likely consequences, and the measures taken or proposed to address it.
  • Regulatory Notification:Where required by law (including GDPR Articles 33–34 and applicable state breach-notification statutes), we notify relevant supervisory authorities and, where required, affected individuals within the legally mandated timeframes.
  • Remediation & Review: We remediate the root cause, restore service integrity, and document the incident with a post-incident review to prevent recurrence.
  See our Security page for the full incident-response commitment.

No method of transmission or storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. ESXPress gives you direct, self-service control over your data:

• Export your data: You can download a complete copy of all personal data we hold for your account — your profile, conversion history, API keys, webhooks, and account settings — as a JSON file at any time via our authenticated API endpoint POST /api/v1/privacy/export. This is a full data-subject access request (DSAR) export: nothing is omitted.
• Delete your data: You can request account deletion via our authenticated API endpoint POST /api/v1/privacy/delete. This requires typing the word “DELETE” as confirmation. Your account is deactivated immediately, all API keys are revoked, and webhooks are disabled. Your personal data is then permanently purged within 90 days.
• Delete individual conversions: You can delete individual conversions, uploaded PDFs, and generated ESX files at any time from the Dashboard (History). Deleted conversions are permanently purged after 90 days.
• Opt out of anonymized improvement data:
  With your consent (granted at signup — see our Terms of Service §7), ESXPress may use your uploaded scope PDFs — in anonymized form only — to improve conversion accuracy. The improvement dataset contains only layout structure: section names, line-item column patterns, extraction method, and layout signatures. It never contains names, addresses, claim numbers, policy numbers, phone numbers, email addresses, or any other personal information. Anonymization is applied programmatically (deterministic redaction) before any data is stored, and tenant identity is stored only as an irreversible salted hash. You may opt out at any time by emailing [email protected](or by unchecking the consent box at signup); opted-out accounts are excluded from the improvement dataset immediately, and opting out never affects your ability to use the Service.

If you prefer not to use the API, you can exercise any of these rights by emailing [email protected]. We will respond within 30 days.

ESXPress is not intended for use by anyone under the age of 18. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, contact us immediately and we will delete it.

Your data is stored on servers in Germany (Hostinger) and the United States (Supabase). By using ESXPress, you consent to the transfer of your data to these locations. We ensure appropriate safeguards are in place for any international data transfers.

We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders. Continued use of ESXPress after changes constitutes acceptance of the updated policy.

For privacy-related inquiries — including access, correction, export, or deletion requests — contact us: