Privacy Policy

• Account Data: When you register, we collect your name, email address, company name, and a hashed password. We also store your subscription status and plan, and account timestamps (creation, last update, password change).
• Uploaded Documents: The PDFs you upload for conversion, along with the extracted line items, claim number, property address, insured name, phone number, email address, carrier name, and conversion totals we process from them. We also generate and store the resulting ESX files for re-download.
• Usage Data: Conversion counts, feature usage, API request logs, and file metadata (file names, sizes, status).
• Payment Data: Billing is processed entirely by Stripe. ESXPress never sees or stores your full credit card number. We receive only subscription status, plan tier, and transaction metadata from Stripe.
• Technical Data: IP address, browser type, and device information, collected via standard server logs for security and performance monitoring.

• Process PDF documents into Xactimate ESX files and store the output for re-download
• Manage your account, subscriptions, and billing
• Send service-related emails (password resets, billing notices, deletion confirmations)
• Monitor and improve service performance and security
• Enforce usage limits based on your subscription plan
• Comply with legal obligations and prevent fraud or abuse

We do NOT sell, rent, lease, or share your personal data with third parties for their marketing purposes. Ever. We do not use your documents or data for advertising, and we do not train AI models on your documents (see Section 3).

ESXPress uses third-party AI providers to read and extract line items from the documents you upload:

• DeepSeek (deepseek-chat) — AI text extraction of line items from the text of uploaded scope PDFs.
• Google Gemini (gemini-flash-latest) — performs OCR / vision analysis on photos and images (for example, Photo-Scope damage detection and image-based scope reading).

When you upload a PDF or photo, the relevant document content is transmitted to these providers solely to generate output for your account. We do not use your documents to train AI models, we do not fine-tune models on customer documents, and we do not sell or share your documents for third-party model training. AI output can be wrong — you are solely responsible for reviewing every line item, price, and total before submitting to any carrier, adjuster, or customer. See our AI Disclosure for details.

For data submitted through our REST API or under an OEM, Reseller, or API Partnership (for example, structured JSON converted to an ESX file), the same commitments apply: the data is processed only to generate the requested output, is not used to train AI models or improve the product, and is not combined with other customers’ data except in de-identified, aggregated form described in Section 8.

Separately, and only with your consent at signup, the layout structure of your scope PDFs (section names, column patterns — never personal information) may be added to our anonymized product-improvement dataset. This is described in Section 8 below, and you may opt out at any time.

Subprocessors

In addition to the AI providers above, the following subprocessors may process data in connection with the Service:

• Stripe — Payment processing and billing. Stripe handles all card payments; we never see or store full card numbers.
• Supabase — PostgreSQL database hosting for account and conversion data.
• Cloudflare — DNS, CDN, and DDoS protection in front of esxpress.org.
• Hostinger — VPS hosting of the application server and uploaded files (United States — Phoenix, AZ).
• SMTP email relay (Google Workspace, smtp.gmail.com) — Delivery of transactional email (password resets, billing notices, deletion confirmations).
• Mailgun — Email delivery event webhooks (delivery, bounce, and complaint processing).
• Slack — Slack bot integration for workspace commands (only for tenants that connect a Slack workspace).

Each subprocessor processes data under its own privacy policy and applicable data-processing terms. We review and update this list as providers change.

Your data is stored in a Supabase (PostgreSQL) database and on our secured VPS (Hostinger, United States — Phoenix, AZ). Uploaded files are stored on the application server’s disk.

• Conversion data: Conversions and their metadata (line items, totals, claim info) are retained for the life of your account. This is what powers your History and re-download.
• Optional file retention window: If enabled on your account, source PDFs and generated ESX files are purged once they are older than your retention window (configurable between 1 and 30 days). A daily purge job deletes those files; your conversion metadata remains in the database.
• Scheduled source-file cleanup: Separately, a scheduled platform cleanup removes uploaded source PDFs that are more than 30 days old from file storage. Conversion records and metadata remain in the database, and generated ESX files are not affected by this cleanup.
• Deleted conversions: When you delete a conversion, it is soft-deleted so it no longer appears in your History. Its records and any stored files are then handled under the retention practices described above; we do not operate a separate scheduled purge that permanently erases deleted conversion records.
• Account deletion: When you request account deletion (see Section 8), your account is deactivated immediately, API keys are revoked, and webhooks and email-ingest tokens are disabled. Stored files are then handled under the retention practices described above; we do not operate a scheduled purge that erases database records after a set number of days. If you need data removed sooner, contact us and we will help.
• API keys: API keys are stored hashed; the raw key value is never stored and cannot be retrieved after creation.
• Anonymized data: Anonymized, aggregated data may be retained for analytics and service improvement after deletion.

We use the following third-party services. Each processes data under its own privacy policy:

• Stripe — Payment processing. Stripe Privacy Policy
• Supabase — Database hosting. Supabase Privacy Policy
• Cloudflare — DNS, CDN, and DDoS protection. Cloudflare Privacy Policy
• DeepSeek — AI text extraction of line items from uploaded PDFs. DeepSeek Privacy Policy
• Kimi-k3 (via the opencode.ai gateway) — vision OCR fallback that reads page images when a document has no usable text layer. Page images only; no account data.
• Google Gemini — OCR and vision analysis of uploaded photos and images. Google Privacy Policy
• Mailgun — Email delivery event webhooks (delivery, bounce, and complaint processing). Mailgun Privacy Policy
• SMTP (Google Workspace) — Transactional email delivery via our configured SMTP relay (smtp.gmail.com). Google Workspace Privacy
• Slack — Slack bot integration for workspace commands. Slack Privacy Policy

ESXPress uses essential cookies required for the service to function (listed below). Since August 27, 2026, it also uses the Google tag (GA4 measurement ID G-JR0NTXGRXN) for aggregate page views and signup conversion events — it sets standard Google-analytics cookies on builds where analytics is enabled. The full list is in our Cookie Policy.

• Session presence marker — an esx_token cookie (Secure, SameSite=Lax) marks that you logged in on this browser so protected pages can load. It contains no token or other credentials: your session token lives only in browser storage and is sent as an Authorization header, validated server-side on every request: access tokens expire after 2 hours, and sessions time out after 30 minutes of inactivity (12-hour absolute maximum).
• CSRF token — A security cookie (Secure, SameSite=Strict) that prevents cross-site request forgery.
• Browser storage — Used to hold your session token and to remember UI preferences such as tour completion status. The session token is transmitted to our servers with API requests; UI preferences are not.

We do NOT serve advertising cookies of our own and do not use third-party tracking pixels. The Google tag described above — including the Ads click identifier it may set while Google Ads conversion tracking is active — is the only ad-adjacent cookie, and we never sell or share data. You can control cookies through your browser settings, and you can reach us at any time at hello@esxpress.org.

We implement industry-standard security measures:

• All traffic encrypted via TLS (HTTPS)
• Passwords hashed using bcrypt (never stored in plaintext)
• JWT tokens signed and verified server-side
• CSRF protection on all state-changing endpoints
• Rate limiting on authentication and API endpoints
• Database access restricted to application servers only
• Regular security audits and dependency updates
• Incident Response & Breach Notification (72 hours): We operate a formalized incident-response workflow for security incidents affecting your data:
  • Detection: Security monitoring, automated alerts, and user reports are continuously reviewed for potential incidents.
  • Containment & Assessment: Upon detection, we contain the incident, preserve evidence, and assess scope, root cause, and impact on personal data.
  • Customer Notification: In the event of a confirmed breach affecting your personal data, affected customers are notified within 72 hours of confirmation. Notifications describe the nature of the incident, the categories of data involved, the likely consequences, and the measures taken or proposed to address it.
  • Regulatory Notification: Where required by law (including GDPR Articles 33–34 and applicable state breach-notification statutes), we notify relevant supervisory authorities and, where required, affected individuals within the legally mandated timeframes.
  • Remediation & Review: We remediate the root cause, restore service integrity, and document the incident with a post-incident review to prevent recurrence.
  See our Security page for the full incident-response commitment.

No method of transmission or storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. ESXPress gives you direct, self-service control over your data:

• Export your data: You can download a copy of the personal data we hold for your account — your profile, conversion history (metadata and totals), API keys, webhooks, email-ingest tokens, and account settings — as a JSON file at any time via our authenticated API endpoint POST /api/v1/privacy/export. The export does not include the uploaded documents themselves, their full line-item detail, server log data, or IP addresses; contact us if you need help assembling a complete record.
• Delete your data: You can request account deletion via our authenticated API endpoint POST /api/v1/privacy/delete. This requires typing the word “DELETE” as confirmation. Your account is deactivated immediately, all API keys are revoked, and webhooks and email-ingest tokens are disabled. Stored files are then handled under the retention practices described in Section 4; we do not operate a scheduled purge that erases database records after a set number of days, and if you need data removed sooner, contact us and we will help.
• Delete individual conversions: You can delete individual conversions, uploaded PDFs, and generated ESX files at any time from the Dashboard (History). Deleted conversions are soft-deleted and handled under the retention practices described in Section 4.
• Opt out of anonymized improvement data:
  With your consent (granted at signup — see our Terms of Service §7), ESXPress may use your uploaded scope PDFs — in anonymized form only — to improve conversion accuracy. The improvement dataset contains only layout structure: section names, line-item column patterns, extraction method, and layout signatures. It never contains names, addresses, claim numbers, policy numbers, phone numbers, email addresses, or any other personal information. Anonymization is applied programmatically (deterministic redaction) before any data is stored, and tenant identity is stored only as an irreversible salted hash. You may opt out at any time by emailing hello@esxpress.org(or by unchecking the consent box at signup); opted-out accounts are excluded from the improvement dataset immediately, and opting out never affects your ability to use the Service.

If you prefer not to use the API, you can exercise any of these rights by emailing hello@esxpress.org. We will respond within 30 days.

ESXPress is not intended for use by anyone under the age of 18. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, contact us immediately and we will delete it.

Your data is stored on servers in the United States: the application server runs on a Hostinger VPS (Phoenix, AZ) and the database is hosted on Supabase (AWS us-west-2, Oregon). By using ESXPress, you consent to the transfer of your data to these locations. We ensure appropriate safeguards are in place for any international data transfers.

We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders. Continued use of ESXPress after changes constitutes acceptance of the updated policy.

For privacy-related inquiries — including access, correction, export, or deletion requests — contact us: