Legal

Privacy Policy

Last updated 2026-04-30

Plain-language draft. This page is a working summary. The full counsel-reviewed terms are available on request via [email protected].

We're a B2B SaaS used by expedition leaders. We collect minimum data to run the service, never sell it, and host EU-resident by default.

What we collect

From operators: name, email, business name, payment method (held by Stripe — we see metadata only), workspace usage data, audit logs of in-app actions.

From guests of operators: we are a processor for whatever the operator collects (name, email, dietary, passport, etc.). The operator decides what's collected; we provide the tools to handle it safely.

From visitors: server-side analytics of page views and referrers. No tracking cookies until consented.

Why we collect it

To run the service: authenticate you, bill you, render the right data to the right people, send transactional email, prevent abuse, comply with legal obligations.

Where it lives

EU residency by default. Postgres, file storage, email, observability — all in EU regions. Stripe is the only inevitable cross-region dependency, covered by Stripe's DPA.

Who we share it with

Sub-processors only — Stripe (payments), Resend (email), Cloudflare (CDN/storage), Sentry (error tracking), Axiom (logs). Each is GDPR-compliant. Full list available on request.

Your rights

You can ask us to access, export, correct, or delete your personal data. Operators can fulfil the same rights for their guests via the in-app data tools. Email [email protected].

Retention

Active tenants: data retained while the subscription is active. Cancelled tenants: 30-day soft-delete, then hard-purge.

Sensitive guest fields (passport, medical) auto-purge a configurable number of days after the related Trip completes (V1).

Cookies

Marketing pages are cookie-less by default. The app uses an HttpOnly session cookie scoped to app.exply.app, strictly necessary for log-in. Optional analytics cookies are consent-gated. Details in our Cookies notice.