# exployt.ai Privacy Summary
Last updated: 2026-07-07
Canonical privacy policy: https://exployt.ai/privacy
Legal page privacy section: https://exployt.ai/legal#privacy

## Controller
exployt Software GmbH, Lange Gasse 30, 8010 Graz, Austria is responsible for processing personal data on the website and account service. Contact: office@exployt.ai.

## Data categories
exployt processes account data, authentication data, billing data, license state, support/feedback content submitted by the user, operational logs, account-security data, fraud-prevention data and the limited data needed to run the public website and account service.

## Project content and AI provider keys
Customer source code, file contents, local project databases, local project files and local AI-provider API keys are not collected by exployt's cloud for ordinary desktop-app operation. They remain under customer control unless the customer explicitly sends content through a chosen integration or support channel.

## Data residency
The primary production web service is hosted on Microsoft Azure in the West Europe region (Netherlands). Some third-party providers may process limited data outside the EEA under their own transfer mechanisms and contractual safeguards.

## Third-party services and subprocessors
Current providers for the public website and account service include Microsoft Azure, Stripe, Resend, MaxMind offline geolocation data, and optional Google Analytics 4 / Microsoft Clarity website analytics where enabled. Customer-selected AI providers are separate third parties chosen by the customer.

## Security
Traffic uses HTTPS/TLS. Passwords are bcrypt hashed. Selected sensitive server-side fields use AES-GCM encryption and lookup hashes. Local Windows secrets use DPAPI. Local project database encryption is available through desktop app settings, but it is not claimed as enabled for every local database by default.

## GDPR rights and DPA
Users may request access, rectification, deletion, restriction, portability, objection or consent withdrawal where applicable by contacting office@exployt.ai. Business and enterprise customers can request a Data Processing Agreement at office@exployt.ai. Some data must be retained for legal, tax, accounting, fraud-prevention, dispute or security reasons.