Your work.
Your privacy.
What Eksprt handles, where it goes, and the choices you have.
You choose the provider for each request. Your completed text conversation follows when you change models. Saved memories are added only when that provider has permission. API keys are stored encrypted; your workspace is not end-to-end encrypted.
01. Who operates Eksprt
Eksprt operates this Eksprt service and is responsible for the personal information it handles through this website and workspace. You can reach the operator through our contact form by selecting Privacy & data.
This policy covers this installation of Eksprt. AI providers have their own privacy terms for their services. Eksprt is an independent interface and is not operated by those providers.
02. Information we handle
- Account details: your name, email address, password hash, and information used for sign-in and password resets.
- Connected tools: API credentials you supply, connection settings, selected models and capabilities, account model lists, and model-specific memory permissions.
- Your work: conversation titles, prompts, replies, saved memories, image-generation requests and results, and related provider/model identifiers.
- Usage and subscriptions: request status, token counts, available cost estimates, and subscription details you enter manually. Polar handles payment card details; Eksprt stores billing references and subscription status.
- Contact requests: your name, email, topic, message, a submission reference, acknowledgement of this policy version, and the request's delivery and resolution status.
- Technical information: session and security information, including IP address and browser information associated with sessions or hosting logs. Hosting systems may record request times, requested paths, and errors.
Please avoid including API credentials, passwords, or unnecessary sensitive personal information in conversations or contact messages. Only provide information you are entitled to share.
03. How it is used
We use information to create and secure accounts, keep your workspace available, send requests to the providers you select, preserve conversations and preferences, show recorded usage, and respond to support or privacy requests. We also use limited technical information to prevent misuse and investigate failures.
Where a legal basis is required, providing the requested service generally relies on performance of a contract; maintaining security and responding to enquiries generally relies on legitimate interests, balanced against your rights. Some processing may be necessary to meet a legal obligation. If a particular activity requires consent, it must be obtained for that activity and can be withdrawn as applicable.
The current application has no advertising trackers, automated advertising profiles, or pipeline for training our own AI models on your conversations. Third-party providers may handle submitted information differently under their own terms and account settings.
04. What your AI providers receive
When you send a text request, the selected provider receives your prompt and the completed text messages in that conversation, plus enabled saved memories if you granted that exact provider/model access. Switching models can therefore send earlier conversation text to a different provider. Failed or unfinished replies are not added as completed conversation history.
Saved-memory access starts off for new models. Turning it off stops adding those saved memories to subsequent requests for that model. It does not remove facts already included in conversation text or retract information a provider has already received. Start a new conversation if you do not want to carry earlier text forward.
Image generation sends the image prompt and required generation settings to the chosen provider; it does not send the full text conversation or saved-memory list. OpenAI and Gemini output images are stored privately on the application server and are served only to the account owner. Higgsfield results use provider-hosted URLs; displaying these can connect your browser to the image host.
Your API credentials are used server-side to authenticate provider requests, including model discovery. Connecting an API does not import your consumer ChatGPT or Claude chat history, subscription invoices, or other provider account activity. Review each provider's privacy policy, retention controls, and API terms before connecting.
06. Storage, protection, and retention
Uploaded files: files are stored on private server storage, with their names, sizes, checksums and processing status in the database. Readable text may be extracted for chat. Files are not sent to model providers just by uploading them. When you attach a chat-ready file and send a message, its extracted text is sent to the selected provider and retained in that conversation, including when you switch models. File contents are reference data, not shared memories. Media messages retain file references; deleting the original file makes those references unavailable. Provider conversation state needed for some models is encrypted and sent back only to that same provider and model, not included in workspace exports. Images can be sent to compatible vision models. Audio and video are sent through Gemini’s Files API when requested, where provider copies normally expire after 48 hours. Sending a message starts that transfer; merely uploading a file to Eksprt does not. Archives remain download-only. Generated documents and images are stored privately, appear in Files, and count toward your plan storage allowance. You can delete generated images from Eksprt to remove the saved image and free its storage; usage history remains.
You can delete an uploaded file from the file library. Extracted text already included in a conversation remains until you delete that conversation. Completed uploads remain until you remove them or delete your account. Incomplete uploads expire after 24 hours without progress. Files are not end-to-end encrypted; authorized server operators and configured backup services can access them.
API credentials are encrypted in the database using the application's encryption key. Passwords are hashed. Conversations, saved memories, usage, and contact records are stored in the application database and are not end-to-end encrypted. Authorized server operators can access stored information. No system can guarantee absolute security.
Workspace information is retained while your account is active, unless you remove it. You can delete conversations and memories individually or delete your account in Settings. Removing a connection removes its stored credentials; it does not automatically delete past conversations or usage records. Deleting a conversation does not delete its usage record.
Contact submissions are scheduled for deletion after 180 days, including resolved submissions. They are stored separately from accounts, so account deletion does not automatically remove a contact request. Include its reference when requesting earlier deletion.
Account deletion removes the application's account-linked workspace records. Previously submitted provider requests, emails, hosting logs, and backups are not erased by that action. Backup and technical-log retention depends on this installation's infrastructure; ask us for its current schedule. Information may need to be retained longer where the law requires it.
08. Your choices and rights
In the workspace, you can change model permissions, remove memories and conversations, disconnect API credentials, export your workspace data without API keys, and delete your account. Revoking credentials at the provider is a separate step.
Depending on your location and applicable law, you may have rights to access, correct, delete, receive a portable copy of, restrict, or object to certain processing of your personal information. Where consent applies, you may withdraw it without affecting processing that was lawful before withdrawal. You may also complain to your local data protection authority.
Send a request using Privacy & data in the contact form. Explain what you need and use your account email where possible. We may need proportionate verification to protect your account; do not send identity documents or secrets through the form unless a suitable process has been agreed. Requests are handled under the deadlines and exceptions that apply to your location.
09. Age requirements
This service is not intended for children under 13. Users must also meet any higher minimum age and permission requirements that apply in their location and for each connected provider. If you believe a child has provided information contrary to these requirements, contact us so it can be reviewed and addressed.
10. Updates and contact
This policy may change as the service or its processing changes. The effective date appears at the top. Material changes require appropriate notice where applicable law requires it.
Questions about your data? Send a privacy request. For rules on using the service, see our Terms & conditions.