Privacy & Security

Who is responsible for your data?

Export Reader is a project of Málaga Web Designs. The data controller is Lee Daniel Nolan, operating as an autónomo in Spain.

Lee Daniel Nolan · autónomo · Málaga Web Designs
NIF: X8282504C
Calle José Carlos Urbano 22, 18280 Algarinejo, Granada, España
hello@malagawebdesigns.com · +34 628 57 44 33

For account support, privacy requests or concerns about an uploaded archive, use support@exportreader.com or the operator's contact details above. See the legal notice.

Information we use

• Account: email, a password hash for password accounts, verification/reset tokens stored as hashes, sign-in timestamps, plan and preferences. Google sign-in also provides your Google identifier and the profile details supplied through that flow.
• Your archive: uploaded conversation exports and media; extracted messages, titles, dates, tags, snippets, folders and search indexes; descriptions or summaries produced by the features you choose.
• Billing: plan, Stripe customer/subscription/invoice identifiers, payment status and allowance/usage records. Stripe collects payment-method details on its site; we do not store full card numbers or card security codes.
• Security and support: IP address, browser/device information, request dates, security events, account actions and messages you send us. Application logging masks common credentials and omits question/answer text where identifiable; do not send passwords or API keys in support requests.

Information needed to create an account, process a purchase or provide an archive feature is required for that service. You choose what to upload; avoid information you are not entitled to process or disclose.

Purposes and legal bases

Account access, archive storage/search, requested AI processing and paid allowances are processed to provide the service under our contract with you. Support before purchase is handled at your request. Security, abuse prevention and defending claims are based on legitimate interests. Accounting, invoicing and legally required disclosures are based on legal obligations. Where a separate optional use requires consent, you can withdraw that consent without affecting earlier lawful processing.

We do not make decisions with legal or similarly significant effects about you using your chat content. Automated abuse controls may restrict an account; contact us to request review of a suspected false positive.

Providers, optional AI and external requests

• Hosting and email: 20i and the email/infrastructure providers supporting the service process stored files, databases, messages and connection/security data as necessary to operate it. Authorised maintenance and support access is limited to what is needed.
• OpenAI and Google Gemini: optional AI features may send your question, relevant archive excerpts, selected images or derived themes to these providers, depending on the tool. Ask AI uses OpenAI. Photo descriptions and image-generation tools use the provider configured for the feature. Check the material you submit; using AI does not publish your archive.
• Stripe: checkout and subscription management receive the data needed to take payment and return payment/subscription information. Stripe privacy policy.
• Google sign-in: choosing it connects to Google and supplies the account details needed for sign-in. Google privacy policy.
• Browser libraries and public images: archive Markdown libraries are hosted locally. Particular tools may request libraries from jsDelivr or a public Product Hunt badge; these requests disclose technical connection information such as IP address. They are not sent your private conversation content for this purpose.

We do not use your archive to train our own AI models. Provider processing, safety monitoring and retention follow the applicable API/service terms and account settings; a blanket promise of zero provider retention would be inaccurate. See OpenAI and Google.

Ask AI history: conversation history is kept in the current browser tab's session storage. The server usage ledger records request dates, model, usage and estimated cost, rather than question/answer text. Completed usage records become eligible for maintenance cleanup after 90 days; billing and allowance records are separate. The API provider still processes the request.

Recipients and international processing

The operator and service providers receive data needed for the purposes above. Accounting advisers, competent authorities or other recipients may receive information where a legal obligation or claim requires it. We do not sell data or share archives with advertisers.

Providers may process data outside the European Economic Area. Transfer arrangements depend on the provider, entity, region and service settings; applicable safeguards may include an adequacy decision or standard contractual clauses. Contact the controller for information about the arrangements applying to your data and how to obtain a copy of relevant safeguards. We do not represent every provider request as remaining in the EU or UK.

Deleting content and accounts

You can remove chats and snippets and use Settings to request account/data removal. Some archive actions hide or move files to a recoverable trash area before permanent removal. Search indexes, derived descriptions, public shares and copies in your original export are different records: hiding an item is not the same as erasing every copy. Contact us if you need complete erasure or help identifying retained copies.

Removal from active storage does not instantly erase provider backups, billing/legal records or copies you or other people already downloaded. If you published content, withdrawing it cannot recall those external copies. Keep your original export before requesting permanent removal.

Retention

Archive files and indexes are kept to provide your account until you remove them or request erasure, subject to applicable exceptions. Uploaded ZIP files are normally removed after successful extraction; interrupted imports and recoverable trash may need cleanup. Security/support records are retained while necessary to investigate abuse, maintain the service or handle claims. Billing and legal records may need to be retained for statutory periods even after account closure. Backups follow the hosting/provider rotation rather than immediate item-by-item deletion.

Ask for the retention details applicable to your records. A long period of inactivity does not automatically justify deleting data without considering the contract, required notices and your rights.

Your data-protection rights

You can request access, correction, erasure, restriction or portability where applicable; object to processing based on legitimate interests; and withdraw consent where consent is the basis. Email the controller or account-support address above. We may request proportionate identity verification. We normally respond within one month; lawful extensions and exceptions may apply, which we will explain.

You may complain to the Spanish Data Protection Agency (AEPD) or your competent supervisory authority. Exercising these rights does not require buying a plan.

Security measures and their limits

We use HTTPS, password hashing, authenticated access, signed file-download URLs, per-user storage outside the public directory, controlled archive extraction, request tokens and browser security controls. Production session cookies use HttpOnly, Secure and SameSite=Lax. Security controls reduce risk; they do not guarantee that attacks, service failures or data loss are impossible.

Use a unique password, keep your own export backup, sign out on shared devices and clear tab/site storage when needed. Only upload data you are entitled to use and take care with private or sensitive information about other people. Optional AI processing can disclose selected content to the provider.

Incidents and policy changes

Where a personal-data breach requires notification, we notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware. We inform affected people without undue delay where a high risk requires it. Notifications depend on the legal risk thresholds, not every unsuccessful attack.

We update this notice as the service changes, publish the revision date and use an appropriate account/site notice for material changes. Report a suspected security issue privately to the controller or support address; do not include other users' private content.

Age and uploaded content

Export Reader is offered to people aged 16 or over. Contact us if an account appears to belong to a younger child so we can investigate and take appropriate action.

You retain your rights in uploaded content. We process it to operate the archive and features you request, including optional AI processing and publication you choose. We do not claim ownership of your conversations.

Cookies and browser storage · Terms · Legal notice and consumer information