Privacy Policy

The controller of personal data processed through ExpiraDoc is ADVALORIS TRADE - FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates (trade licence no. 73991, Dubai Integrated Economic Zones Authority (DIEZA)).

Privacy requests: privacy@expiradoc.com

To be reviewed before launch: Whether ADVALORIS TRADE - FZCO must appoint an EU representative under Article 27 GDPR depends on the actual customer base and processing. No EU representative has been appointed.

As a UAE-based operator we process personal data in line with the applicable UAE personal data protection framework. Where we offer the service to people in the European Union / EEA, we also aim to meet the obligations of the EU General Data Protection Regulation (GDPR) that apply to that processing. Rights described below apply according to the law that applies to you; they are not identical in every country.

To be reviewed before launch: Confirm which UAE regime applies to a DIEZA-licensed free zone company (federal PDPL or a free-zone-specific regime) and adjust this section.

Account data: name, email address, account type (Personal or Business), company or workspace name, country, language and other preferences, and records of your acceptance of these policies.

Service data: document and deadline titles, categories, issuing organisation, issue and expiration dates, notes, who an item is for (Personal accounts), reminder settings, renewal history and reminder history.

Uploaded content: files you attach to documents and renewals. These may themselves contain personal data you choose to upload.

Billing data: plan, subscription status, trial and billing dates and payment-provider reference IDs. Card details are entered directly with our payment provider, Stripe; ExpiraDoc does not receive or store full card numbers.

Technical data: sign-in session tokens stored in your browser, and server and security logs (which may include IP address, browser information and request times) kept by our hosting and authentication infrastructure.

Communication data: delivery status of reminder emails (sent, failed or suppressed), and messages you send us.

• creating and maintaining your account and workspace
• providing document and deadline tracking and storing your content
• calculating days remaining and expiration status
• sending the reminders you configure
• processing subscriptions, trials and payments
• keeping the service secure and preventing fraud or abuse
• customer support
• meeting legal, tax and accounting obligations

We do not sell your data, do not use it for advertising and do not use analytics or marketing trackers.

Performance of our contract with you (account, tracking, reminders, billing); compliance with legal obligations (accounting and tax records); our legitimate interests in securing and protecting the service; and consent where we ask for it.

We use the following providers, confirmed in our current setup:

• Lovable Cloud — hosting of the application, database, authentication and file storage.
• Lovable email sending — delivery of reminder and account emails from notify.expiradoc.com.
• Stripe — payment processing, subscriptions, invoices, tax calculation and the billing portal.
• Google — only if you choose "Continue with Google" to sign in.
• Google Fonts — the website loads its typefaces from Google's servers, which receive your IP address when pages load.

WhatsApp reminders are not active. If they are introduced, this policy will be updated before launch.

To be reviewed before launch: Confirm each provider's data processing terms and sub-processor list, including the infrastructure providers used by Lovable Cloud and the data-centre regions used. Consider self-hosting fonts to avoid the Google Fonts transfer.

Our providers may process data in countries other than your own, including outside the UAE and the EU/EEA.

To be reviewed before launch: No specific transfer mechanism (such as EU Standard Contractual Clauses) has been verified yet for each provider. This must be confirmed before launch.

We keep account and service data while your account exists. When you delete your account (Account & Settings → Privacy / Account → Delete my account) or it is deleted through our administration process, its documents, deadlines, uploaded files, renewal and reminder history, workspace, profile and sign-in account are deleted, and any active subscription is cancelled.

Some information may be kept where required or justified: invoices and payment records held by Stripe for accounting and tax purposes, an internal administration log recording that the deletion took place, and records needed for security or legal disputes. Deleted data may remain in infrastructure backups for a limited period until they are overwritten; we do not promise immediate deletion from backups.

Depending on the law that applies to you, you may have the right to:

• access your personal data
• correct inaccurate data
• request deletion
• restrict or object to certain processing
• receive your data in a portable format
• withdraw consent where processing relies on consent
• complain to a competent data protection supervisory authority

You can correct much of your data yourself in Account & Settings, and delete your account at any time in Account & Settings → Privacy / Account → Delete my account. For any other request, or if you cannot use self-service deletion, contact privacy@expiradoc.com. We may need to verify your identity.

We use reasonable technical and organisational safeguards. Each workspace's data is separated and access is checked on the server for every request; uploaded files are stored privately and opened only through short-lived links; administrator access requires a dedicated role checked on the server; reminder emails never contain attachments or file links. No system can be guaranteed to be completely secure.

See our Cookie Policy.

We will update the "Last updated" date when this policy changes and notify you of material changes.