Privacy Policy

This policy explains how Indibuying ("Xporta", "we", "us"), of 1198, 22nd Cross, HSR Layout Sector 3, Bengaluru, Karnataka 560102, India, collects, uses and protects information when you use Xporta at xporta.co and app.xporta.co (the "Service").

Xporta is software for exporters: it helps you find overseas buyers, manage conversations with them, and share product catalogues. We act in two roles:

• For your account (who you are, your workspace, billing) we decide how data is used — we are the data fiduciary / controller.
• For the business data you bring into Xporta (your mailbox, your buyers and contacts, your products and catalogues) we process it on your instructions to provide the Service — we act as your data processor.

1. What we collect

Account information. Your name, email address and profile picture from Google when you sign in with Google, or your email and password if you sign up with email. Your workspace and company name. When you sign in with Google, including the one-tap prompt Google shows on our sign-in page, Google tells us only who you are (name, email address, profile picture); Google processes that sign-in under its own privacy policy, and signing in this way does not connect your mailbox.

Mailbox data (only if you connect a mailbox). You connect Gmail, Outlook or another mailbox through our messaging-connection provider (section 4). Google's permission screen names that provider rather than Xporta, because the access is granted to the provider's verified Google app (section 6 gives its name, so you can find it in your Google Account). The connection lets Xporta read, send and organise email in that mailbox. We use it to: find conversations with buyers, show them in your Xporta inbox, draft replies for you to approve, and send the emails you approve (including campaign emails you schedule). The access tokens are held, encrypted, by our messaging-connection provider; Xporta stores only an identifier for the connection. See section 6.

LinkedIn data (only if you connect LinkedIn). You connect your own LinkedIn account through our messaging-connection provider. Xporta uses it to show your LinkedIn conversations with buyers in your Xporta inbox, to draft replies for your approval, to send the connection requests and messages you approve, and to notice when a request is accepted. For that it reads your one-to-one LinkedIn messages (those of the last 90 days when you connect, then new ones as they arrive), your sent invitations and your connections list, and it looks up the public profile of a person you write to. Group chats and sponsored messages are not read. A conversation Xporta judges to be personal is not kept: only the other person's name and the date stay, so you can bring it back if we got it wrong. Your sign-in is handled by our messaging-connection provider; Xporta never stores your LinkedIn password.

WhatsApp data (only if you connect WhatsApp). You connect your own WhatsApp number through our messaging-connection provider by scanning a QR code, the way you would link WhatsApp Web; we recommend a WhatsApp Business number rather than a personal one. Once connected, Xporta reads the number's one-to-one chats (those of the last 90 days when you connect, at most 50 messages in each, then new messages as they arrive). It uses them to show your conversations with buyers in your Xporta inbox, to draft replies for your approval, and to send the messages you approve, including campaign messages you schedule. Group chats, broadcast lists, status updates and channels are not read. A chat Xporta judges to be personal is not kept: only the other person's name or number and the date stay, so you can bring it back if we got it wrong. Other chats that are not about your business stay out of your inbox, in a Filtered out list you can review. Your WhatsApp session is held by our messaging-connection provider, like a linked device; Xporta never holds it.

Your business data. Companies, contacts and buyers you add, import or find through Xporta; your products, photographs, catalogues and brand details (logo, colours, public contact details); PDF catalogues you upload for import; notes, drafts and campaign content.

Buyer and contact data found through Xporta. When you search for buyers, Xporta returns information about companies and their staff — company name, website, country, and professional contact details such as name, job title, business email and LinkedIn profile — gathered from public sources and from data providers. See section 4.

Catalogue viewer activity. When someone opens a catalogue link you share, we record that it was viewed, which products were clicked, whether the contact button was pressed, and whether the page was read to the end. We do not store the viewer's IP address. We store a one-way hash of the IP address and browser, salted with a secret and scoped to one catalogue and one month, used only to count distinct viewers. We record the referring website's domain only, and the viewer's country.

Usage and technical data. Pages used, actions taken, errors, device and browser type, used to run and improve the Service (see analytics in section 4).

Google Sheets you import (only if you use it). To import leads from a Google Sheet, you sign in with Google and pick the sheet in Google's own file picker. Xporta asks only for access to the file you pick (Google's drive.file permission), reads that one sheet once, read-only, in your browser, to import its rows as leads, and does not store the access. It cannot see or change your other files.

Payment information. Payments are handled by Razorpay. We receive confirmation of payment and the plan purchased; we do not receive or store your card or bank details.

2. How we use it

To provide the Service you asked for; to find and verify buyer contacts you request; to draft emails and replies for your approval; to send emails you approve; to import and publish your catalogues; to bill you; to keep the Service secure and prevent abuse; to fix errors; and to contact you about your account. Nothing is sent from your mailbox and no credits are charged without your explicit approval.

We use AI models to read and draft on your behalf (see section 5). We do not sell your personal data and we do not use it for advertising.

3. Legal basis

Where the law requires a basis: contract (to provide the Service you signed up for), consent (connecting a mailbox, LinkedIn or WhatsApp; analytics cookies where required), and legitimate interests (security, fraud prevention, improving the Service, and — for buyer contact data — business-to-business outreach, balanced against the rights of the people concerned; see section 4). Under India's Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent and for the legitimate uses the Act permits.

4. Who we share it with (sub-processors)

We use these kinds of service providers to run Xporta. Each receives only what it needs.

We keep a current list of our sub-processors and give it on request (write to friends@xporta.co) and to business customers in our data processing agreement. We tell business customers before adding a sub-processor.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you).

People whose details appear in Xporta's buyer results. Xporta shows professional contact details of people at businesses, gathered from public sources and data providers, so that exporters can make business-to-business contact. If you are such a person and want to know what we hold about you, or want it removed, write to friends@xporta.co and we will act within 30 days. The same applies if you received a LinkedIn invitation or message, or a WhatsApp message, sent through Xporta by one of our customers.

People who chat with our customers on LinkedIn or WhatsApp. When one of our customers connects their LinkedIn account or WhatsApp number to Xporta, the chats you have with them are processed by Xporta on that customer's behalf, as described in section 1: the customer decides why their conversations are kept, and we act as their data processor. You can ask that customer, or us at friends@xporta.co, what is held about you. If you write "STOP" or "unsubscribe" in a chat, that customer's campaigns will not contact you again, on any channel.

5. AI processing

To draft replies, summarise conversations, read product photographs and PDF catalogues, and research buyers, Xporta sends the relevant text or images to our AI model provider's API. Under that provider's commercial terms, data sent through its API is not used to train its models. AI output is a draft: Xporta never sends an email, writes a product, or spends credits on the basis of AI output alone — you approve it first.

6. Google API Services — Limited Use

Gmail data reaches Xporta through our messaging-connection provider, Unipile, whose Google app you authorise when you connect Gmail. Xporta's use and transfer to any other app of information received from Google APIs, including through Unipile, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data we obtain from your Gmail account:

• is used only to provide and improve the user-facing features described in section 1 — reading and organising your buyer conversations, drafting replies for your approval, and sending the emails you approve;
• is not used for advertising, and not sold;
• is not transferred to others except as needed to provide those features (for example, through Unipile to reach your mailbox, or to our AI provider to draft a reply you asked for), to comply with law, or as part of a merger or acquisition with notice;
• is not read by humans, except with your explicit consent for a specific message (for example, when you ask support to investigate a problem), for security purposes, to comply with law, or when aggregated and anonymised for internal operations;
• is not used to train general AI or machine-learning models.

You can revoke access at any time by disconnecting the mailbox in Xporta → Connections, which also removes the connection at Unipile, or from your Google Account (myaccount.google.com/permissions), where it is listed as Unipile.

7. Retention

• Account and business data: while your account is active; deleted within 30 days of account closure, except where the law requires us to keep it (for example, invoices).
• Uploaded PDF catalogues: deleted once you confirm the import; otherwise after 7 days, and in every case within 30 days. Photographs you add to your library stay until you delete them.
• Printed catalogue PDFs: kept as a cache and regenerated on demand.
• Catalogue viewer activity: 90 days.
• Mailbox, LinkedIn and WhatsApp connections: when you disconnect one, or your account closes, we delete the connection at our messaging-connection provider at once, which ends its access. The provider keeps a connection's messages and access tokens only until the connection is deleted (it stores no Gmail message content at all), so deleting it removes the provider's copies, apart from anything it must keep by law. Conversations already in your Xporta inbox follow the account retention above.
• Chats judged personal (LinkedIn and WhatsApp): their messages are never stored; only the other person's name or number and the date are kept, with the account's data.
• Questions you type on our website are kept for up to 24 hours so we can carry them into the app, then deleted.
• Backups: up to 30 days, after which backup copies are overwritten.

8. Security

Data is encrypted in transit (TLS). Mailbox access tokens and LinkedIn and WhatsApp sessions are held by our messaging-connection provider, encrypted, never by Xporta. Access to production systems is limited to people who need it. Every piece of workspace data is separated by workspace, and our code enforces that separation on every query. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

9. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict processing, withdraw consent, and nominate someone to exercise your rights. Write to friends@xporta.co. We respond within 30 days. You can also complain to your data protection authority — in India, the Data Protection Board of India; in the EU/UK, your local supervisory authority.

Grievance Officer (India): Deepanshu Shahara, friends@xporta.co, 1198, 22nd Cross, HSR Layout Sector 3, Bengaluru, Karnataka 560102.

10. International transfers

Some providers in section 4 process data outside India (Singapore, the United States, the European Union, and others). We use providers bound by contractual data protection commitments, and we transfer data only as Indian law permits.

11. Cookies

Necessary cookies keep you signed in, keep your workspace secure, and remember your cookie choice. They are always on.

Analytics cookies — Google Analytics (via Google Tag Manager) and Microsoft Clarity — tell us which pages are used, where people get stuck in sign-up and onboarding, and (Clarity) how pages are scrolled and clicked, with anything you type masked. We use them to improve Xporta, not to advertise to you, and we do not sell this data.

Your choice. Visitors in the European Economic Area, the United Kingdom and Switzerland see a banner and no analytics cookie is set unless they accept. Elsewhere, analytics cookies are on by default and the banner lets you decline. Your choice applies to both xporta.co and app.xporta.co, is kept for six months, and can be changed at any time from Cookie settings in the website footer or the account menu in the app. Declining removes the analytics cookies already set.

Bot protection. Sign-up, sign-in and the free buyer search are protected by Cloudflare Turnstile, which runs in the background to tell people from automated scripts. It is necessary for security, is not used for advertising, and does not depend on your cookie choice. Cloudflare's handling of the data it collects is described in the Cloudflare Turnstile Privacy Addendum.

Catalogue pages you share with buyers show no banner, because they carry your brand, not ours. They never set advertising cookies. Buyers in the EEA, UK and Switzerland get no analytics cookies there; elsewhere, Google Analytics may measure the visit so we can improve catalogues.

12. Children

Xporta is a business service and is not for anyone under 18.

13. Changes

We will post changes here and, if they are significant, tell you by email or in the app before they take effect.

14. Contact

Indibuying · 1198, 22nd Cross, HSR Layout Sector 3, Bengaluru, Karnataka 560102 · friends@xporta.co