Privacy Policy

Last updated: October 2026

1. Introduction

This policy describes the current EXPI (expi.digital) money and mobility preview and investor portal. Product previews do not mean that all proposed financial or mobility services are live.

2. Information We Collect

We collect information in various ways:

  • Information you provide: Contact details, enquiries, applications, investor account information and documents you submit.
  • Operational records: Login, access-control and security records, and document-signature evidence needed to operate the portal and record agreements.
  • Optional analytics: With your opt-in, invitation visits and data-room engagement, including document viewing time, visits and download statistics.
  • Technical information: Requests to the site can include IP address and browser information used to deliver and secure the service.

3. Use of Information

We use collected information for:

  • Account creation, verification, and maintenance
  • Responding to enquiries and applications
  • Providing preview features and access to investor documents
  • Fraud detection and security purposes
  • Regulatory compliance and legal obligations
  • Customer support and communication
  • Recording document signatures and related evidence
  • Measuring invitation and data-room engagement only when optional analytics are accepted

4. Data Sharing and Disclosure

We may share your information with:

  • Regulatory Bodies: Government agencies and financial regulators as required by law
  • Service Providers: Hosting, document storage and communication providers used to operate this website and portal.

We do not sell your personal information to third parties for marketing purposes.

5. Data Security

The HTTPS site uses TLS to encrypt data in transit. Access restrictions limit protected portal documents and administrative functions to authorised users. These measures do not eliminate all risks; protect your credentials and verify unexpected requests before sharing information.

6. Data Retention

We retain information as needed to operate the portal, maintain security and signature evidence, handle enquiries, resolve disputes and meet applicable obligations. Retention depends on the record and purpose; cookie and browser-storage durations are described below.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your data (subject to legal requirements)
  • Portability: Receive your data in a portable format
  • Opt-out: Unsubscribe from marketing communications
  • Consent Withdrawal: Withdraw consent for specific data uses

Contact us at privacy@expi.digital to exercise these rights.

8. Blockchain and Cryptocurrency

Blockchain features described in previews are not a statement that this site processes live token transactions. If you independently transact on a public blockchain, its records may be public and immutable; EXPI cannot delete those records.

9. International Data Transfers

Hosting and service providers may process information outside your country, where privacy laws may differ. Contact us for information about providers and any safeguards applicable to your data. Visiting this website is not consent to optional analytics or to every international transfer.

10. Third-Party Links

Our platform may contain links to third-party websites and services. Review their privacy policies before providing information. The site also requests fonts from Google Fonts; those third-party requests disclose technical request information such as your IP address and browser information to Google. Rejecting optional analytics does not prevent these font requests.

11. Changes to This Policy

We may update this policy as the site changes and will display the updated date here. Changes do not turn an analytics rejection into permission; optional analytics require your opt-in.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact:
Email: privacy@expi.digital
Address: Available upon request
Data Protection Officer: dpo@expi.digital

13. Regional Privacy Rights

Privacy rights and obligations depend on your location and the processing involved, including under EU/UK data protection law and California privacy law where applicable. Contact privacy@expi.digital with a request or question. This policy is not a guarantee of compliance with every law in every jurisdiction.

EXPI GLOBAL INC  ·  SR: 20261175611  ·  File Number 10545589

14. Cookies and Browser Storage

Optional analytics are off until you accept. They cover invitation visits and data-room engagement (document viewing time, visits and download statistics), not login, security or document-signature evidence. Rejecting or withdrawing analytics does not disable those essential functions. No advertising cookies are installed.

expi_privacy — 180 days
First-party preference cookie storing v1.allow or v1.deny. It applies across this site, uses SameSite=Lax and is Secure on HTTPS. Missing, invalid or expired choices do not permit optional analytics. Each saved choice starts a new 180-day duration.
connect.sid — 7 days
Essential server-session cookie used for authenticated portal and administrator access. The configured maximum age is seven days and may renew with session activity. It is HttpOnly, SameSite=Lax and Secure in production. It is not controlled by analytics consent.
Local storage — until cleared
expi-preview-currency remembers the preview currency on this device. Local storage also remembers theme and the investor desktop-notice preference. These preferences are not optional engagement analytics and remain until cleared or reset.
Session storage — browser-tab session
Investor introduction and informational-panel preferences avoid repeating presentation elements within a tab. They normally clear when that tab session ends; browser session restoration may preserve them.
GAESA — hosting-platform managed
The hosting platform may set a GAESA cookie as part of serving the site. Its lifetime is managed by the platform; up to 30 days has been observed. It is separate from EXPI's optional analytics choice and is not set or removed by this control.

Use Cookie settings on any page to change or withdraw your choice. Withdrawal stops future optional analytics; it does not automatically erase previously recorded data. If the browser cannot save your choice, the control displays an error and optional analytics stay off in that tab. You can also remove cookies and storage in your browser; clearing the consent cookie returns analytics to off.