Global Privacy Statement

We collect and process personal data only when we have a lawful basis to do so — such as fulfilling a contract (processing your order), complying with a legal obligation, or pursuing a legitimate business interest that does not override your rights. We do not collect data for undisclosed purposes.

We use data only for the purposes for which it was collected. If we need to use data for a materially different purpose, we will notify you and, where required, seek your consent before doing so.

We collect only the personal data we actually need. We do not collect data speculatively or “just in case.” Where possible, we anonymize or aggregate data rather than retaining individually identifiable records.

We take reasonable steps to keep the personal data we hold accurate and current. If you believe we hold inaccurate data about you, you can request a correction at any time by contacting us at privacy@expresstools.com.

We implement technical and organizational measures appropriate to the sensitivity of the data we hold. This includes encryption in transit (TLS) and at rest, access controls based on the principle of least privilege, and regular reviews of our security posture.

Our infrastructure runs on Vercel (application) and Supabase (database), both of which maintain their own security certifications and data center controls. Payment data is processed by Stripe; we do not store raw card numbers.

For full security details, see our Security page.

We are transparent about what data we collect and why. We do not sell your personal data to third parties for advertising. We share data only with the service providers and partners necessary to operate our business, under confidentiality or data processing agreements.

Regardless of your location, you can contact us to:

• Request a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Opt out of marketing communications at any time

California residents have additional rights under CCPA/CPRA, described fully in our Privacy Policy.

Express Tools is based in the United States. If you access our site from outside the United States, your personal data will be transferred to and processed in the U.S. The U.S. may not have the same data protection laws as your home country. By using our site, you acknowledge this transfer.

Where we transfer data from the European Economic Area (EEA) or the United Kingdom to the U.S., we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or other mechanisms recognized under applicable law.

We retain personal data only for as long as necessary to fulfill the purposes described in this statement, or as required by law. When data is no longer needed, we delete or anonymize it securely.

This statement may be updated from time to time to reflect changes in our practices or applicable law. We will post the updated statement on this page with a revised effective date. For material changes, we will provide additional notice where feasible.