Privacy Policy

1. Who we are

The controller of the personal data described here is:

We are small enough that we are not required to appoint a data protection officer. Write to the address above, or email us, and you will reach the people who actually run the service.

2. The short version

• Your PDFs, annotations and trial data never leave your computer.
• The license server sees only what it needs to check a license: a hash of the license key, the app version, a random device identifier, an optional device name and, for trials, the date the trial started.
• Stripe processes payments. We never see or store your card details.
• Resend delivers your license key by email.
• If you use the chat on the website, your messages reach our support team through Telegram.
• The public website uses our own cookieless analytics and Google Analytics 4. Google Analytics sets two first-party cookies; there are no tracking pixels and no advertising networks. Do Not Track and Global Privacy Control are honoured by both. Server logs are kept for up to 30 days.
• The application can send anonymous usage statistics — event names and a few numbers. It is on by default and you can switch it off in Settings. It never includes documents, exhibit names, annotations or case details.
• We do not sell personal data and we do not run a mailing list.

3. What stays on your computer

Exhibit Room stores everything about your cases locally, in the application data folder on your machine. That includes:

• the PDFs you import as exhibits, and their file names;
• exhibit numbers, titles, descriptions and status;
• trial names, case numbers, courts and parties;
• every annotation — highlights, pen strokes, shapes, arrows, text, callouts, redactions;
• your application settings.

None of this is transmitted anywhere. It is not uploaded, synchronised, backed up to a server or sent to any third party. There is no cloud account. If you want a copy elsewhere you make it yourself with Export Trial, which writes a single file you control.

Because your data is local, deleting the application data folder deletes your cases. Keep your own backups.

4. What the license server receives

The license service runs at https://exhibitroom.app. The application contacts it only when activating, deactivating or occasionally revalidating a license, when recording the start of a trial, and when you ask it to check for an update. Those requests carry:

• a hash of your license key — we store the key only as a SHA-256 hash plus the first four characters, so support can identify it;
• the application version;
• a random device identifier generated on first launch — a random value stored on your computer, not a hardware fingerprint and not derived from anything about you;
• an optional device name, if you set one, so you can tell your own activations apart;
• for trials, the date the trial started;
• the time of each activation and validation, which the server records alongside the activation.

Why: to perform the contract with you — issuing, activating and validating the license you bought — and because we have a legitimate interest in enforcing the device limit and detecting license abuse such as a key published publicly.

The server never receives document contents, file names, exhibit titles, trial names, annotations or anything else about your cases. The application does send anonymous usage statistics unless you switch them off; section 5 sets out exactly what they contain.

5. Usage statistics in the application

Exhibit Room can send a small amount of anonymous usage information so that we can see which features are actually used. It is on by default and you can turn it off at any time in Settings → General.

What is sent:

• an event name from a fixed list — that a trial was created, an exhibit was opened or a presentation started, for example;
• a few numeric or enum values belonging to that event, such as a page count or the name of the annotation tool used;
• the application version and the operating system;
• the same random device identifier the license check uses, so that repeated events from one installation are counted as one.

What is never sent: documents or their contents, file names, exhibit numbers or titles, trial and case names, party names, annotation text — no free text of any kind. The server accepts only the names and values on that fixed list and drops anything else.

Why: we have a legitimate interest in knowing which features matter, so that we improve and fix the right things. Switching the setting off stops the sending immediately and discards anything still queued on your computer.

The same statistics are also forwarded to Google Analytics (see section 6), under the application's random install id and without your name or email address. Switching the setting off in Settings stops both.

Two events are recorded and sent to Google Analytics whatever that setting says, because they are part of providing the service: starting the free trial and activating a license. Each carries the application version and the operating system, and an activation also carries the order number and an internal customer number (not your name or email address), which lets us see that a purchase led to a working installation.

6. What the website collects

Most of the website is served as static files; the content pages are rendered on our own server. We run our own first-party, cookieless analytics: a small script, served from our own domain, that reports page views and clicks on the download and buy buttons to our own API. Our own script sets no cookies; Google Analytics, described below, does.

What it records:

• the page path you visited, without the query string;
• the host of the referring site — www.google.com, not the full referring address;
• any utm_ campaign parameters in the link you followed;
• a randomly generated visitor id stored in your browser's localStorage under er_vid, and a per-tab session id in sessionStorage under er_sid;
• the time of the event.

What our own script does not do: no cookies, no fingerprinting, no advertising networks and nothing about the content of your cases. Your IP address is never stored in our analytics database — it is used only transiently, to rate-limit the endpoint.

If your browser sends Do Not Track or Global Privacy Control, the script stops before it does anything at all: nothing is read, nothing is stored and nothing is sent. You can clear the visitor id whenever you like by clearing this site's data in your browser. The legal basis is our legitimate interest in understanding which pages are useful.

We also load Google Analytics 4. It sets two first-party cookies, _ga and _ga_<id>, kept for up to two years and renewed on each visit, holding a random client id so that Google can tell returning visits apart. It sends to Google the page path and any utm_ campaign parameters (never the rest of the address, and the same for the page that referred you), your browser's user agent and screen size, and the same download and buy clicks. Google receives your IP address to derive a coarse location and, for Google Analytics 4, does not log or store it. Advertising storage, ad personalisation and Google Signals are switched off, so nothing here is used to build an advertising profile. Do Not Track and Global Privacy Control stop the script before it loads. Google Ireland Limited processes the data as our processor under Google's Data Processing Terms; data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework and standard contractual clauses. Google keeps user- and event-level data for up to 14 months; aggregated statistics are kept longer. When you download an installer, our server also reports the download (platform and version) to Google Analytics if your browser carries the Google Analytics cookie. The order number, amount, currency and promotion code of every order, together with your billing country and an internal customer number, are reported to Google Analytics as revenue, even if you opted out of its cookies or have Do Not Track on; your name, email address and card details are not. The legal basis is our legitimate interest in understanding which pages are useful; Google's policy is at policies.google.com/privacy.

You can also block cookies for this site or use Google's opt-out browser add-on.

We also use Google Search Console to see which search queries lead here. It reports aggregated queries, impressions, clicks and average position; it tells us nothing about individual visitors. Google's policy is at policies.google.com/privacy.

Our web server keeps ordinary access logs — IP address, timestamp, requested path, status code and user agent — for up to 30 days. We use them to keep the service running and to investigate abuse and attacks; the legal basis is our legitimate interest in the security of the service.

Five small scripts run in your browser, all served from our own domain: one asks our API for the latest release so the download page can show version numbers, one asks our API whether a purchase has completed, one is our analytics script, one runs the chat window described in section 8 and talks only to our own API, and one loads Google Analytics from googletagmanager.com as described above. Nothing else is loaded from anywhere else.

The staff admin area sets a session cookie. It is only ever set for us, never for visitors to the public site.

7. Payments — Stripe

Purchases are handled by Stripe Payments Europe, Ltd. using Stripe Checkout. You enter your payment details on Stripe's own page; card data never reaches our servers and we never store it.

From Stripe we receive your email address, the amount paid, the currency, a payment identifier and any promotion code you used, so that we can issue, email and support your license. Stripe processes your data as an independent controller under its own policy: stripe.com/privacy.

8. Email — Resend

Your license key and purchase confirmation are delivered by Resend acting as our processor. Resend receives your email address and the content of the message. Its policy is at resend.com/legal/privacy-policy.

We use your email address to send your key, to answer support messages, and to contact you about a problem with your purchase or license. We do not run a mailing list and we do not send marketing email.

If you write to us through the form on our support page, we store what you send as a support ticket: your email address, the subject and message, the category you picked and, if you fill them in, the application version and operating system. We use it to answer you and to keep track of the question; the legal basis is performing our contract with you, or our legitimate interest in supporting people who are trying the app.

Live chat — Telegram

The chat button on the website does nothing until you send your first message: it stores nothing and calls nothing before that. Once you start a chat, we keep the conversation as a support ticket — your email address, your messages and ours, the page you started the chat on, and when your chat window last checked for new messages. That last item is how we decide whether to answer in the chat or, if you have left, by email.

Your browser keeps a random chat token in localStorage under er_chat, together with how many of our answers you have read, so the conversation follows you from page to page. It is not a cookie and is used for nothing else. "End this chat" removes it, and so does clearing this site's data in your browser.

So that we can answer quickly from our phones, each message you send is relayed to a private chat between our support team and our own bot on Telegram. Telegram receives your email address, your message and the page you started on, and our answers travel back the same way. Telegram handles them under its own policy: telegram.org/privacy. If you would rather nothing went through Telegram, use the support form or email us instead. The legal basis is the same as for support tickets.

9. Legal bases

• Performance of a contract (GDPR Article 6(1)(b)) — issuing your license, emailing the key, activating and validating it, and supporting you.
• Legitimate interests (Article 6(1)(f)) — enforcing the device limit, preventing and detecting license abuse, keeping the website and API secure, and understanding which pages and features are used. We use the least identifying data that works, which is why the device identifier is a random value, the analytics visitor id is random, and the key is stored hashed.
• Legal obligation (Article 6(1)(c)) — keeping accounting records for the period Estonian law requires.

10. How long we keep things

• Order and accounting records — for as long as the license is valid, and in any case for 7 years, as required by the Estonian Accounting Act.
• License and activation records — for as long as the license is valid, so that it can be validated, moved between computers and supported.
• Trial-start records (a random device identifier and a start date) — 24 months, then deleted.
• Server access logs — up to 30 days, then rotated away.
• Website analytics events and visitor records — 24 months, then deleted.
• Desktop usage statistics — 24 months, then deleted.
• Support tickets — while the question is open and for 24 months after it is resolved, so we can follow up on the same license.
• Live chats — kept as support tickets, for the period above. The relayed copies in our Telegram chat are deleted automatically after one month.
• Support email — for as long as needed to resolve your question and to handle any follow-up about the same license.

11. Who we share data with

Only the providers named above — Stripe for payment, Resend for email, Telegram for live chat messages, and Google, which runs Google Analytics as our processor and whose Search Console reports aggregated search statistics for the site — plus the hosting provider that runs our server. Each receives only what it needs to do its job.

We do not sell personal data, and we do not share it for advertising. We may disclose data if the law requires it, or to establish or defend a legal claim.

12. International transfers

Stripe and Resend may process data outside the European Economic Area, including in the United States. Where they do, they rely on the European Commission's standard contractual clauses or another transfer mechanism permitted under Chapter V of the GDPR. Their own policies, linked above, describe the safeguards they use. Google Analytics data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and standard contractual clauses. Telegram, which carries live chat messages, may also process them outside the European Economic Area; its policy describes where and how.

13. Your rights

Under the GDPR you can ask us to:

• Access — tell you what we hold about you and give you a copy.
• Rectify — correct anything that is wrong.
• Erase — delete your customer and license records, where that is compatible with our legal obligations. Accounting records we must keep for 7 years are the exception. Deleting a license record deactivates the license, so we will confirm with you first.
• Restrict or object to processing based on our legitimate interests.
• Port — receive the data you gave us in a structured, commonly used, machine-readable format.

Email support@exhibitroom.app and we will answer within one month. There is no charge.

If you think we have got something wrong you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or to the supervisory authority where you live.

Nothing about the data on your own computer needs us: it is yours, and you can export or delete it at any time from inside the application.

14. Children

Exhibit Room is professional software for legal practitioners. It is not directed at people under 18 and we do not knowingly collect their personal data. If you believe a child has given us data, email us and we will delete it.

15. Changes to this policy

If this policy changes, the effective date at the top of the page changes with it and the current version stays at https://exhibitroom.app/privacy. Material changes are posted on this page before they take effect.

16. Contact

Questions about privacy, or to exercise any of the rights above: support@exhibitroom.app, or write to Toubbali OÜ at the address in section 1. See also our Terms of Service.