Legal
Privacy policy
Last updated 9 October 2026
This policy explains what personal information Exponenture collects through this website, why, who it is shared with, and the choices you have. We have written it to describe what the site actually does, in plain language.
Who we are
Exponenture is an independent applied-AI company operating from Cape Town, South Africa and Delaware, United States. For this website, Exponenture is the responsible party under South Africa’s Protection of Personal Information Act (POPIA) and the controller under the EU and UK General Data Protection Regulation (GDPR).
Our Information Officer is Matt Watson, founder. You can reach us about anything in this policy through the contact form, or by email once you have revealed our address there.
What we collect
When you send an enquiry
- Your name, work email address and, if you give it, your company.
- What you tell us in your message, and the service you selected.
- The page you sent it from, a reference number, any campaign tags in the link you arrived on (such as
utm_source), and the country your connection appears to come from.
When you chat with XPO_
- XPO_ is the AI assistant on this site. The messages you type are sent to our assistant service, which uses an AI model provider to write its replies.
- A random session identifier is kept in your browser for the length of your visit so the conversation hangs together. It is not used to identify you.
- If you share your name or contact details in a conversation, we may use them to follow up, as we would an enquiry. Please don’t share sensitive information.
To protect the site from abuse
- Cloudflare Turnstile runs a privacy-preserving check before an enquiry is sent or our email address is revealed.
- Your IP address is used briefly to limit repeated enquiries. These records expire after about 15 minutes.
- Like any website, our hosting provider processes technical request data (such as IP address, browser and pages requested) to deliver and secure the site.
- Cloudflare Web Analytics counts page views and loading performance without cookies and without identifying you.
Analytics and advertising, only with your consent
If you accept cookies, we use Google Tag Manager to load Google Analytics, Google Ads and the LinkedIn Insight Tag. These record how the site is used and let us show relevant ads to people who have visited. If you reject cookies, or make no choice, these tools run in a restricted mode that sets no cookies and sends no advertising identifiers.
Why we use it
- To reply to your enquiry and, if we work together, to manage that relationship. This is in our legitimate interest and, where relevant, a step you have asked us to take before entering a contract.
- To keep the site secure and prevent spam and abuse, which is in our legitimate interest.
- To understand visits and run advertising, only with your consent, which you can withdraw at any time.
We do not sell your personal information, and we do not use it for automated decisions that affect you.
Who we share it with
We use a small number of service providers who process information on our behalf:
- Cloudflare hosts and secures the website and provides Turnstile.
- Postmark delivers enquiry emails to us.
- Railway hosts XPO_, and Anthropic provides the AI model that writes its replies.
- Google (Tag Manager, Analytics and Ads) and LinkedIn (Insight Tag), only if you accept cookies.
We may also disclose information where the law requires it. When we bring in specialists or partners for an engagement, we share enquiry details with them only as far as the work needs.
International transfers
Some of these providers process information outside South Africa and the EU, including in the United States. Where that happens we rely on their contractual safeguards, such as standard contractual clauses, to protect your information to a standard comparable to POPIA and the GDPR.
How long we keep it
We keep enquiries for as long as we need them to respond and, if we work together, for the length of that relationship and any period the law requires afterwards. Enquiries that do not lead to work are deleted within 24 months of our last contact. Rate-limiting records expire after about 15 minutes. Analytics data is kept according to the retention settings in Google Analytics.
Cookies and similar technologies
| Name | Purpose | Kept | When |
|---|---|---|---|
exponenture-consent (local storage) | Remembers your cookie choice | Until you clear it | Always |
xpo.session, xpo.teaser.seen (session storage) | Keeps your XPO_ conversation together and shows its greeting only once | Until you close the tab | Always |
Google Analytics (_ga, _ga_*) | Counts visits and how the site is used | Up to 2 years | If you accept |
Google Ads (_gcl_* and Google domains) | Measures ad results and builds remarketing audiences | Up to 13 months | If you accept |
LinkedIn Insight (li_sugr, bcookie, lidc and others) | Measures LinkedIn ads and builds audiences | Up to 1 year | If you accept |
You can change your choice at any time with , also linked in the footer of every page.
Your rights
You can ask us to confirm whether we hold information about you, to see it, to correct or delete it, or to object to how we use it, and you can withdraw consent at any time. Contact us through the contact form and we will respond within a reasonable time.
If you are unhappy with how we have handled your information, you can complain to the Information Regulator (South Africa), or to the data protection authority where you live in the EU or UK.
Children
This website is meant for businesses and is not directed at anyone under 18.
Changes to this policy
If we change how we handle personal information, we will update this page and the date at the top.