Privacy notice
Last updated: 2026-09-29
Who we are
ExCards (hacacare.com) is operated by IndEx Middle East FZE, which decides how the personal data described here is used — the controller in the sense of the EU General Data Protection Regulation (GDPR). For anything about your data, write to .
What we hold, and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Your account — user name (often your e-mail address), your password stored only as a one-way hash, which parts of the service you may use, whether it is active or an administrator account, and when it was created and last signed in | To give you access to the service you or your organisation subscribed to | Contract (Art. 6(1)(b) GDPR) | While the account exists; on request it is anonymised (see Your rights) |
| Sign-in log — user name, sign-in, sign-out and failed sign-in events, IP address, browser type (user agent) and time | To protect your account and the service against misuse | Legitimate interest (Art. 6(1)(f) GDPR) | 365 days, then deleted automatically |
| Administrator log — which administrator created or changed an account, its access, or a project, and when | Accountability for administrative actions | Legitimate interest (Art. 6(1)(f) GDPR) | No fixed period at present; kept for accountability |
| Your projects — the classifications and calculations you save, who they are shared with, and any names typed into them (for example “Prepared by”) | To provide the service | Contract (Art. 6(1)(b) GDPR) | Kept as engineering and safety records, deleted on request where no obligation to keep them applies |
Not stored: the regulatory-inspection pages keep site and inspector names only in your browser session, never in our database; the modules that do not save projects keep nothing once you leave the page; and the project and author fields of a downloaded report are used only to build that file.
Cookies
ExCards sets one cookie, zone_calc_session. It is strictly necessary: it keeps
you signed in and protects forms against cross-site request forgery, and it lasts until you
sign out or close the browser. There are no analytics, advertising or third-party cookies,
and the pages load no scripts from other sites.
Who else handles it
- Hosting — the application and its database run on Railway, a cloud hosting platform, which stores the data on our behalf.
- Error monitoring — if an error occurs, technical details of the failed request can be sent to Sentry, our error-monitoring provider. Cookies, sign-in headers and password fields are removed before anything is sent.
- Substance look-ups query PubChem and the NIST Chemistry WebBook by substance name or CAS number. No personal data is sent.
We do not sell personal data, and we do not use it for marketing.
Where
The database is stored by our hosting provider in the United States (Railway's US East region), and IndEx Middle East FZE is established in the United Arab Emirates — both outside the European Economic Area.
Your rights
Under the GDPR you may ask for access to your data and for a copy of it in a portable form, for its correction or erasure, for its processing to be restricted, and you may object to processing based on our legitimate interest. Erasure anonymises the account: the user name and password are replaced so that it can no longer be used or traced back to you; projects are handled as described above. Write to the address above — we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.
Automated decisions
ExCards makes no automated decisions about people. Its calculations concern installations and materials.
Changes
We update this notice when the way we handle personal data changes; the date at the top shows the current version.