Privacy notice

What Expogentic collects when you visit this site, book a call, write to us or use the product, and what happens to it.

Last updated 29 September 2026.

Who we are

Expogentic is a work platform made by Puente Global.

Expogentic is provided by Kalkan Networks, a company in the United Kingdom ("Kalkan Networks", "we", "us"). Kalkan Networks is the data controller for the personal data this notice describes, except for what a workspace puts into the product, which is described below.

For any question about this notice or your personal data, write to humberto@puenteglobal.com.

When you visit this site

We measure visits ourselves, with no third party analytics and no cookies. A page records how long it was open and in use, how far down you scrolled, which section was on screen, the site that linked you here (its address, not the full link), a campaign tag if the link carried one, and whether you are on a phone, a tablet or a computer.

Your country, region and city come from our hosting provider's network, which already knows them to route the request. We do not store your IP address. A visit is counted under a code made from your IP address, your browser and the date, mixed with a secret key, so the same visitor gets a different code each day. People who hold that key could recompute a code, so we treat it as personal data.

A random visit number sits in your browser tab's session storage and is gone when the tab closes. If your browser sends Do Not Track or Global Privacy Control, nothing is measured at all.

A page also records which element was clicked and where on the page, with no text and no form values. Click records are deleted after 90 days.

If you use the chat on this site

What you type goes to the agent that answers for us, and the agent answers through Anthropic, our AI provider. The conversation is stored so our team can read it. The chat sets no cookie. It keeps a random visitor token in your browser, so that one person cannot use up the chat for everybody.

We keep website chat conversations until our team deletes them. Nothing deletes them automatically today.

When you ask for access or write to us

The request form and the contact form send your name, your work email, your company and anything you write in the message field. We also store the IP address the form came from, to limit how many requests one connection can send. A person on our team is told by email and reads it. You are not added to a mailing list.

When you book a call

The booking page asks for your name, your email, the time you choose and an optional note. We use them to hold the time, to send you a confirmation and reminders, and to tell the host. The booking is also offered to the host's team as a possible new contact, which a person accepts or declines.

When you have an account

Logins are created by invitation. We keep your name, your email, your password as a one way hash, and your sign in sessions. If you sign in with Google, Google sends us your email address, whether Google has verified it, your Google account number and your name. We use the verified address to find your account. Signing in with Google does not by itself create an account, and we keep no Google access token from sign in.

For what a workspace puts into the product (its chat, tasks, pages, tables, files, meetings and email), the organisation that runs the workspace decides what happens to it, and we process it on that organisation's behalf.

Where we process personal data on an organisation's behalf, a Data Processing Agreement under Article 28 of the UK GDPR is available on request from the contact address above.

Why we may use it

We use personal data to provide the service under our contract with your organisation; to answer requests, run bookings, keep the site and the service secure and measure how the site is used, in our legitimate interest in running and improving Expogentic; and to keep billing records, because the law requires it.

Where it is stored

Accounts, memberships, chat, pages, calls and usage records sit in our shared application database, where every record is tagged to its workspace and our application keeps each workspace to its own. A workspace with a company database of its own keeps its business tables there, and its task board where that is switched on. Files sit in storage dedicated to the workspace where one is set up, and otherwise in shared storage under a path of its own.

Our hosting and database providers store this data in the United States.

Services that process it for us

• Vercel: hosting, scheduled jobs, logs and file storage.
• Neon: our Postgres databases.
• Anthropic: AI processing, including web search when a workspace turns it on.
• Resend: sending and receiving email. Postmark only where it is configured instead.
• Railway: hosts the service that runs outreach campaigns.
• Google: sign in with Google, and free and busy times for hosts who connect Google Calendar.
• Stripe: card payments, once they are enabled.

Some tools run on the workspace's own account with the provider, not on ours, and that provider's terms with the organisation apply: OpenAI for voice calls, transcription and images; Fathom for meeting recordings; Slack; Higgsfield; and any database or file store the organisation brings.

Some of these providers process data outside the United Kingdom, mainly in the United States. When we transfer personal data from the United Kingdom, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK International Data Transfer Agreement.

AI and your content

We do not use your content to train AI models. To answer, content is sent to the AI provider the workspace uses, as context for that request. By default that is Anthropic, which also performs some supporting steps when a workspace chooses another provider.

Google data

We do not read your Gmail and do not access your Google Contacts.

Hosts inside Puente Global can connect Google Calendar so that booking pages offer only their free times. That connection asks Google for free and busy times only, which carry no event titles, attendees or descriptions.

That connection reads free and busy times only. Expogentic does not write events to a host's Google Calendar: a booking reaches a calendar as an invitation file attached to the confirmation email.

Expogentic's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Payments

Today customers pay by invoice and bank transfer. When card payments are enabled, Stripe takes them on its own page: your card details go to Stripe and never reach our servers.

Customers may also pay by invoice and bank transfer. We keep billing records for 7 years, as the law requires.

Cookies

This site sets no cookie for measurement or advertising. The product sets these, all of them its own:

• joseph_session: keeps you signed in, for 30 days.
• g_oauth_state, g_oauth_verifier and g_oauth_next: protect a Google sign in while it happens, for 10 minutes.
• g_cal_state and g_cal_verifier: protect a Google Calendar connection while it happens, for 10 minutes.
• xg_invite and xg_gid: carry an invitation through sign up, for 15 minutes.
• xg_viewas: lets an admin preview the product as another role, for 30 minutes.
• pnt_v: shares out the chat on Puente Global's own page fairly, for 24 hours.
• bk_tz: the time zone you picked on a booking page, for a year.
• NEXT_LOCALE: your language, for a year.
• nav_collapsed, chat_dock, dock_w and the dashboard view choices: how you left the product's panels, for a year.

How it is protected

Credentials a workspace connects, such as API keys, database connection strings, file storage tokens and Google tokens, are encrypted with AES-256-GCM before they are stored. Passwords and the session and access tokens we issue are stored only as one way hashes. Our hosting and database providers also encrypt stored data.

How long we keep it

Our hosting provider keeps application logs for about a day. Security and usage records, such as sign in attempts, admin actions and AI usage, are kept while the account or workspace exists. Form requests and visit records are not deleted automatically today.

Nothing deletes a workspace automatically today. Export and deletion are done by hand, by our team.

When a workspace closes, its owner may ask us for an export of the workspace's data for 30 days after closing, and our team provides it on request.

We delete a closed workspace's data within 90 days of closing. We keep billing records for 7 years, as the law requires.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict how we use it or to send it to you in a portable form, or object to how we use it, by writing to the contact address above. Where the organisation that runs your workspace decides what happens to the data, we pass your request to it.

You may also complain to the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk.

Children

The product is for business users aged 18 or over and is not directed at children.

Changes to this notice

We will tell workspace owners before a material change to this notice takes effect.

A material change gets at least 30 days' notice, and the date at the top of this page changes with it.