Privacy Policy

Last updated: 24 October 2026

This Privacy Policy explains how TAWVO Digital Services ("XPORA"), the operator of the XPORA platform, collects, uses, discloses, retains and protects Personal Data in connection with the Platform, and the rights available to you, in accordance with the Personal Data Protection Law promulgated by Law No. 151 of 2020 of the Arab Republic of Egypt and its Executive Regulations (the "PDPL"). It forms an integral part of the Terms of Service. Capitalised terms not defined here have the meaning given to them in the Terms of Service.

1. Definitions

• "Personal Data" means any data relating to an identified natural person, or to a natural person who can be identified, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including its collection, recording, storage, use, display, disclosure, transfer or erasure.
• "Data Subject" means the natural person to whom Personal Data relates.
• "Controller" means the person who determines the purposes and means of the Processing of Personal Data.

2. The Controller

2.1 XPORA (TAWVO Digital Services) is the Controller of the Personal Data processed through the Platform. Its details are:

• Legal entity: TAWVO Digital Services (a limited liability company, Commercial Registration No. 6548R of 2026, Tax ID 774231777)
• Address: Building No. 1, Chillout Lotus Maxim, Third Floor, Fifth Settlement, New Cairo, Egypt
• E-mail: support@xporanetwork.com

2.2 Any request or question regarding your Personal Data may be addressed to XPORA through Settings → Contact Support or by e-mail to support@xporanetwork.com.

3. Personal Data We Collect

3.1 Data you provide in your Application. If you are an Influencer: your full name, e-mail address, telephone number and gender, and the Instagram and TikTok accounts you connect (clause 3.4). If you are a Business: the full name, personal e-mail address and personal telephone number of the person representing the Business, and the name, category, type, e-mail address and telephone number of the Business.

3.2 Data you provide when creating and managing your Account: your username and password; for an Influencer, a profile picture; and for a Business, its photographs, its description and its Branches, each comprising a city, an area and a map link.

3.3 Data generated through your use of the Platform, including:

• the date and time at which you accepted the Terms of Service and the version accepted;
• for a Business: its Requests, what it requires from the Influencers, the Branches selected, and the price of each Request and the value added tax on it;
• for an Influencer: the Tier assigned by XPORA; Bookings, including the Branch, date and time; the status of each Booking; the Content selected for each Booking (its link, image, caption and time of publication); and the performance figures of the Content (views, likes, comments, shares and saves) on Instagram and TikTok, which XPORA continues to update after approval;
• for an Influencer: the Wallet balance and its movements; each withdrawal request, including the amount, the method and the receiving account details provided (an Instapay username or telephone number and the Instapay name, a mobile wallet number and the name on it, or an IBAN, the account holder name and the bank name);
• the notifications sent to you within the Platform and to your device; and
• any question you type into the in-app assistant that it is unable to answer, recorded together with your Account.

3.4 Data received from Instagram and TikTok. When you connect your Instagram and TikTok accounts through the sign-in services of those platforms, XPORA receives, with your authorisation: the identifier of each account, its username, its number of followers, the list of your recent content and its performance figures, and access keys that allow XPORA to read this information. XPORA refreshes the username and the number of followers regularly, and uses this data to verify Applications, to assign Tiers, to list your content so that you can select the Content of a Booking, to verify Content and to record its performance. XPORA does not receive the password of any Instagram or TikTok account, and does not publish anything on your accounts.

3.5 Data stored on your device: your preferences, such as the display theme, the language and the city you select for browsing, are stored on your device. If you allow notifications, a notification token identifying your device is sent to XPORA and stored with your Account, or with your Application before an Account exists, so that notifications can be delivered to your device; notifications can be switched off in Settings.

4. Data We Do Not Collect

• XPORA does not collect or store payment card numbers, CVV codes or PINs. Requests are paid by bank transfer, and no card details are entered in the Platform.
• XPORA does not access your device's location. The city in which you browse is selected by you.
• All metadata embedded in photographs uploaded to the Platform, including the location at which they were taken, is removed upon upload.
• The Platform does not use advertising identifiers or third-party advertising or analytics trackers.

5. Purposes and Legal Bases of Processing

5.1 XPORA processes Personal Data only for specified, explicit and legitimate purposes, namely:

• to review Applications and create and administer Accounts;
• to operate the marketplace: to display to each Influencer the Requests that apply to them, to enable Bookings, and to inform the Business of the Branch, date and time booked;
• to assign Tiers, verify Content, record its performance and report it to the Business concerned;
• to credit Wallets and process withdrawals;
• to communicate with you by notification, by notification to your device, by e-mail or by telephone about your Application, your Account, your Requests and your Bookings;
• to improve the in-app assistant using the questions it could not answer; and
• to enforce the Terms of Service, prevent fraud and misuse, and comply with applicable law.

5.2 XPORA processes Personal Data on the basis of your explicit consent, given when you accept the Terms of Service and this Privacy Policy and when you connect your Instagram and TikTok accounts; where the Processing is necessary to perform the agreement between you and XPORA; where it is necessary to comply with a legal obligation; or as otherwise permitted by the PDPL.

5.3 Receiving account details provided for a withdrawal may constitute financial data, which the PDPL treats as sensitive Personal Data. XPORA processes such data only with your explicit consent, given when you submit the withdrawal request, and solely for the purpose of making that withdrawal.

6. Disclosure of Personal Data

6.1 Other Users. Influencers can see the name, photographs and description of a Business, the published description of what a Request requires, and the area, city and map link of its Branches in the city they are browsing. Businesses can see the Branch, date and time of each Booking of their Requests and, once the Content of a Booking has been approved, the Instagram and TikTok usernames of the Influencer who made it and the performance figures of that Content. The name and profile picture of an Influencer are not disclosed to Businesses, and the e-mail addresses and telephone numbers of Users are not disclosed to other Users.

6.2 XPORA personnel. Authorised XPORA personnel have access to the Personal Data in all Accounts to the extent necessary to review Applications, administer Accounts, publish Requests, verify Content, process withdrawals and provide support.

6.3 Service providers. Personal Data may be disclosed to providers that host and operate the Platform on XPORA's behalf; to banks and payment institutions to the extent necessary to receive payments and make withdrawals; to the operators of Instagram and TikTok to the extent necessary to read the information described in clause 3.4; and to the providers that deliver notifications to devices (Expo, Apple and Google), which receive the text of a notification and the notification token of the device to which it is sent.

6.4 Authorities. Personal Data may be disclosed where required by law or by an order of a competent judicial or governmental authority.

6.5 XPORA does not sell Personal Data and does not disclose it to advertisers.

7. Transfer of Personal Data Outside Egypt

7.1 Where Personal Data is transferred to, or stored in, a country outside the Arab Republic of Egypt, XPORA shall do so only in accordance with the conditions laid down in the PDPL, including obtaining any licence or permit required from the Personal Data Protection Center. The Platform is hosted by Railway Corporation on servers located in the European Union, and the in-app assistant runs on the User's own device. Apart from storing the Platform's data on those servers, XPORA does not transfer Personal Data outside Egypt.

8. Retention

8.1 XPORA retains Personal Data for as long as your Account exists and as necessary for the purposes set out in clause 5, and thereafter for the period required by applicable law, which for the records described in clause 8.2 is five (5) years from the date on which the Account is deleted.

8.2 When your Account is deleted, whether by you or by XPORA, the Personal Data associated with it is deleted, including the connection to your Instagram and TikTok accounts and the access keys to them, save that XPORA retains, to the extent required to comply with the laws of the Arab Republic of Egypt: (a) in the case of a Business, the name and contact information of the Business and of the person who represented it, including the addresses of its Branches, for the purpose of addressing any complaint, together with the records of its transactions; and (b) in the case of an Influencer, the records of the amounts credited and paid to the Influencer, including the details of each withdrawal and the Wallet balance at the time of deletion, together with the identifying and contact information associated with them. Such data is retained for no longer than the applicable law requires, being five (5) years from the date on which the Account is deleted.

8.3 Applications that are rejected are retained only for as long as necessary to handle them.

9. Security and Breach Notification

9.1 XPORA applies technical and organisational measures appropriate to protect Personal Data against unauthorised access, use, alteration or disclosure. Passwords are stored only in hashed form, and the access keys to Instagram and TikTok accounts are stored in encrypted form. Access to the Platform is verified against the status of the Account on every request, so that a suspended or deleted Account loses access immediately.

9.2 In the event of a breach of Personal Data, XPORA shall notify the Personal Data Protection Center and the affected Data Subjects within the time limits prescribed by the PDPL.

10. Your Rights

10.1 Subject to the PDPL, you have the right to:

• know of, review and access the Personal Data that XPORA holds about you;
• withdraw your consent to the retention or Processing of your Personal Data;
• have your Personal Data corrected, amended, erased, supplemented or updated;
• have the Processing of your Personal Data limited to a specified scope;
• be informed of any breach of your Personal Data; and
• object to the Processing of your Personal Data, or to its results, where it conflicts with your fundamental rights and freedoms.

10.2 You may update your own details from Settings → Account → Edit Profile, change your username or password from Settings → Security, switch notifications to your device off from Settings, and delete your Account from Settings or, if you cannot access the Platform, by e-mail to support@xporanetwork.com as described on XPORA's Account Deletion page. Details that are set by XPORA may be corrected on request. You may also remove XPORA's access to your Instagram or TikTok account from the settings of that platform; doing so may prevent XPORA from verifying your Content. To exercise any other right, contact XPORA through Settings → Contact Support or by e-mail to support@xporanetwork.com. XPORA may ask you to verify your identity before acting on a request.

10.3 Withdrawing consent, or requesting erasure of data necessary to operate your Account, may prevent XPORA from continuing to provide the Platform to you, and does not affect the lawfulness of Processing carried out before the withdrawal.

10.4 You may lodge a complaint with the Personal Data Protection Center.

11. Third-Party Platforms

11.1 Content published on Instagram and TikTok, the sign-in services of those platforms, and map links opened in third-party mapping services are subject to the privacy policies of the operators of those services. This Privacy Policy applies only to the Personal Data processed by XPORA.

12. Persons Under Eighteen

12.1 The Platform is not intended for persons under eighteen (18) years of age, and XPORA does not knowingly collect their Personal Data. Any Account found to belong to such a person will be deleted.

13. Amendments

13.1 XPORA may amend this Privacy Policy at any time. The amended Privacy Policy takes effect from the date shown at the top of this page. XPORA will notify Users of material amendments through the Platform or by e-mail. Where an amendment changes the purposes for which, or the way in which, your Personal Data is processed, XPORA will ask for your explicit consent before the change applies to you.

14. Contact

14.1 Any question, request or complaint regarding this Privacy Policy or your Personal Data may be addressed to XPORA through Settings → Contact Support or using the details below:

• Legal entity: TAWVO Digital Services (a limited liability company, Commercial Registration No. 6548R of 2026, Tax ID 774231777)
• Address: Building No. 1, Chillout Lotus Maxim, Third Floor, Fifth Settlement, New Cairo, Egypt
• E-mail: support@xporanetwork.com