Privacy, in plain language.

Excera is an early-stage, founder-operated human risk intelligence venture run by Mahmoud Lotfy. This policy covers excera.live, the public game called The Tell and the Build with Excera contact form.

The wider Excera product is not publicly available and is outside this policy. We will update this policy before that product launches.

When you visit the website

Our hosting and security providers process ordinary request data such as your IP address, browser, device, requested page, referring page and request time. The site also loads fonts from Google Fonts, which means your browser connects to Google.

Public-site analytics

We record a random session identifier, the page visited, language, broad device class, referring domain and a small set of interactions such as selecting a Build with Excera route, submitting the form or opening an Intel source. We do not send names, email addresses, form text or other contact details to analytics. The site honours the browser Do Not Track setting.

When you play The Tell

You enter a name or nickname, job title and country. These details are sent to the game service so it can return a session shaped around the role you provide. They are not included in The Tell’s gameplay analytics.

The Tell gameplay analytics

We record a random session identifier, language, broad device class, selected country, broad role category, selected crew, answers, score, timing, sharing actions, referring domain and campaign tags. We do not record your name or exact job title in gameplay analytics. Cloudflare Workers Analytics Engine retains these events for three months.

When you use Build with Excera

The form sends the collaboration route, support type where relevant, name, email, optional relevant link and note you enter directly to Excera. We use this information only to review your message, reply and manage any conversation that follows.

When you contact us

We receive the information in your message, your contact details and the usual email metadata needed to reply.

Where data-protection law requires a lawful basis, we rely on steps you ask us to take, our legitimate interests in operating and improving Excera, consent where we ask for it, and legal obligations where they apply. Sending a Build with Excera request does not subscribe you to an unrelated marketing list.

• To run the website and The Tell, tailor the game to the role you provide and keep the service secure.
• To understand whether people complete, replay and share The Tell, and where the experience needs work.
• To understand which public pages and contact routes are useful, without placing form contents in analytics.
• To review Build with Excera requests, reply to people who contact us and plan relevant next steps.
• To prevent spam, automated abuse and attacks on our services.
• To comply with law and protect our legal rights.

We use a small number of service providers to run the public site:

• Cloudflare: website delivery, security and analytics
• Resend: Build with Excera email delivery
• Google: serving website fonts

These providers process ordinary service data under their own terms and may process it outside your country. We do not sell personal data and do not use it for third-party advertising.

We may also disclose information when law requires it, to protect people or the service, or as part of a genuine company financing, acquisition or restructuring under appropriate confidentiality safeguards.

• The Tell’s name, job and country inputs are used to return the game session. They are not included in gameplay analytics. The service uses rate limits to prevent abuse.
• The Tell gameplay analytics are retained for three months by Cloudflare Workers Analytics Engine.
• Public-site analytics are retained for three months by Cloudflare Workers Analytics Engine.
• Build with Excera requests and related correspondence are kept only as long as needed to review the request, respond, record any relationship that begins, and meet legal or security obligations. You can ask us to delete them sooner where the law allows.
• Security and infrastructure logs follow the shorter operational schedules set by the relevant hosting provider.

The Tell and the public-site analytics each place a random identifier in session storage, which normally disappears when you close the browser tab. The wider website may remember your language choice in local storage until you clear it.

Excera does not currently use advertising cookies. Cloudflare may set strictly necessary security cookies when its protective services require them.

Depending on where you live, you may ask for access to your personal data, correction, deletion, restriction, portability or an explanation of how it is used. You may also object to certain processing or withdraw consent where consent is the basis.

Email [email protected] with “Privacy request” in the subject. We may need to verify your identity before acting. You may also complain to the data-protection authority where you live, including Egypt’s Personal Data Protection Center where applicable.

We use access controls, encryption in transit, rate limits and restricted administrative access. No internet service can promise absolute security.

Our providers operate internationally, so data may be processed outside your country. Where law requires safeguards for an international transfer, we will use the available contractual or legal safeguards.

The public services are designed for people aged 18 or over. We do not knowingly collect Build with Excera requests from children. If you believe a child has submitted personal data, contact us so we can remove it.

We will update this page when the public service or its data use changes. Material changes will be marked by a new date at the top.

Questions and privacy requests: [email protected].