This policy explains what personal data XPNSR ("we", "us") processes when you visit xpnsr.tech, book a demo, or use XPNSR Tracker (the "Service"), and what choices you have. Questions: support@xpnsr.tech.
1. Data we collect
- Account data: your name, email address, password (stored only as a hash), workspace and team settings, and two-factor and single sign-on settings you enable.
- Billing data: plan, billing period and payment status. Card details are entered on Stripe's checkout and never reach our servers.
- Demo and support requests: what you send us through the demo form or by email: name, email, company, Telegram handle and your message.
- Website analytics: if you accept analytics cookies, Google Analytics records pages viewed, approximate location and device type.
- Service logs: sign-in times, IP addresses and errors, used to keep accounts secure and the Service working.
2. Data you track with the Service
When you send traffic through XPNSR Tracker, it records clicks and conversions for you: IP address, user agent, referrer, approximate location derived from the IP, device details, the parameters in your tracking links, and postback and lead data you send. For this data you are the controller and we act as your processor: we process it only to provide the Service to you, under your instructions. You are responsible for having a legal basis for collecting it and for informing your visitors. The Service gives you tools for this, including IP pseudonymisation, a consent banner for your landing pages, and data export and erasure.
3. How we use data
- To provide, secure and support the Service and your account.
- To process payments and send receipts and account notices.
- To answer demo and support requests.
- To understand, in aggregate, how the website is used, if you consent.
We do not sell personal data and do not use your tracked data for advertising or to build profiles.
4. Service providers
We use these providers to run the Service. Each processes data only on our instructions.
| Provider | Purpose |
|---|---|
| Railway | Hosting of the Service and this website |
| Stripe | Payments and subscription billing |
| Resend | Account and notification emails |
| Sentry | Error monitoring |
| Website analytics (with consent) and optional Google sign-in |
Location lookups use a database that runs on our own servers; IP addresses are not sent to a third party for this. Some providers are located in the United States; where required, transfers rely on standard contractual clauses.
5. Retention
- Personal data in click, conversion and lead records (IP address, user agent, referrer, city and coordinates, visitor and ad click identifiers, e-mail, phone, lead contact fields): removed after 13 months.
- The remaining anonymous statistics: for the history period of your plan (90 days, 1 year, 2 years or unlimited), then deleted.
- Account data: for as long as the account exists, then deleted, except records we must keep by law, such as invoices.
- Demo and support requests: as long as needed to handle them and follow up.
6. Cookies
The Service uses only the cookies and local storage it needs to keep you signed in and remember your settings. This website uses Google Analytics only if you click Accept in the cookie banner; until then no analytics cookies are set. You can change your choice any time with Cookie settings at the bottom of every page.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. Email support@xpnsr.tech and we will respond within 30 days. Visitors to our customers' campaigns should contact the customer who runs the campaign. You may also complain to your data protection authority.
8. Security
Traffic to the Service is encrypted with TLS. Passwords are hashed, access to production systems is limited to the people who need it, and accounts can use two-factor sign-in and single sign on. No system is perfectly secure; if a breach affects your data we will tell you without undue delay.
9. Children
The Service is for businesses and is not directed at anyone under 18.
10. Changes
We will post changes here and update the date above. For material changes we will also notify account owners by email.