XpenseIt

Privacy Policy

Last updated: August 29, 2026

This Privacy Policy describes how AR Web Development & Media LLC ("we", "us", "our") collects, uses, and protects information when you use XpenseIt ("the Service").

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and a hashed version of your password. We never store your password in a form anyone can read, including us.

Financial Data You Enter

The Service stores the expenses, invoices, mileage records, receipt images, business entities, and other financial data that you voluntarily enter. This data is stored on infrastructure we operate ourselves in the United States, and is encrypted in transit and at rest.

Login & Security Logs

We log sign-in attempts (IP address, user agent, timestamp, whether it succeeded) to protect accounts against unauthorised access. These records are kept only as long as they are useful for that purpose, and are deleted with your account.

Usage Data

We do not use third-party analytics, tracking pixels, or advertising networks. We do not track your behavior across other websites or services. Standard HTTP request logs (status, path, timestamp) are retained for operational and abuse- prevention purposes and rotated within 30 days.

2. How We Use Your Information

  • To provide and maintain the Service
  • To authenticate your identity and protect your account
  • To detect and prevent fraud, abuse, and security incidents
  • To send transactional emails (password resets, trial notifications, payment receipts)
  • To enforce our Terms of Service and Acceptable Use Policy

3. What We Do NOT Do

  • We do not sell, rent, or share your personal data with third parties for marketing purposes
  • We do not use your financial data for advertising or profiling
  • We do not embed third-party trackers, social widgets, or ad networks
  • We do not train AI models on your data, and we do not authorize our service providers to do so

4. Third-Party Services

We use the following third-party services in the operation of XpenseIt:

  • Stripe — for payment processing. Stripe receives your payment information (card number, billing address) directly; we never see or store your full card number. See Stripe's Privacy Policy.
  • Zoho Mail — for transactional email delivery (verification, password reset, billing notifications). Zoho processes your email address and the content of transactional emails we send. See Zoho's Privacy Policy.
  • Google Gemini API — for receipt OCR. When you upload a receipt image and use the "auto-fill" feature, the image is transmitted to Google for processing. Google's API terms prohibit them from using submitted content to train their models. See Google Gemini API Terms.
  • Cloudflare — for DNS, DDoS protection, and CDN. Cloudflare may process request metadata (IP address, headers). See Cloudflare's Privacy Policy.

5. Data Storage & Security

Your data, including receipt files, is stored on infrastructure we operate ourselves in the United States. It is encrypted in transit and at rest. Passwords and two-factor backup codes are stored only as hashes and cannot be read back. We apply industry-standard protections against unauthorised access and review them as the product changes.

While we implement industry-standard security measures, no system is 100% secure. We strongly encourage you to enable two-factor authentication and use a strong, unique password.

6. Data Retention

  • Account data — retained until you delete your account
  • Financial records — retained until you delete them or delete your account
  • Trashed items — soft-deleted items remain in Trash until you permanently delete them or delete your account
  • Sign-in and access logs — kept only as long as they are useful for protecting accounts, and deleted with your account
  • Backups — daily backups are retained for 30 days, then automatically deleted

7. Your Rights

You have the right to:

  • Access your data — all your data is visible in the application at all times
  • Export your data — use the CSV and Excel export features available on each section
  • Delete your data — delete individual records, or delete your entire account from Settings > Danger Zone
  • Correct your data — edit any record at any time

Account deletion is permanent and irreversible. All your data, including expenses, invoices, mileage records, receipts, and account information, is removed from all systems including backups within 30 days.

8. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

10. Contact

Questions or concerns about this Privacy Policy? Contact us at [email protected].