Privacy Policy

This Privacy Policy explains what information AR Web Development & Media LLC ("we", "us", "our") collects when you use XpenseIt ("the Service"), why, who else receives it, where it is kept, for how long, and how to delete it.

We are the controller of your account information. Information you enter about your own customers and contacts (for example on an invoice) we process on your behalf and only to provide the Service to you; you are responsible for having the right to give it to us.

1. Information We Collect

Your account

Your name, your email address and your password. Your password is never stored in a form anyone can read, including us.

What you enter

The expenses, invoices, mileage records, receipt images, companies, contacts and other records you add. Contacts and invoices can include your own customers' names, email addresses and billing details.

Sign-in records

When someone signs in to your account, or tries to, we record the time, the IP address, the browser or device, and whether it succeeded. We use these records only to protect your account.

Messages you send us

If you use the contact form or email support, we receive your name, your email address and your message.

Payment details

If you subscribe, your card details go straight to Stripe. We never see or store your full card number.

Usage

We do not use third-party analytics, tracking pixels or advertising networks, and we do not follow you across other websites. Our servers keep basic request records (the page requested, the time and the IP address) to run the Service and stop abuse, and delete them routinely.

2. How We Use Your Information

• To provide the Service and keep your records available to you
• To sign you in and protect your account
• To detect and prevent fraud, abuse and security incidents
• To send the emails the Service needs to send: verification, password resets, trial and billing notices, and the invoices you choose to email
• To answer you when you contact us
• To enforce our Terms of Service and Acceptable Use Policy

Legal basis (EEA and UK)

We use your information to perform our contract with you (providing the Service and billing), for our legitimate interests in keeping the Service and your account secure and preventing fraud and abuse, to meet our legal obligations, and with your consent where we ask for it, which you can withdraw at any time.

3. What We Do Not Do

• We do not sell your personal information, or share it for cross-context behavioral advertising
• We do not use your financial data for advertising or profiling
• We do not embed third-party trackers, social widgets or ad networks
• We do not train AI models on your data, and we do not allow our service providers to do so

4. Who Else Receives Your Information

These companies process information for us, only for the purpose given:

• Stripe — payments. Stripe receives your payment details and billing address when you subscribe. See Stripe's Privacy Policy.
• Zoho Mail — email delivery. Zoho handles every email the Service sends, including invoices you email to your customers, so it receives the recipient's address and the content of the email. It also receives the messages you send us. See Zoho's Privacy Policy.
• Google (Gemini API) — reading receipts and suggesting categories. When you use receipt auto-fill, the receipt image is sent to Google to be read. When you ask for category suggestions, the vendor and description of those expenses are sent to Google. Google's terms for this paid service do not allow it to use what we send to train its models. See Google's Gemini API Terms.
• Cloudflare — delivers the Service's network traffic. Cloudflare processes request details such as your IP address and browser. See Cloudflare's Privacy Policy.

5. Where Your Data Is Stored

Your account and everything you enter, including receipt files, is stored on dedicated, access-controlled servers in the United States. Backups are stored in the United States too.

If you use the Service from outside the United States, your information is transferred to and processed in the United States. The service providers listed above offer data protection terms, including the European Commission's Standard Contractual Clauses for information from the EEA and the UK.

6. Keeping Your Account Safe

All traffic is encrypted in transit, and your data and its backups are encrypted at rest. Passwords are never stored in a form anyone can read, including us. Each account's data is isolated from every other account. We apply industry-standard protections against unauthorised access and review them as the product changes.

If a security incident affects your personal information, we will notify you, and the authorities where the law requires, without undue delay.

Two-factor authentication

You can add a second step to signing in, using an authenticator app on your phone. To turn it on, go to Settings > Security and choose Enable 2FA. You will be given backup codes: keep them somewhere safe, as they let you sign in if you lose your phone. We strongly recommend it.

7. How Long We Keep It

• Your account — until you delete it
• Your records — until you delete them, or delete your account
• Trash — items you delete stay in Trash until you empty it, or delete your account
• Sign-in records — only as long as they are useful for protecting your account, and never after your account is deleted
• Payment records — kept by Stripe for as long as tax and financial law requires, also after your account is deleted
• Backups — kept for 30 days, then deleted automatically

8. Deleting Your Account

Go to Settings > Profile, scroll to Danger Zone and choose Delete account. You will be asked for your password and your email address to confirm.

Deletion is permanent. Your account and everything in it — expenses, invoices, mileage records, receipts, contacts and sign-in records — is removed from the Service straight away, and from our backups within 30 days, as those backups expire.

9. Your Rights

• See your data — everything you enter is visible in the Service at all times
• Export it — use the CSV and Excel exports in each section
• Correct it — edit any record at any time
• Delete it — delete individual records, or your whole account as described above

EEA and UK residents

You also have the right to restrict or object to our use of your information, to receive it in a portable format, to withdraw consent at any time, and to complain to your local data protection authority.

California and other US state residents

Depending on where you live, you have the right to know what personal information we collect, use and disclose; to have it deleted or corrected; and to opt out of its sale, its sharing for targeted advertising, and profiling. We do none of these, so there is nothing to opt out of, and we treat a Global Privacy Control signal from your browser as an opt-out request. The financial and sign-in information you give us is used only to provide the Service, never to infer anything about you. We will not treat you differently for using any of these rights.

How to use your rights

Most can be done yourself in the Service. For anything else, email us from the address on your account (or have an authorized agent do so); we will confirm it is you and respond within 30 days. If we decline a request, you may appeal by replying to our answer, and we will respond to the appeal within 45 days.

10. Cookies and Tracking

We use only the cookies needed to sign you in and keep the Service secure. We do not use advertising or analytics cookies, and we do not track you across other websites, so we treat every visit the same whether or not your browser sends a "Do Not Track" signal.

11. Children

The Service is not intended for anyone under 18. We do not knowingly collect information from children. If we learn we have, we will delete it promptly.

12. Changes to This Policy

We may update this policy. We will tell you about material changes by email or in the Service at least 14 days before they take effect. The date at the top shows the latest revision.

13. Contact

Questions about this policy or your data? Email [email protected].