Privacy Policy

Welcome to XpensePro ("we," "us," "our," or "Company"), operated by Gershon Consulting. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our expense management application, website, and related services (collectively, the "Service").

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Account Registration: Name, email address, phone number, company name, job title, password
• Profile Information: Profile photo, notification preferences, language preferences, time zone
• Payment Information: Billing address, payment card information (processed securely by third-party payment processors)
• Expense Data: Expense amounts, dates, categories, descriptions, merchant information, tags, notes
• Supporting Documents: Receipts, invoices, contracts, and other documentation you upload
• Communications: Messages, feedback, support inquiries, and other communications with us

1.2 Information We Collect Automatically

When you use our Service, we automatically collect certain information, including:

• Device Information: Device type, operating system, browser type and version, unique device identifiers, mobile network information
• Usage Information: Pages viewed, features accessed, time spent on pages, click patterns, navigation paths, search queries
• Log Data: IP address, access times, error logs, referring/exit pages, clickstream data
• Location Information: General geographic location based on IP address (we do not collect precise GPS location unless you explicitly grant permission)
• Cookies and Similar Technologies: See Section 7 for more information

1.3 Information from Third-Party Sources

We may receive information about you from third parties, including:

• Single Sign-On (SSO) Providers: If you log in using Google, Microsoft, or other SSO services
• Payment Processors: Payment confirmation and billing information
• Analytics Providers: Aggregated usage and demographic information
• Publicly Available Sources: Information from public databases or social media platforms

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Provide and Maintain Our Service

• Create and manage your account
• Process and track expenses
• Automatically categorize and validate expenses using AI
• Detect fraudulent or suspicious transactions
• Generate expense reports, analytics, and insights
• Enable multi-currency support and currency conversion
• Synchronize data across your devices
• Process payments and manage subscriptions

2.2 To Improve and Personalize Our Service

• Analyze usage patterns and user behavior
• Develop new features and functionality
• Improve AI algorithms for fraud detection and categorization
• Personalize your experience and provide recommendations
• Conduct research and testing
• Measure and analyze the effectiveness of our Service

2.3 To Communicate with You

• Send service-related announcements and updates
• Respond to your inquiries and support requests
• Send administrative messages and account notifications
• Send marketing communications (with your consent, where required)
• Request feedback or participate in surveys

2.4 For Security and Legal Compliance

• Protect against fraud, abuse, and security threats
• Verify identity and authenticate users
• Enforce our Terms of Service and other policies
• Comply with legal obligations and regulations
• Respond to legal requests and prevent harm
• Protect our rights, property, and safety, and that of our users

2.5 With Your Consent

We may use your information for other purposes with your explicit consent.

3. Data Protection & Security

We implement reasonable administrative, technical, and physical security measures designed to protect your information from unauthorized access, disclosure, alteration, and destruction.

3.1 Security Measures

• Encryption: Data is encrypted in transit using secure protocols (HTTPS/TLS)
• Authentication: Password protection and authentication controls for account access
• Access Controls: Limited access to personal information on a need-to-know basis
• Secure Storage: Data stored on secure servers with access restrictions
• Regular Updates: Security patches and software updates applied regularly
• Monitoring: System monitoring for security threats and vulnerabilities
• Data Backups: Regular backups to prevent data loss

3.2 Your Responsibility

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Using a strong, unique password
• Logging out of your account when using shared devices
• Notifying us immediately of any unauthorized access

3.3 No Absolute Security

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information. You use our Service at your own risk.

4. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

4.1 Service Providers and Business Partners

We may share information with third-party service providers who perform services on our behalf, including:

• Cloud Hosting Providers: For data storage and computing infrastructure
• Payment Processors: For processing subscription payments
• Email Service Providers: For sending transactional and marketing emails
• Analytics Providers: For usage analytics and performance monitoring
• Customer Support Tools: For help desk and support services
• Security Service Providers: For fraud detection and security services

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Business Transfers

If we are involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.3 Legal Requirements and Protection

We may disclose your information if required to do so by law or if we believe such action is necessary to:

• Comply with legal obligations, court orders, or legal processes
• Enforce our Terms of Service or other agreements
• Protect and defend our rights or property
• Prevent fraud, security issues, or technical problems
• Protect the safety of users, the public, or the Company

4.4 Aggregated and De-Identified Information

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for research, analytics, marketing, or other purposes.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

5.1 Retention Periods

• Account Information: Retained while your account is active and for 30 days after account deletion
• Financial Data: Retained for 7 years to comply with tax and accounting regulations
• Transaction and Expense Data: Retained for 7 years from the transaction date
• Supporting Documents: Retained for 7 years or until you delete them, whichever comes first
• Usage Logs: Retained for 90 days
• Backup Data: Retained for 30 days in encrypted backups
• Marketing Data: Retained until you opt out or request deletion

5.2 Account Deletion

When you delete your account:

1. Your account is immediately deactivated and inaccessible
2. Personal information is deleted within 30 days
3. Financial records are retained for 7 years as required by law
4. Anonymized data may be retained for analytics purposes
5. Backup copies are permanently deleted within 30 days

5.3 Legal Obligations

We may retain certain information longer if required by law, regulatory requirements, litigation, or to resolve disputes and enforce our agreements.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 Access and Portability

• Right to Access: Request a copy of the personal information we hold about you
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format

6.2 Correction and Deletion

• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal retention requirements)

6.3 Control and Objection

• Right to Opt-Out: Unsubscribe from marketing communications
• Right to Object: Object to certain processing of your information
• Right to Restrict Processing: Request restriction of processing in certain circumstances
• Right to Withdraw Consent: Withdraw previously given consent

6.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: [email protected]
• In-App: Settings → Privacy → Data Rights
• Mail: XpensePro Privacy Team, c/o Gershon Consulting, 123 Business Ave, Suite 400, San Francisco, CA 94105

We will respond to your request within 30 days. We may require verification of your identity before processing your request.

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of our Service. For detailed information about our cookie practices, please see our Cookie Policy.

7.1 Types of Technologies We Use

• Cookies: Small text files stored on your device
• Web Beacons: Small graphic images (also called "pixel tags" or "clear GIFs")
• Local Storage: HTML5 local storage and other browser storage mechanisms
• Analytics Tools: Third-party analytics services to understand usage patterns

7.2 How to Control Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to refuse or delete cookies
• Cookie Consent Banner: Manage preferences when you first visit our website
• Cookie Settings: Update your cookie preferences in your account settings
• Opt-Out Tools: Industry opt-out tools like the Network Advertising Initiative or Digital Advertising Alliance

Note: Blocking essential cookies may affect the functionality of our Service.

8. International Data Transfers

XpensePro is based in the United States. If you access our Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

These countries may have data protection laws that are different from the laws of your country. By using our Service, you consent to the transfer of your information to the United States and other countries.

8.1 International Safeguards

When transferring information internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by relevant authorities
• Data Processing Agreements with service providers
• Encryption during transfer and storage
• Regular security and privacy assessments

9. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information.

9.1 Your CCPA Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (subject to exceptions)
• Right to Opt-Out: Opt-out of the sale of your personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights

9.2 Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, IP address)
• Commercial information (transaction history, purchase records)
• Financial information (payment card details, expense data)
• Internet or network activity (browsing history, usage data)
• Geolocation data (approximate location based on IP address)
• Professional information (company name, job title)

9.3 How to Exercise Your CCPA Rights

To exercise your CCPA rights, contact us at:

• Email: [email protected]
• Phone: 1-800-XXX-XXXX (toll-free)
• Online Form: Submit a Privacy Request

We will verify your identity before processing your request and respond within 45 days.

9.4 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We will require written proof of the agent's authorization and may verify your identity directly.

10. Children's Privacy

Our Service is not directed to individuals under the age of 18 ("Children"). We do not knowingly collect personal information from Children.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at [email protected]. If we become aware that we have collected personal information from Children without verification of parental consent, we will take steps to delete that information immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

11.1 How We Notify You

• We will post the updated Privacy Policy on this page with a revised "Last Updated" date
• For material changes, we will notify you via email to the address associated with your account
• For significant changes affecting your rights, we may display an in-app notification or banner
• Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy

We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: