Privacy Policy

1. Overview

DataExpandr ("DataExpandr", "we", "our", or "us") provides AI-powered data pipeline and workflow automation tools for businesses and individuals. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, applications, and services (collectively, the "Service").

This Policy applies to all visitors, registered users, and paid subscribers. By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. Information We Collect

When you create an account, use DataExpandr, or interact with our services, we may collect the following information:

• Account information: name, email address, login credentials (encrypted), business name, and account preferences.
• Usage data: pipeline configurations, run history and metadata, workflow activity, feature usage, step types and connectors used, and AI interaction logs (prompts and token counts).
• Payment information: billing details processed securely through Stripe. We store only your subscription status and Stripe customer identifier — we never store full payment card details.
• Device and log data: IP address, browser type, device information, access times, diagnostics, and security logs. We generate a SHA-256 device fingerprint (IP + User-Agent) to detect new-device logins and send security alerts.
• Uploaded content: files, datasets, and source materials you provide for processing through the platform ("Customer Data").
• Forms and inquiries: information you submit through our contact and demo request forms — such as your name, work email, company, team size, country, and how you heard about us — which we process through HubSpot to respond to you and schedule demos.

3. Legal Bases for Processing

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under one or more of the following legal bases:

• Performance of a contract: to provide, operate, and maintain the Service and process your transactions (Sections 4a, 4b, 4c).
• Legitimate interests: to improve the Service, monitor for security threats, prevent fraud, and send service-related communications (Sections 4d, 4e, 4f).
• Consent: for optional marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing (Section 4g).
• Legal obligation: to comply with applicable laws, regulations, legal processes, and law enforcement requests (Section 4h).

4. How We Use Your Data

We use the information we collect to:

• (a) Provide, maintain, and improve the DataExpandr platform.
• (b) Process workflows, uploaded content, and pipeline executions.
• (c) Process transactions and send billing-related communications.
• (d) Send service updates, security alerts, and support messages.
• (e) Improve service reliability, usability, and feature development.
• (f) Monitor for fraud, unauthorized access, security incidents, and misuse of the platform.
• (g) Respond to contact and demo inquiries, and send related sales or marketing communications, which you can opt out of at any time.
• (h) Comply with legal, regulatory, and contractual obligations.

5. Customer Data and AI/ML Processing

You retain ownership of Customer Data you upload to DataExpandr. We act as a processor of Customer Data on your behalf and only use it to provide and support the services you request.

We do not use Customer Data to train our own machine learning or AI models.

Where DataExpandr uses third-party AI providers (currently via OpenRouter) to operate features of the platform such as transform code generation and data explanations, we make reasonable efforts to use providers that offer contractual commitments or technical controls limiting the use of Customer Data for model training, and we configure those services accordingly where such options are available.

You are responsible for ensuring you have the necessary rights and permissions to upload Customer Data to the platform, including any personal information about third parties contained within it.

6. Data Processing & Storage

Customer Data is processed during pipeline runs to provide the services you request. Uploaded source files are processed for the duration needed to execute your workflows and are not intentionally retained longer than necessary to operate the Service, troubleshoot issues, or comply with legal obligations.

Pipeline configurations, metadata, account settings, and run history are stored to enable scheduled workflows, user dashboards, service reliability, and support.

We use industry-standard safeguards to protect data in transit (TLS/HTTPS) and at rest (AES-256-GCM encryption for sensitive fields such as two-factor secrets and connection credentials). However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a security incident affecting your personal information, we will provide notifications where required by applicable law, including to any applicable supervisory authority within the timeframes required by the GDPR or other applicable data protection legislation.

7. Data Sharing

We do not sell personal information or share it for cross-context behavioral advertising.

We may share data with:

• Service providers: trusted third parties that help us operate our platform (see Section 9 — Sub-processors). These providers are bound by contractual confidentiality, privacy, and security obligations and may only process information on our behalf.
• Legal requirements: when required by law, regulation, legal process, or to protect the rights, safety, and security of DataExpandr, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, with appropriate notice where required.

8. Cookies & Tracking

We use essential cookies and similar technologies to maintain sessions, secure accounts, and operate the platform. We also use third-party analytics and marketing tools, some of which set their own cookies:

• Umami provides privacy-friendly, cookieless website analytics (aggregate page views, referrers, and device type). It does not use cookies, does not collect personal data, and we never sell it.
• HubSpot powers our contact and demo request forms and may set cookies on those pages to associate your form submissions with your visit so our team can follow up.

For a complete list of cookies we use, how to control them, and your opt-out options, see our Cookie Policy.

We do not use third-party advertising trackers to sell or target advertising based on your personal information.

Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. Because there is no industry-accepted standard for how to respond to DNT signals, we do not currently alter our data collection or use practices in response to DNT signals. We do not track users across third-party websites, and our analytics provider (Umami) is cookieless and does not engage in cross-site tracking.

9. Sub-processors

DataExpandr relies on the following categories of third-party sub-processors to operate portions of the Service. Each is bound by contractual confidentiality, privacy, and security obligations.

We may update this list as our infrastructure evolves. Enterprise customers may request a current sub-processor list at any time by contacting [email protected].

10. International Data Transfers

Your information may be processed and stored in countries other than your own, including the United States. By using DataExpandr, you acknowledge that your information may be transferred to jurisdictions that may have different data protection laws than your country of residence.

Where required by law, including for transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. You may request a copy of the applicable transfer safeguards by contacting [email protected].

11. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you and receive a copy in a portable format.
• Correct inaccurate or incomplete personal information.
• Delete your personal information (right to erasure), subject to legal retention obligations.
• Export your pipeline configurations and run history (data portability).
• Object to or restrict certain processing activities, including processing based on legitimate interests.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Manage communication and privacy preferences.
• Lodge a complaint with your local data protection authority (e.g., the ICO in the UK, CNIL in France, or your EEA supervisory authority).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or sooner if required by applicable law). We will not discriminate against you for exercising any of these rights.

12. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

• Account data: retained while your account is active and for a reasonable period after closure to fulfill legal, billing, security, and backup obligations.
• Customer Data (uploaded files): processed transiently during pipeline runs; not intentionally retained beyond what is needed to operate the Service, troubleshoot, and comply with legal obligations.
• Pipeline configurations and run history: retained for as long as your account is active to support scheduled execution, dashboards, and versioning.
• Security and audit logs: retained for up to 12 months for fraud prevention and incident response.
• Aggregated / anonymized data: may be retained indefinitely for analytics and service improvement.

If you delete your account, we will remove or anonymize personal data within 30 days, except where retention is required by law.

13. Children's Privacy

DataExpandr is not directed toward children under the age of 13 (or the applicable minimum age in your jurisdiction, such as 16 in parts of the European Economic Area), and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take appropriate steps to delete it promptly.

14. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to:

• Know what personal information we collect, use, disclose, and (if applicable) share.
• Request access to, correction of, or deletion of personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising. DataExpandr does not currently sell or share personal information for these purposes.
• Limit the use and disclosure of sensitive personal information.
• Be free from discrimination for exercising these rights.

To submit a CCPA/CPRA request, contact us at [email protected]. We will verify your identity before processing your request.

15. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-Service notification at least 30 days before the changes take effect. For non-material changes, we will update the "Last updated" date above. Continued use of the platform after changes constitutes acceptance of the updated policy.

16. Contact

If you have questions about this Privacy Policy or would like to submit a privacy-related request, contact us at:

• Privacy inquiries: [email protected]
• Legal matters: [email protected]
• General support: [email protected]