EXPAND PRIVACY POLICY

Last updated: September 14, 2026

ExpandAI, Inc. (“Expand”, “we”, “us”, or “our”) provides a web and document data extraction API and related services for developers and businesses. This Privacy Policy explains how we collect, use, disclose, and retain personal information when you visit our websites (including expand.ai and its subdomains, the “Sites”), create an account or use our dashboard and APIs (together with the Sites, the “Services”), communicate with us, or otherwise interact with us.

Who this Policy covers. This Policy applies to website visitors, prospective customers who contact us or sign up for demos, newsletters, or events, account holders and the individuals who use the Services on their behalf (“Users”), and people who communicate with us for sales, support, billing, or other purposes.

Customer Content is different. Our customers use the Services to retrieve publicly accessible web pages and files, and the Services generate output and archives for the customer’s account. The URLs, instructions, and files our customers submit, and the output and archives we generate for them (together, “Customer Content”), are processed on the customer’s behalf under our agreement with that customer, not under this Policy, except as described in Section 3. If you believe your personal information appears in Customer Content, Section 3 explains how to contact us.

1. INFORMATION WE COLLECT

Information you provide to us

• Account information: name, email address, company or organization name, role, password or single sign-on details, and profile and organization settings.
• Billing information: billing contact and address, plan and purchase history, and payment details. Payment card numbers are collected and processed by our payment and billing providers (currently Autumn, with payments processed by Stripe); we receive limited information such as the card type, the last four digits, the expiration date, and transaction confirmations.
• Communications: the content of emails, support requests, chat or community messages, demo or sales inquiries, survey responses, and feedback you send us, together with your contact details.
• Marketing preferences: newsletter, event, and product update sign-ups and your communication choices.
• Job applications: if you apply to work with us, the information in your application and any interview notes [confirm whether Expand collects applications through the Sites].

Information we collect automatically

• Device and usage information: IP address, approximate location derived from IP address, browser and operating system, device identifiers, language, referring and exit pages, pages viewed, links clicked, and the dates and times of your visits.
• Service telemetry: when you use the dashboard or the API, we log technical information about each request, such as the API key identifier, timestamp, endpoint, request parameters (including the URLs you direct the Services to access), response status, latency, credits consumed, error information, and the IP address of the calling system.
• Cookies and similar technologies: we and our service providers use cookies, local storage, pixels, and similar technologies to operate the Sites, keep you signed in, remember your preferences, and understand how the Services are used. See Section 5.

Information from other sources

• Authentication providers: if you sign in using a third-party identity provider [such as Google or GitHub], we receive your name, email address, and profile identifier from that provider.
• Payment and billing providers: transaction confirmations, payment status, and fraud signals.
• Business information: publicly available professional and company information, and information from referral partners or events, which we may use to understand prospective customers and personalize our outreach.

2. HOW WE USE INFORMATION

We use personal information for the following purposes:

• Providing the Services: to create and manage accounts, authenticate Users, process API requests, meter usage and credits, generate output and archives for customers, and provide the dashboard.
• Billing and payments: to process payments, issue invoices, manage credits and subscriptions, and detect and prevent payment fraud.
• Support and communications: to respond to inquiries, provide technical support, send service, security, and billing notices, and communicate about changes to the Services or our terms.
• Marketing: to send newsletters, product updates, and information about features, events, and offers where permitted by law. You can opt out at any time as described in Section 8.
• Security, abuse prevention, and enforcement: to monitor and protect the security and integrity of the Services, detect and prevent misuse (including use of the Services against websites in violation of our terms), respond to complaints from website operators and others, and enforce our agreements.
• Analytics and improvement: to understand how the Services are used, measure performance, diagnose problems, and develop and improve the Services. Where we can, we use de-identified or aggregated information for these purposes.
• Legal compliance: to comply with applicable law, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims.
• Business transactions: to evaluate or carry out a merger, financing, acquisition, reorganization, or sale of assets, in which personal information may be among the transferred assets.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals.

3. CUSTOMER CONTENT AND FETCHED WEB CONTENT

How the Services work. A customer submits URLs or files and instructions through the API. The Services retrieve the publicly accessible page or file, process it (including with our proprietary model, Iris), and return structured output, highlights, and citations to the customer, together with an archive of the captured page that is stored for the customer’s account for a limited period. Public web pages may incidentally contain personal information about individuals, such as names, contact details, professional information, or public posts.

Our role. We process Customer Content as a service provider or processor acting on our customers’ instructions. Each customer decides which URLs to submit and how to use the output, and is responsible for its own compliance with applicable law. We do not sell Customer Content, use it to build or enrich profiles of individuals, or combine it across customers to create our own datasets about people. We do not use Customer Content to train or fine-tune our machine-learning models unless the customer has separately permitted us to do so. We may use de-identified and aggregated usage information (such as request volumes and error rates) to operate, secure, and improve the Services.

Retention of Customer Content. Captured images are available to the customer for ninety (90) days from capture. Other archive artifacts, including output, citation mappings, page representations, and network and structured page data, are retained for [ninety (90)] days from capture unless our agreement with the customer provides otherwise. After the retention period, or after the thirty (30)-day export period that follows the end of the customer’s agreement or account, we delete or de-identify the archive, subject to the exceptions in Section 6. Snapshot links generated by the Services are designed to be shareable by the customer and may be accessible to anyone who has the link.

If your information appears in Customer Content. If you believe that a customer has used the Services to capture a web page containing your personal information and you wish to exercise privacy rights with respect to that information, please contact the customer directly where you are able to identify it, or contact us at [privacy@expand.ai]. Where we act as a service provider or processor, we will refer your request to the relevant customer and assist as required by applicable law and our agreement with the customer. Please note that we do not maintain a database of individuals and generally cannot identify whether a given person’s information appears in Customer Content without specific information about the web pages concerned.

4. HOW WE DISCLOSE INFORMATION

We disclose personal information in the following circumstances:

• Service providers: companies that provide services to us under contract and process personal information on our behalf, including cloud hosting and infrastructure [confirm providers, e.g., AWS / Google Cloud / Cloudflare], machine-learning model providers [confirm whether third-party model APIs process Customer Content], payment and billing (Autumn, Stripe), product analytics (PostHog), authentication, email delivery, customer support and communications tools, and error monitoring. A current list of the subprocessors that process Customer Content is available at expand.ai/subprocessors.
• Customers: if you use the Services as a User on behalf of a customer organization, we may disclose your account and usage information to that organization’s administrators.
• Professional advisors: lawyers, accountants, auditors, insurers, and other advisors in connection with the services they provide to us.
• Legal and safety: to comply with law, regulation, legal process, or governmental request; to enforce our agreements and protect our rights, property, and safety and those of our customers, website operators, and others; and to detect, prevent, or address fraud, security, or technical issues.
• Business transfers: to a buyer, investor, or successor in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, with reasonable measures to protect confidentiality.
• With your direction or consent: for example, when you connect a third-party tool to your account or ask us to share information.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising or targeted advertising. [Confirm that no advertising pixels or retargeting tools are deployed on the Sites; if they are, this statement and the state-law section must be revised and an opt-out link added.] We may disclose de-identified or aggregated information that does not identify any individual.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use the following categories of cookies and similar technologies on the Sites and in the dashboard:

• Strictly necessary: to operate the Sites and the dashboard, authenticate Users, maintain sessions, and protect against fraud and abuse. These cannot be switched off in our systems.
• Functional: to remember your preferences and settings.
• Analytics: to understand how visitors and Users interact with the Sites and the Services, using PostHog and [other analytics tools]. These tools collect information such as pages viewed, clicks, device and browser information, and IP address.

Your choices. You can control cookies through your browser settings, including by blocking or deleting cookies, although some features of the Services may not function properly without them. [Where we deploy a cookie banner or consent manager, you can manage non-essential cookies through it.] We [honor] / [do not currently respond to] browser-based opt-out preference signals such as Global Privacy Control. Because we do not sell or share personal information for targeted advertising, such signals do not change how we process your information beyond the analytics choices described here. There is no industry standard for “Do Not Track” signals, and we do not respond to them.

6. DATA RETENTION

We retain personal information for as long as needed for the purposes described in this Policy, and then delete or de-identify it, unless a longer period is required or permitted by law. Our general retention practices are:

• Account information: for the life of the account and for [thirty (30) days] after closure, after which it is deleted or de-identified, except as needed for the purposes below.
• Billing and transaction records: for [seven (7)] years after the transaction, to meet tax, accounting, and audit obligations.
• Service telemetry and API logs: for [twelve (12) months], after which they are deleted or aggregated; security logs may be retained longer where needed to investigate incidents.
• Support and sales communications: for [three (3) years] after the last interaction.
• Website analytics: for [fourteen (14) months] in identifiable form.
• Customer Content: captured images for ninety (90) days from capture, and other archive artifacts for [ninety (90)] days from capture, unless our agreement with the customer provides otherwise; remaining Customer Content is deleted or de-identified after the thirty (30)-day export period that follows the end of the customer’s agreement or account.

Exceptions. We may retain information beyond these periods where reasonably necessary to comply with legal obligations, resolve disputes, enforce our agreements, investigate security incidents or abuse, or maintain backups. Information in routine backups is deleted or overwritten in the ordinary course, generally within [thirty (30) to ninety (90)] days.

7. SECURITY

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit, access controls that limit access to personnel who need it, credential management for API keys, logging and monitoring, and vulnerability management. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

8. YOUR CHOICES

• Account information: you can review and update most account information in the dashboard or by contacting us.
• Marketing communications: you can opt out of marketing emails by using the unsubscribe link in any marketing email or by contacting us. We will continue to send service, security, and billing communications that are necessary to provide the Services.
• Cookies: see Section 5.
• Telemetry: service telemetry is inherent to providing an API and cannot be disabled while you use the Services.

9. U.S. STATE PRIVACY RIGHTS

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws may have some or all of the following rights with respect to their personal information, subject to applicable exceptions: [Many state laws apply only to businesses above revenue or volume thresholds and exclude information about individuals acting in a business capacity. Confirm which laws apply to Expand; the rights below are offered where required by applicable law.]

• Access and portability: to confirm whether we process your personal information, to access it, and to obtain a copy in a portable format.
• Correction: to correct inaccurate personal information.
• Deletion: to request that we delete personal information we have collected from you.
• Opt-out: to opt out of the sale of personal information, sharing or processing for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in these activities.
• Limit use of sensitive personal information: we use sensitive personal information (such as account credentials) only for the purposes permitted without a right to limit.
• Non-discrimination: we will not discriminate against you for exercising your rights.
• Appeal: if we decline your request, you may appeal by replying to our response; we will explain the outcome and, where applicable, how to contact your state attorney general.

How to exercise your rights. Submit a request by emailing [privacy@expand.ai] [or through the request form at expand.ai/privacy-request]. We will verify your identity using the email address associated with your account or other information reasonably necessary to confirm that you are the person about whom we hold information, and we may ask an authorized agent for proof of authority. We respond within forty-five (45) days, which may be extended by a further forty-five (45) days where reasonably necessary. Requests concerning personal information contained in Customer Content are handled as described in Section 3.

California notice at collection

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the California Consumer Privacy Act, for the purposes described in Section 2 and with disclosures to the categories of recipients described in Section 4. We retain each category for the periods described in Section 6.

We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age. We use sensitive personal information only as permitted by Cal. Civ. Code § 1798.121(a) and its regulations. We do not offer financial incentives in exchange for personal information. California residents may also request information about our disclosures of personal information to third parties for their direct marketing purposes under California’s “Shine the Light” law; we do not make such disclosures. [If Expand is a “data broker” under California law (it is not expected to be, because it does not sell personal information about consumers with whom it has no direct relationship), registration and DROP obligations would apply; confirm.]

10. INTERNATIONAL USERS; EEA, UK AND SWISS DATA SUBJECTS

[This Section applies if Expand offers the Services to, or monitors the behavior of, individuals in the European Economic Area, the United Kingdom, or Switzerland. Confirm whether Expand markets to or has Users in those regions; if not, retain the first paragraph only.]

Processing in the United States. We are located in the United States and process personal information in the United States and in other countries where we or our service providers operate. These countries may have data protection laws that differ from those of your country. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum [and, if certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions]. You may request a copy of the relevant safeguards by contacting us.

[Controller. ExpandAI, Inc. is the controller of the personal information described in Sections 1 and 2. For personal information contained in Customer Content, our customer is the controller and we are the processor. [If required under Article 27 GDPR / UK GDPR, insert the details of Expand’s EU and UK representatives.]

Legal bases. We process personal information (a) to perform our contract with you or to take steps at your request before entering into a contract (providing the Services, billing, support); (b) for our legitimate interests, where those interests are not overridden by your rights (securing and improving the Services, preventing abuse, marketing to business contacts, and administering our business); (c) to comply with legal obligations; and (d) with your consent, where we ask for it (for example, for non-essential cookies), which you may withdraw at any time.

Your rights. Subject to applicable law, you have the right to request access to, rectification or erasure of, or restriction of processing of your personal information; to object to processing based on legitimate interests, including direct marketing; to data portability; to withdraw consent; and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner). To exercise these rights, contact us at [privacy@expand.ai]. We respond within one month, which may be extended by two further months for complex requests.]

11. CHILDREN

The Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal information from anyone under the age of eighteen (18). If you believe that a child has provided us with personal information, please contact us at [privacy@expand.ai] and we will delete it.

12. THIRD-PARTY SITES AND SERVICES

The Sites and the Services may contain links to, or integrate with, third-party websites and services that we do not control, including the websites our customers direct the Services to access. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

13. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, if the changes are material, notify you by email or through the Services before they take effect where required by law. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of it to the extent permitted by law.

14. CONTACT US

If you have questions or concerns about this Policy or our privacy practices, or wish to exercise your rights, contact us at:

ExpandAI, Inc.

1105 Tennessee St, San Francisco, CA 94107

Email: [privacy@expand.ai]

Support: [support@expand.ai]