Privacy Policy
Privacy
What we collect, why we keep it, and how you can ask us to change that.
This policy covers every Xpancom surface: the marketing site, tokenized onboarding intake, invitation-only authentication, and the client workspace. It is not limited to browsing xpancom.com.
01 / Section
Who is responsible.
Xpancom, LLC is the controller of personal information we collect for our own purposes: marketing inquiries, operator-issued intake that we originate, account identity, and security logs. When we process personal information on a client's documented instructions under a statement of work, we are a processor and the Data Processing Addendum applies.
Our principal place of business is Florida, United States. Write to privacy@xpancom.com for the current mailing address used for privacy correspondence.
02 / Section
The surfaces this policy covers.
- Marketing site
- xpancom.com, including the contact form and public legal and trust pages.
- Onboarding intake
- Tokenized /intake/[token] links issued by Xpancom operators. Not a public form.
- Client workspace
- app.xpancom.com. Invitation-only. No public signup.
- Authentication
- auth.xpancom.com. Magic-link or SMS sign-in for invited people only.
- Operator admin
- Internal. Issues invitations and intake links. Not a public destination.
03 / Section
Categories of information.
We collect identity and contact details (name, business email, company, optional role and phone). We collect business operational descriptions you choose to type into an inquiry or intake. We collect account identifiers, session IP address, and user agent when you sign in to the invitation-only workspace. We collect workspace records a client chooses to keep in the app (initiatives, decisions, documents, metrics, workforce transition notes).
Intake is designed for operating-level answers. Do not enter passwords, API keys, customer records, employee files, payment card data, or health information. There are no file upload fields on the public contact form.
- Sources: you, your colleagues on an invited workspace, Xpancom operators who issue a link, and the devices used to reach our hosts.
- We do not buy marketing lists. We do not run advertising pixels or analytics SDKs on this site.
- We do not collect precise geolocation, biometric identifiers, or payment cards on Xpancom systems.
04 / Section
Why we use it.
We use personal information to respond to inquiries, qualify and deliver professional services, operate the invitation-only workspace, protect the systems, meet legal duties, and keep a record of privacy requests.
Legal bases we rely on where a basis is required: performance of a contract or steps toward one; legitimate interests in B2B communication, security, and running the practice; consent where a law requires it (for example certain SMS messages). Invitation-only SMS one-time codes are sent only to a number named on an access grant.
05 / Section
SMS sign-in codes and mobile numbers.
Xpancom sends SMS only as invitation-only sign-in codes. A code is sent only to a mobile number already named on an access grant, and only when that person requests a code on the sign-in page. We do not send marketing or promotional texts. Message frequency is one one-time code per sign-in request. Message and data rates may apply. Reply STOP to opt out of SMS. Reply HELP for help.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
Twilio processes the number so the code can be delivered. That is a service provider used to provide sign-in, not a sale and not a marketing share. Other processors are listed on the subprocessors page. This notice is published at https://xpancom.com/privacy. Privacy questions about SMS: privacy@xpancom.com.
06 / Section
Marketing inquiries are stored.
The contact form sends your details to Xpancom. We store them in Neon in the United States and notify operators by transactional email. Sending an inquiry does not create a paid engagement and does not create a workspace account.
Please keep the description at the operating level. Do not include passwords, customer records, employee records, financial documents, or health information.
07 / Section
Your rights and how to use them.
You may request access, correction, deletion, export, or restriction, and you may appeal a refusal, by emailing privacy@xpancom.com or by using the request form on this page. We will verify the request and respond within 45 days, or sooner where a shorter statutory period applies. We will not discriminate against you for exercising a privacy right.
Florida residents have the rights described in the Florida Digital Bill of Rights, including confirmation, access, correction, deletion, and to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.
California residents have the rights described in the CCPA/CPRA, including knowledge, deletion, correction, and to opt out of sale or share. We have no such sale or share. We do not offer a financial incentive program tied to personal information.
If we process data of a person in the EEA or United Kingdom as a processor, the client's instructions and the Standard Contractual Clauses in the Data Processing Addendum apply. International transfers of Xpancom-controlled data are to the United States.
Submit a privacy request.
This request is stored with Xpancom and sent to privacy@xpancom.com. We verify it before we act.
08 / Section
Children and automated employment decisions.
The site and the services are for established businesses. They are not directed at anyone under 18, and we do not knowingly collect personal information from children.
We do not make automated decisions that produce legal or similarly significant effects about employment. There are no hidden replaceability scores. People and Trust explains how workforce effects are handled in an engagement.
09 / Section
Retention, subprocessors, and security.
We keep information only as long as the published schedule requires, unless a legal hold applies. Processors that handle personal information for us, including Twilio for SMS delivery, are listed on the subprocessors page. Using a processor to send a sign-in code is not a sale, and it is not sharing mobile numbers or messaging consent with third parties or affiliates for marketing or promotional purposes. Security practices are described on the Trust Center.
10 / Section
Changes to this policy.
If we change this policy in a material way, we will update the version and date on this page. If we add analytics, advertising, or any optional tracker, this policy, the cookie notice, and the site's controls will be updated before that tracker is enabled.