1. Who we are

Expiro is a product of Elixon LTD, a company registered in England and Wales. We provide contract renewal tracking software for businesses.

If you have any questions about this policy, contact us at support@expiro.io.

2. What data we collect

Every category below is something the application actually stores. It was written by reading the code rather than from a template.

Your account - email address, company name, plan and billing status, time zone, and the settings you choose. Passwords are stored only as a hash, never as text.
Your team - the email address of everyone you invite, their role, and the invitations themselves until they are accepted or expire.
Contracts - everything you enter about each one: name, client name and email, value and currency, dates, notice period, notes, renewal terms, pipeline status and any custom fields you define, plus notes, comments and the timeline of what changed.
Files you attach - contract attachments, stored in our own Cloudflare R2 bucket, restricted to the European Union.
A PDF you ask us to read dates from - when you upload a contract on the contract form to have its end date, notice period and auto-renewal filled in, its text is read on our own server with open-source tools (and OCR for a scanned page). It is not sent to any other service and no AI reads it. The file is deleted as soon as the dates are read and is not kept; only what you then save on the form is stored.
Two-factor and sign-in data - your two-factor secret (encrypted with a separate key), hashed backup codes, and session tokens - each with the name of the browser it was issued to, the network it came from with the last part of the address removed, and when it was last used, so you can see where you are signed in and sign any of them out. To tell you about a sign-in from a browser you have not used before, each browser you sign in from keeps a random identifier in a cookie, and we keep a one-way hash of it with the time it was last used - not your IP address. A browser not used for 90 days is forgotten.
Referrals - if you open another customer's referral link, a cookie remembers the link's code for up to 30 days, so that signing up gives you the longer trial. When you then create an account, we record that it came through that customer's link. The customer who invited you sees how many businesses signed up and subscribed through their link - never your name, your company or your address. Nothing is sent to anyone because of a referral: we do not write to the people a customer invites.
Notification details you provide - a phone number if you turn on SMS alerts, a browser push subscription if you allow notifications, and the webhook URLs or chat identifiers for any channel you connect (Slack, Teams, Discord, Google Chat, Mattermost, Telegram, Pushover, ntfy or your own webhook).
Activity records - the audit log of key account actions (who did it, when, and from which IP address and browser, including when a member of our support staff signed in to your account at your request - you can see those sessions, who and when, in Settings, Activity), in-app notifications, and the record of which alerts were sent and to whom. An entry in the audit log is kept for 12 months, and all of it is deleted with the account if that comes sooner.
Security records - every sign-in and sign-out, and every sign-in attempt or API request that was refused, with the time, the IP address and browser it came from, and the outcome. We keep them to notice and investigate attempts to break into accounts. Never a password, a code or a token; an attempt made with an address that has no account keeps no address at all. They are kept for 24 months. The ones about your account appear in Settings, Activity and are deleted with the account if that comes sooner; the ones that belong to no account lose the IP address and browser after 90 days.
API tokens - stored as a hash. The token itself is shown to you once and never stored.
How you found us - the campaign parameters and referring site of your first and most recent visit.
Billing - handled by Stripe. We hold your Stripe customer reference and subscription status; card details never reach us.
Usage analytics via Umami, our own self-hosted analytics on servers we run. While you are signed in, pages you visit are recorded against your internal account identifier - a random id we already hold - together with your plan and your role. No name, email address, company name or contract data is ever sent to analytics, and pages whose address carries a sign-in or unsubscribe link are not recorded at all.
Error reports - when something breaks we record what failed, on our own monitoring server. Request bodies are never included, so contract data cannot leave this way.
Backups - daily snapshots of the database, kept for 30 days in the same region and then deleted automatically.

3. How we use your data

To provide and operate the Expiro service
To send you contract expiry alerts and product emails
To process payments via Stripe
To improve the product by measuring how it is used, without personal data

4. Data storage

Your data is stored on servers located in the United Kingdom and the European Union. The application, the database and its backups are in the United Kingdom; the files you attach to a contract are in the European Union. Neither leaves those two places:

Application and database - Fly.io, London (lhr), volume encrypted at rest
Contract attachments - Cloudflare R2, European Union jurisdiction
Database snapshots - Fly.io, London (lhr)

Some of the third parties listed below process data outside the UK on our behalf; each one is named in section 5 with what it receives.

5. Third parties

Fly.io - hosting for the application and the database, in London. Subject to Fly.io's privacy policy.
Cloudflare (R2) - storage for the files you attach to a contract, in the European Union.
Stripe - payment processing. Receives your email address and billing details; card details go to Stripe and never to us.
Resend - email delivery. Receives the address and content of transactional emails, which include contract names and dates in your alerts.
Twilio - SMS delivery, only if you turn SMS alerts on. Receives your phone number and the message.
Twilio and Meta (WhatsApp) - WhatsApp alerts, only where we offer them and only if you switch them on, which records when you agreed. Receive your phone number and the alert: the contract name, the client and the dates. Switching WhatsApp off, or changing your number, withdraws that agreement.
Any notification channel you connect yourself - Slack, Microsoft Teams, Discord, Google Chat, Mattermost, Telegram, Pushover, ntfy or your own webhook. Alerts you have asked for are sent there, which means the contract name, client and date go to that service. You choose which, and you can disconnect at any time.
Umami - analytics, self-hosted by Elixon LTD. Your data is not shared with an analytics company: the software runs on our own servers. See section 2 for what is recorded.
GlitchTip - error monitoring, also self-hosted by Elixon LTD on our own server. Receives what failed and where, never request bodies.

6. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Request correction or deletion of your data
Object to or restrict processing of your data
Data portability

To exercise any of these rights, email us at support@expiro.io.

7. Data retention

Cancelling a subscription and deleting an account are two different things, and only one of them removes anything.

Cancelling your subscription deletes nothing. Your account stays, your contracts stay, and you can still sign in, read everything and export it. When the paid period ends the account moves to the free plan - nothing is locked or deleted. Free for good, no credit card: alerts for up to 5 contracts, 1 user, email and one chat channel, and the calendar feed. SMS, the API, more people and every channel come with a paid plan.
Deleting your account starts a 30-day grace period. During it nothing is destroyed and you can cancel the deletion yourself. When it runs out, a scheduled job permanently deletes the account and everything in it - contracts, attachments (the stored files, not only their records), notes, comments, audit records and tokens. The files are deleted first; if file storage cannot be reached, the account is left in place and the job tries again the next night, rather than deleting the records and leaving the files behind. That job is monitored, so a purge that fails to run is noticed rather than assumed.
Backups. Database snapshots are kept for 30 days and then deleted automatically, so a purged account can persist in a snapshot until the last snapshot taken before the purge ages out.

Export before either. You can export your contracts as CSV and your whole account as JSON at any time from the application, without asking us.

8. Businesses we contact

We sometimes write to businesses we think have the problem Expiro solves. This section is about those messages, not about customers.

Where the details come from. The contact address published on that business's own website. We do not buy lists, we do not use scraping or enrichment services, and we do not guess addresses.
What we hold. The business name, the published contact address, and the page it came from. Nothing else, and nothing about anybody's private life.
Our lawful basis. Legitimate interest, under UK GDPR Article 6(1)(f): telling a business about a product relevant to how it operates. We have assessed the impact on the individual as a single email that promises no second one.
We write once. Every message says who sent it and gives a postal address. We do not follow up, we do not pass details to anybody else, and we never sell them.
Objecting takes one word. Reply "no" and the address is removed permanently. We keep a suppression list so that a removal cannot be undone by a later mistake - it is a record of your objection, not a contact list.

To object, ask what we hold, or have it erased, email support@expiro.io.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email.

Privacy Policy