Privacy Policy

Xpense ("Xpense," "we," "us," or "our") provides an AI-powered expense management platform that helps organizations capture receipts and invoices, route approvals, and sync accounting data (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect personal and business information when you use the Service or visit our website.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

We collect the following categories of information:

• Account information. Name, email address, job title, organization, and login credentials when you or your organization create an account.
• Expense and financial documents. Receipts, invoices, and related documents you submit to the Service, along with data extracted from them such as vendor names, dates, amounts, line items, and payment terms.
• Accounting data from connected services. If your organization connects the Service to QuickBooks Online or another accounting system, we access data needed to operate the integration, as described in Section 4.
• Usage and device information. Log data such as IP address, browser type, pages viewed, actions taken within the Service, and timestamps. This includes audit trail records of expense submissions, approvals, and administrative actions.
• Communications. Information you provide when you contact us, request a demo, or correspond with vendors through the Service.

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Extract data from receipts and invoices, route approvals, and sync transactions with your connected accounting system;
• Authenticate users, enforce role-based permissions, and maintain audit trails required for compliance;
• Respond to support requests and communicate with you about the Service;
• Monitor and analyze usage to improve reliability, security, and functionality; and
• Comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use your financial or accounting data for advertising purposes.

The Service integrates with QuickBooks Online through APIs provided by Intuit Inc. This integration is optional and is only enabled when an authorized administrator of your organization explicitly connects your QuickBooks Online company to the Service using Intuit's secure OAuth 2.0 authorization flow. We never see or store your QuickBooks username or password.

When connected, the Service may access and store:

• Company information, chart of accounts, vendors, customers, jobs or classes, and tax codes, used to categorize and allocate expenses; and
• Transaction data (such as bills, expenses, and purchase details) that the Service creates, reads, or updates on your behalf to keep your books in sync.

Data obtained through the QuickBooks Online APIs is used solely to provide and improve the integration features you request. It is never sold, shared with third parties for their own purposes, or used for advertising. OAuth access tokens are stored encrypted and are used only to perform the actions you have authorized.

You may disconnect QuickBooks Online at any time from within the Service or from your Intuit account settings. Upon disconnection, we revoke and delete the associated access tokens and stop accessing your QuickBooks Online data. Your use of QuickBooks Online remains subject to Intuit's own terms of service and privacy policy.

We share information only in the following circumstances:

• Within your organization. Expense data is visible to users in your organization according to the roles and permissions your administrators configure.
• Service providers. We use trusted third-party providers for hosting, email delivery, and document processing. These providers may process data only on our behalf, under contractual confidentiality and security obligations.
• Connected services you authorize. Such as QuickBooks Online, as described in Section 4.
• Legal requirements. When required by law, subpoena, or legal process, or to protect the rights, safety, or property of Xpense, our customers, or others.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We take the security of your data seriously and use industry-standard safeguards to protect it, including:

• Encryption of data in transit using TLS;
• Encryption of sensitive data at rest, including OAuth tokens;
• Role-based access controls and audit logging within the Service;
• Least-privilege access for our personnel and service providers.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and applicable regulators as required by law.

We retain information for as long as your organization's account is active or as needed to provide the Service, satisfy legal, accounting, or reporting requirements (such as expense audit trails), and resolve disputes. When data is no longer needed, we delete or anonymize it. Your organization may request deletion of its data as described in Section 8.

Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 12. We will respond within the timeframes required by applicable law.

If you are an employee of an organization that uses Xpense, note that your organization controls its account data; we may direct your request to your organization's administrator where appropriate.

The Service uses cookies and similar technologies that are necessary to keep you signed in and to operate the Service securely. Our marketing website does not use third-party advertising or tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent the Service from functioning.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, or wish to exercise your privacy rights, please contact us through our contact page.