Privacy Policy

1. Introduction

Expona ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Service"). Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

We collect information in the following ways:

• Account Information: When you register, we collect your name, email address, and payment information.
• Workspace Data: Content you create within Expona — including company profiles, buyer personas, campaigns, and generated content — is stored securely in your workspace.
• AI Interaction Data: When you interact with Lumi or other AI features, we process your inputs (prompts, questions, and contextual data) to generate responses. This data is transmitted to our third-party AI model providers for processing.
• Usage Data: We collect anonymized analytics about how you interact with the Service to improve performance and user experience.
• Device & Browser Data: We may collect information about your device, browser type, operating system, and IP address for security and analytics purposes.
• Communications: When you contact us via email or our contact form, we retain that correspondence.

3. How We Use Your Information

• To provide, operate, and maintain the Service
• To process transactions and manage your subscription
• To personalize your experience and deliver relevant AI-generated outputs
• To process your inputs through AI models for content generation, persona creation, and conversational assistance
• To communicate with you about updates, support, and marketing (with opt-out)
• To monitor and analyze usage trends and improve the platform
• To detect, prevent, and address technical or security issues
• To enforce our Terms of Use and comply with legal obligations

4. AI Data Processing

Expona uses third-party AI model providers (including Anthropic, OpenAI, and Groq) to power Lumi and other AI features. When you use AI-powered features:

• Your inputs (such as prompts, persona data, and campaign context) are transmitted to these providers to generate responses.
• Our AI providers process your data under their respective data processing agreements and are contractually prohibited from using your inputs to train their models.
• AI memory within Lumi is session-based and does not persist between sessions unless explicitly saved by you to your workspace.
• We do not use your workspace content — including personas, campaigns, or generated artifacts — to train any AI models, whether our own or third-party.
• Generated outputs are stored in your workspace and subject to the same data protection measures as all other workspace data.

5. Data Isolation

Your workspace data is isolated at the account level. Each account operates in a logically separated environment. No data from your workspace is accessible to other users or accounts. Your data stays yours.

6. Data Security

We use industry-standard encryption in transit (TLS 1.3) and at rest (AES-256) to protect your data. Access controls, audit logs, and infrastructure monitoring are in place to safeguard your information. While no system is 100% secure, we take commercially reasonable measures to protect your data.

7. Third-Party Services

We use third-party services to operate and improve the Service. These providers are selected for their security practices and are bound by their own privacy policies. Our key third-party service categories include:

• AI Model Providers: Anthropic, OpenAI, Groq, and other providers as needed — for content generation and AI assistant features
• Payment Processing: Stripe — for subscription billing and payment handling
• Hosting & Infrastructure: Vercel — for application hosting and delivery
• Database: Supabase — for secure data storage
• Analytics: Vercel Analytics and Google Analytics (via Google Tag Manager) — anonymized usage analytics to understand platform performance. Google's privacy policy governs data processed through Google Analytics.
• Email: Transactional and marketing email delivery services

We do not sell your personal information to third parties.

8. Cookies

We use cookies and similar technologies to operate and improve the Service. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

You can manage your cookie preferences through the consent banner displayed when you first visit our site, or through your browser settings at any time.

9. Data Retention

We retain your account and workspace data for as long as your account is active. If you close your account, we will delete your workspace data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records, fraud prevention). Anonymized analytics data may be retained indefinitely.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict processing of your data
• Export your data in a portable format
• Withdraw consent where processing is based on consent
• Opt out of marketing communications at any time

To exercise these rights, contact us at privacy@expona.ai. We will respond to your request within 30 days.

11. International Users

Expona's infrastructure is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We may also notify you via email for significant changes. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@expona.ai or through our contact page.