Privacy Policy

Controller: Valinorsk LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Email: hello@xpanion.com. Phone: +1 307 218 8332.

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12875832842

powered by Prighter

Xpanion processes your meetings on your own machine. Your audio, transcripts, minutes, projects, notes and time records stay on your computer. They are not sent to us, we cannot read them, and we cannot recover them for you.

What we do receive is limited to what is needed to give or sell you a license, keep that license valid and within the limits of your plan, deliver the software, and answer you when you write to us or leave us a voicemail.

We do not use your meeting content to train any model. We could not: it never reaches us.

• Audio is held in memory while a meeting is recorded, is never written to disk, and is not transmitted.
• Transcripts, summaries, minutes, action items, boards, timelines and time records are stored locally and are not transmitted, apart from what Xpanion shares with your organization's own company hub (below).
• File names, project names, participant names and speaker labels are not transmitted, apart from what Xpanion shares with your organization's own company hub (below).
• We operate no analytics, telemetry, crash reporting or session recording inside the application.

INV-1Audio is never written to disk

Capture lives in memory and is discarded the instant it's processed. There is no recording file to leak, subpoena, or lose.

INV-2Meeting data never leaves your Mac

Transcripts, minutes, and plans stay on your machine. Nothing from your meetings ever leaves your Mac — Xpanion only checks your license, downloads its models once, and looks for updates.

INV-3Nothing is trained on your data

The model runs locally on Apple silicon. Your conversations are never used to improve anyone's model — ours or otherwise.

INV-4Voiceprints vanish

Speaker separation happens in memory and is never stored or linked across meetings. The voiceprint exists for the length of the meeting, then it's gone.

Xpanion connects to the internet for the license check (section 4.1) — which includes the count of active projects — the model download (section 4.4), and the update check and the update download (section 4.5).

Two things Xpanion sends only when you ask for them inside the app: when you start Xpanion Free there, the email address you type; and when you own a plan for several people, the email address of a person you invite, and your requests to list or remove the people under your plan (section 4.2).

Where your license includes the company hub and Xpanion is connected to your organization's own hub, Xpanion signs in to that hub with the enrollment token your organization gave you and exchanges with it the projects and cards you share with your team — with their comments and activity — your team's member list, and the output-folder settings of your team and your organization; private cards are never sent, and the hub is run by your organization, not by us. Whether that connection is encrypted depends on the hub address your organization sets: an https address is, an http address is not.

4.1 License activation, validation and the count of active projects

Xpanion checks your license over the internet when you activate it, re-check it or change your plan, when you return to Xpanion shortly after opening the payment page, and periodically after that. Xpanion also asks our license service before it adds a project, and from time to time for the projects you already have, so that the limit on active projects holds across everyone under your plan.

Data, license check: The license check sends your license key, an identifier derived from your machine, and the version of Xpanion you are running; our license service also sees your IP address.

Data, project count: with the same three items, for each of your active projects a random identifier that Xpanion generated for this purpose and a counter that goes up each time we confirm it. We store, per identifier: which organization and which person under the plan holds it, whether it is active or released, the counter, and the times it was created, last confirmed, valid until, and released. We do not receive the project's name, its contents, or how much is in it, and the identifier is not derived from any of them.

Purpose: binding a license to a machine, enforcing the limits on people and active projects of a plan, preventing fraud.

Basis: Art. 6(1)(b) GDPR (performance of the contract); Art. 6(1)(f) for fraud prevention.

Retention: 90 days for validation records. A project identifier is kept until Xpanion releases it, which it does when you archive and remove the project; it is not released when your plan ends. An identifier that is never released is kept for as long as your account exists and for 12 months after that, to prevent misuse of the plan limits and of Xpanion Free, which is one per Mac. A released one is deleted once it has been released for 30 days and its last confirmation has run out. Your license and account records are kept for as long as the plan runs (section 4.2).

It carries nothing about your meetings, your recordings or your project data.

4.2 Account, plan and the people under it

Data: email address; for a portal account, authentication credentials in hashed form; plan, its limits and its end date; subscription status; license keys issued to you.

Starting Xpanion Free: the email address you enter. To keep the Free door from being used over and over we also store, for each request, a keyed hash of that address, a keyed hash of the network address the request came from, the machine identifier if the request came from the app, the time, and whether a message was sent. The hashes are made with a secret key held only by us; neither the address nor the IP address is stored in that record. When a Free license is activated we record which machine identifier holds it, so that one Mac holds one Free plan. That record keeps the Mac from starting another Free plan for as long as the plan is bound to it, and for 30 days after the plan has moved to another Mac.

Inviting people: if you own a plan for more than one person, you enter the email addresses of the people you invite. We store each address with the place it takes under your plan and send that person a message with a link to their license key. As the owner you see the list of people under your plan — address, invited or active, and when. If you were invited, the owner of the plan gave us your address; the owner can remove you, which ends your license.

Plans we issue directly: where a plan is arranged with us rather than bought at checkout, we hold the same data, entered by us from what you gave us.

Purpose: providing and administering the plan; for the Free door and the machine record, preventing a free offer from being multiplied.

Basis: Art. 6(1)(b); Art. 6(1)(f) for the request records and the machine record of the Free door; for an invited person before they accept, Art. 6(1)(f) — the owner's and our interest in delivering the invitation.

Retention: for the life of the plan and afterwards for as long as needed to handle renewals, disputes and refunds; then deleted. Request records of the Free door: 30 days. A Free plan that was requested and never activated is deleted 30 days after its last link expired. The record of which Mac holds a Free plan is kept for as long as your account exists and for 12 months after that, to prevent misuse of Xpanion Free, which is one per Mac; until then it stays when the plan is upgraded, ends or moves to another Mac.

4.3 Payment

We do not receive or store your card details. Payments are processed by Stripe as merchant of record. We receive confirmation of payment, the plan purchased, and the billing country — the last because tax treatment depends on it.

Free plans and plans we issue directly involve no payment and no payment data.

Basis: Art. 6(1)(b); Art. 6(1)(c) for the tax records.

Retention: for the period required by applicable tax law.

4.4 Model downloads

After you activate a license, Xpanion downloads the speech and language models it runs from Hugging Face and keeps them on your Mac. If a model is missing later, Xpanion downloads it again the same way.

The model download carries no license key, no machine identifier and no account data; Hugging Face sees your IP address.

On macOS 26 or later, the same step asks macOS to download Apple's speech-recognition assets for English and German, which macOS fetches from Apple.

Basis: Art. 6(1)(b).

4.5 Updates

Xpanion checks for a newer version shortly after it starts and every six hours while it runs, with or without an active license. The update check and the update download go to our update storage at Vercel and carry no license key, no machine identifier and no account data; Vercel sees your IP address.

A newer version is downloaded from the same storage, and its signature is verified before it is installed.

Basis: Art. 6(1)(b) while you have a subscription, and Art. 6(1)(f) — our legitimate interest in shipping security fixes — in every case, including without an active license.

4.6 Email we send you

Transactional email — the link to your license key (also for Xpanion Free and for an invitation), receipts, renewal and expiry notices, cancellation confirmations, a notice to the owner of a plan when their license moves to another Mac or a person is removed, replies to your messages.

Basis: Art. 6(1)(b).

Product announcements — occasional news about our own products and additions to Xpanion. We send these only to people who have bought from us and only about our own similar products.

Basis: Art. 6(1)(f), together with the existing-customer exception in Art. 13(2) of the ePrivacy Directive as implemented in your country.

You can opt out at any time, in every such message and by writing to hello@xpanion.com. Opting out does not stop transactional email: you will still get your license key and your receipts.

4.7 When you contact us

If you write to hello@xpanion.com, we receive your message, your address and whatever you choose to tell us.

Our phone number goes to voicemail: calls are not answered in person, and the voicemail service records your message and transcribes it automatically. If you call, we receive your number and, if you leave a message, its recording and transcript. The voicemail service is provided by OpenPhone Technologies, Inc. ("Quo").

Please do not send us meeting recordings, transcripts or minutes.

Basis: Art. 6(1)(b), or Art. 6(1)(f) where you are not a customer.

Retention: as long as needed to resolve the matter and handle any follow-up, for voicemail recordings and their transcripts as well.

4.8 Downloading the app

The download button on xpanion.com/download leads to our portal at portal.xpanion.com, which forwards your browser to the installer file in our storage at Vercel (Vercel Blob). Vercel delivers the file as our processor and sees your IP address.

The portal uses your IP address to count downloads per address within a one-hour window, so that the file cannot be pulled over and over, and for nothing else. The count is held in the working memory of the server instance that answers; it is never written to a database or a log, and it is not linked to an account, an order or a license. After the hour, the entry is dropped at the latest when that server instance next handles a request at the download address (portal.xpanion.com/download/current), or when it shuts down.

Independently of this count, Vercel, which hosts the portal and is listed in our register at /subprocessors/, records requests to the portal in its platform logs, with your IP address, as section 5 describes for this website; this covers the steps in section 4.9 as well. Those logs serve delivering the portal and keeping it secure, on the basis of Art. 6(1)(f). Vercel keeps these platform logs for one day.

Data: IP address.

Purpose: delivering the installer and limiting misuse of the download.

Basis: Art. 6(1)(f) — our legitimate interest in delivering the software and keeping its distribution from being misused.

4.9 Portal pages you use without an account

These steps on our portal at portal.xpanion.com work without signing in: buying a license, starting Xpanion Free, picking up a license key, asking for a new key and collecting it, canceling a subscription and confirming the cancellation, changing your plan from the app, and opening a download link from an earlier order email. Each of them uses your IP address to count requests per address within a one-minute window, so that none of them can be run over and over, and for nothing else. The count is held in the working memory of the server instance that answers, separately for each step; it is never written to a database or a log, and it is not linked to an account, an order or a license. After the minute, the entry is dropped at the latest when that server instance next counts a request for the same step, or when it shuts down. Starting Xpanion Free also keeps the request records described in section 4.2, in our database; they are a record of their own, apart from this count.

A valid download link from an earlier order email forwards your browser to the installer file in our storage at Vercel (Vercel Blob), as the download button in section 4.8 does. Vercel delivers the file as our processor and sees your IP address.

Independently of this count, Vercel records requests to these steps in its platform logs, with your IP address, and keeps those logs for one day, as section 4.8 describes.

Data: IP address.

Purpose: limiting misuse of these steps and, for a download link, delivering the installer.

Basis: Art. 6(1)(f) — our legitimate interest in keeping these steps from being misused and in delivering the software.

xpanion.com is a static marketing site.

It sets no cookies and loads nothing from a third-party domain. Typefaces are served from our own origin. This is verified against the build rather than by eye: a browser-level census of every request each route makes is recorded in the build output and reports no request leaving our origin.

Server logs. Our hosting provider automatically records standard technical request data — IP address, page requested, date and time, browser and operating system — to deliver the page and keep the service secure. These logs are not combined with other data and are not used to identify you. Our hosting provider keeps these platform logs for one day.

The address of a page can carry a short note of where a link came from — the app's upgrade links open xpanion.com/upgrade?from=project-limit, for example. It is part of the address and so is recorded with each request, as described above; the page uses it to choose a heading and for nothing else.

The download button leads to our portal at portal.xpanion.com; section 4.8 describes what happens there.

Basis: Art. 6(1)(f).

5.1 Page-view measurement, only with your consent

We count page views only if you allow it. Until you decide, nothing of the measurement loads: the banner on the page asks first, and "Reject all" stands beside "Accept all" as an equal choice. You can change or withdraw your choice at any time under "Cookie settings" in the footer of every page; after a withdrawal the page reloads without the measurement, and nothing further is sent.

Provider: Vercel Web Analytics, run by our hosting provider Vercel as our processor.

Data: once you accept, each page loads a script from our own origin. When a page is shown, the script sends the address of the page — including anything after the question mark — and the time, and, on the first page of a visit, the address of the page that linked to us. Like every request, it reaches the provider with your IP address and your browser's description of itself. According to the provider, it recognizes a visitor by a hash made from the incoming request, not by a cookie, and discards that visitor session after 24 hours. With each page view it stores the time, the address of the page, the referring page, the query string as filtered by the provider, an approximate location (country, region, city), the operating system, the browser and the type of device.

Cookies and storage on your device: the script sets no cookie and writes nothing to your browser's storage. On each page view it reads one entry of the page's local storage, which this site never sets.

Your choice: once you accept or reject, this site keeps your choice and the date you made it in one entry of your browser's local storage, named "xpanion-consent", so that the banner does not ask again on every page. It is not a cookie and holds nothing else. It is strictly necessary to respect your choice (§ 25(2) no. 2 TDDDG) and holds for 12 months; after that it no longer counts, the banner asks again, and the entry is removed the next time you open this site. You can change it at any time under "Cookie settings", or delete it with your browser's site data.

Purpose: knowing which pages are read and where visitors come from.

Basis: your consent — Art. 6(1)(a) GDPR, and for the read of your browser's storage, Art. 5(3) of the ePrivacy Directive as implemented in your country.

Retention: the visitor session is discarded after 24 hours; what Vercel keeps after that is aggregated, without reference to you. Your choice holds for 12 months, as described above.

This is the part that matters most, and the responsibility is yours, not ours.

When you record a meeting, you process the personal data of everyone in it — their voice, what they said, and often their name. Under the GDPR you are the controller of that data.

We are neither controller nor processor of it, because it never reaches us. There is no data-processing agreement to sign with us for meeting content, and we could not offer one meaningfully: we hold nothing to process.

The obligations that come with recording are therefore yours: informing participants, obtaining consent where required, honoring their requests, and keeping the recordings secure on your machine. Xpanion's consent features are record-keeping aids. They do not discharge those obligations and they do not establish that consent was validly given.

Where Xpanion is connected to your organization's own company hub (section 3), the same holds for what it shares there: that data stays with your organization, and your organization is the controller.

The current list, with roles, is at /subprocessors/.

None of them receives meeting content, because we do not have it to pass on. We do not sell personal data and we do not share it for advertising. We may disclose data where we are legally required to — and we can only produce what we hold, which does not include anything about your meetings.

Valinorsk LLCis established in the United States, and our providers process data in the United States and, in some cases, elsewhere. If you are in the EEA, the United Kingdom or Switzerland, your account, subscription and support data, what the license check, the update check, the update download and the model download send, the IP address the app download is delivered to or the portal's pages are used from, the page views of section 5.1 if you allow them, and any voicemail you leave are transferred outside your country.

Each of these providers is engaged under its own terms; if you would like the current detail for a specific provider, write to us or to our representative in section 1.

Retention is stated with each purpose in sections 4 and 5. Your meeting data has no retention period here, because we never hold it. It lives on your machine and is deleted when you delete it.

If the GDPR or a comparable law applies to you, you have the right to access your data, to rectification, to erasure, to restriction of processing, to object to processing based on our legitimate interests (Art. 21), and to data portability. Where processing rests on consent, you may withdraw it at any time with effect for the future.

Write to hello@xpanion.com, or to our EU representative in section 1. We will answer within one month.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Two things we cannot do:

• We cannot give you a copy of your meeting data, or delete it for you. We do not have it. The application's own export and delete functions are the way to reach it.
• We cannot act on a request from someone you recorded. If a meeting participant asks us for their data, we have none, and we will tell them to contact you.

If you are a California resident, you have comparable rights under the CCPA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.

Account credentials are stored hashed. Traffic between the application and our services is encrypted in transit. Access to the systems that hold account data is limited to those who need it.

The strongest security property of Xpanion is structural rather than procedural: the sensitive material never leaves your machine, so it cannot be taken from us. The corollary is that securing your own machine — disk encryption, screen lock, backups — is the part that protects your meetings, and that part is yours.

Xpanion is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children.

We may update this notice. The current version is always available at https://xpanion.com/privacy/ and inside the application. Where a change materially affects how we handle your data, we will tell you before it takes effect.

Version history:

• 1.4: the package model — plans by people and active projects, and Xpanion Free in place of the trial; the count of active projects, and the connection a new project needs; invitations to a plan for several people; the company hub under its new name; page-view measurement on this website, only with your consent
• 1.3.1: editorial — cross-references corrected
• 1.3: the portal pages you use without an account (section 4.9) and Vercel's platform logs, which are kept for one day (sections 4.8 and 5), added to the privacy policy
• 1.2: the app download through our portal added to the privacy policy (section 4.8)
• 1.1: network disclosures aligned with app 1.0.5