Privacy Policy

This Privacy Policy explains how Newempo LLC, 30 N Gould St #40045, Sheridan, WY 82801, USA ("ExpirySuite", "we", "us") collects, uses, and protects personal data when you visit expirysuite.com and use the ExpirySuite application (the "Service"). It applies to visitors, account holders, the people whose documents are tracked in the Service, and people who receive a document request or upload a document through a request link without having an account.

1. Controller and roles

For personal data about your own account (your email, name, preferences), ExpirySuite is the data controller. For the records you enter about your organization's people and assets (subjects, documents, uploaded files), your organization is the controller and ExpirySuite acts as a data processor on its behalf under our Data Processing Agreement. The same applies to document requests: when an organization requests a document from someone, the recipient's email address, the request details and anything the recipient uploads are processed on that organization's behalf. If you believe your personal data is held in ExpirySuite by an organization, contact that organization first; we will assist them as processor.

2. Personal data we collect

• Voice input (optional): if you use the "fill by speaking" button, your browser's own speech recognition converts your speech to text on your device or through your browser vendor's service, under that vendor's terms. We never receive or store the audio. Only the resulting text is sent to us, and only to fill in the form fields you see; it is not retained after the form is filled. • Account data: email address, name, chosen language and time zone, and — only if you turn on SMS or WhatsApp reminders — your mobile number and, for each channel, the date and time you gave consent. • Authentication data: sign-in links and session tokens (we do not store passwords). If you choose to sign in with Google or Microsoft, we receive from that provider your name, email address, a stable account identifier and whether the provider has verified your email; we do not receive your password and we do not request access to your mailbox, files, contacts or calendar. • Content you provide: names of people or assets, document types, issue and expiry dates, notes, assignments, and files you upload — which may include identity, immigration, licensing, or health-related documents. • Document requests: when an organization requests a document through the Service, we process the recipient's email address if the organization enters one (used only to send the request email, which contains the organization's name, the record and document names, the upload link and its expiry date), and the request's status and dates (created, opened, uploaded, reviewed, revoked or expired), including any reason given for rejecting a submission. Recipients do not need an account. If a recipient uploads a document, we receive the file and the dates they enter, which the organization then reviews. Upload links are stored only as a one-way hash. • Automated document reading: when a file is selected in an upload form of the Service or on a document request page, and this feature is available, the file is sent to our AI provider to suggest a document type, issue date and expiry date. The suggestions are only pre-filled into the form; they are saved only if the person submitting the form keeps or edits them. We do not store the AI provider's response separately, and our logs record only technical information (such as file type, size and which fields were found), not the document's content or dates. • Billing data: plan and subscription identifiers. Card details are handled by our payment provider (Stripe) and are never received or stored by us. • Technical data: IP address and basic request metadata processed transiently to operate and secure the Service, and privacy-friendly, cookieless usage analytics that do not track you across other sites.

3. Legal bases (GDPR Article 6)

Where the GDPR applies, we rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure, maintain, and improve the Service, and to send service-related reminders); legal obligation (to comply with law and tax requirements); and consent where specifically requested (for example, SMS and WhatsApp reminders, which are sent only after you opt in and stop as soon as you withdraw consent in Settings or, for SMS, reply STOP). For content uploaded about third parties, including documents collected through document requests, the organization is responsible for having a valid legal basis.

4. How we use personal data

To create and administer accounts; to store the records you enter and send the expiry reminders and digests you configure; to send document request emails and receive uploads on your organization's behalf; to suggest document types and dates from uploaded files; to calculate the requirement statuses, compliance statuses and reports shown in the Service; to process payments through our provider; to secure the Service and prevent abuse; to provide support; and to comply with legal obligations. We do not sell personal data, do not use it for advertising, and do not use your content to train machine-learning models.

5. Sharing and sub-processors

We share personal data only with vetted service providers acting on our instructions ("sub-processors"), including: our EU cloud hosting and database provider, object storage for uploaded files (Cloudflare R2), transactional email delivery (Resend), SMS and WhatsApp messaging (Twilio, and the WhatsApp Business Platform operated by Meta Platforms) for users who opt in to SMS or WhatsApp reminders, web push notifications delivered through the push service of your browser (for example Google, Apple or Mozilla) if you turn them on for a device — the notification content is encrypted so the push service cannot read it, payment processing (Stripe, as Merchant of Record), cookieless website analytics on our public pages (Cloudflare Web Analytics), and an AI provider used solely to suggest document types and dates from files selected for upload (including on document request pages) and to turn a dictated sentence into form fields. A current list is available on request. If you sign in with Google or Microsoft, that provider authenticates you under its own privacy policy; it is not our sub-processor and receives no content from the Service. We may also disclose data where required by law or to protect our rights. Mobile numbers and SMS consent are not shared with third parties or affiliates for marketing or promotional purposes; they are used only to send the reminders you opted in to.

6. International transfers

ExpirySuite is operated from the United States while application data is hosted in the European Union. Where personal data is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) together with appropriate supplementary measures. A copy of the relevant transfer mechanism is available on request.

7. Data retention and deletion

We keep personal data for as long as your account is active. You may delete records at any time. When a record with an attached file is deleted, the file is removed. When an account or organization is deleted, associated documents and files are permanently removed within 30 days, except where a longer period is required by law (for example, billing records for tax purposes).

8. Security

We apply appropriate technical and organizational measures, including encryption of uploaded files at rest, access to files only through short-lived signed links, isolation of each organization's data, least-privilege access controls, and audit logging of document changes and reminders. No method of transmission or storage is completely secure; we work to protect your data but cannot guarantee absolute security. If a security breach affects personal data we hold as controller, we will notify affected individuals and the relevant authorities as required by applicable law, including the breach notification statutes of the US states where affected individuals live (in Wyoming, W.S. § 40-12-501 and following) and, where the GDPR applies, Articles 33 and 34. Where we process data on an organization's behalf, we notify that organization so it can meet its own obligations, as set out in our Data Processing Agreement.

9. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, restriction of, or portability of your personal data, and you may object to certain processing. Where we rely on consent, you may withdraw it at any time. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

10. United States state privacy rights

If you live in a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect — you have rights to confirm whether we process your personal information and access it, to correct inaccuracies, to delete it, and to obtain a portable copy. Section 2 of this Policy lists the categories of personal information we collect, Section 4 the purposes, Section 5 the categories of recipients, and Section 7 our retention practice. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of, and we honor opt-out preference signals such as Global Privacy Control by default. We do not use or disclose sensitive personal information for purposes that require a right to limit. Exercising any of these rights will not cause us to deny you service, charge a different price, or give you a lower quality of service. To make a request, email [email protected] from the address on your account. We verify requests by confirming control of that address, and we respond within the period the applicable law requires (45 days in most states, extendable once where permitted). An authorized agent may act for you with written permission that we can verify. If we decline your request, you may appeal by replying to our decision or writing to [email protected] with "Appeal" in the subject line; we will respond to the appeal within 45 days with our reasons, and will tell you how to contact your state attorney general if you disagree. Where your employer or another organization entered your details into the Service, that organization decides how the data is used and we act on its instructions; we will refer your request to it and assist it in responding.

11. Cookies and analytics

We use only strictly necessary cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies. Usage statistics on our public pages are collected with Cloudflare Web Analytics, which sets no cookies, does not fingerprint your device, and does not track you across other sites, so no consent banner is required for non-essential cookies. Analytics does not run inside the signed-in application or on document upload and document request links. Pages there can contain record identifiers and access tokens, and we do not send those to any analytics provider.

12. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal data from anyone under 16, and we do not knowingly collect personal information from children under 13 as defined by the US Children's Online Privacy Protection Act. If you believe a child has provided us personal data, contact [email protected] and we will delete it. Note that an organization using the Service may enter documents belonging to a minor (for example, a young employee); that organization is the controller for those records and is responsible for the legal basis and consents required.

13. Changes and contact

We may update this Policy from time to time; material changes will be indicated by the "last updated" date and, where appropriate, by notice in the Service. Questions or requests: [email protected]. Postal address: Newempo LLC, 30 N Gould St #40045, Sheridan, WY 82801, USA.