Expand Data Privacy Policy

Effective Date: November 16, 2025
Last Updated: July 26, 2026
Version: 3.0

Overview

Expand Data Inc. is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our services: the Expand Data – Locations add-on for Google Sheets (structured location data only — no AI), and the single-address Location Report PDF (which uses generative AI for its narrative text).

It also covers our public marketing website at expanddata.com — including its neighbourhood and community report pages — which display third-party advertising and affiliate links and offer optional lead-referral forms. Because the website and the products handle data differently, this policy distinguishes between Product & Account Data (what you process through the Sheets add-on and Location Report, plus your account and billing details) and Marketing-Website Data (your activity as a visitor to expanddata.com). Our strong no-sale, no-advertising, and no-cross-site-tracking commitments below apply to your Product & Account Data; the separate Advertising, Affiliate Links & Lead Referrals section explains how the marketing website is monetized.

Company Information:

• Legal Name: EXPAND DATA INC
• Jurisdiction: British Columbia, Canada
• Contact: support@expanddata.com

What We Believe In

1. Data Minimization: We collect only what's necessary
2. Short-Lived Storage: Your job data is deleted within about 48 hours; cached results are kept at most 30 days (see Data Retention)
3. User Control: You can delete your account and data at any time
4. Transparency: We're clear about what we do with your data
5. No Sale of Product Data: We never sell the address, account, or report data you process through our products. The one exception is the optional lead-referral forms on our marketing website, where you can choose to have the contact details you enter forwarded to a provider — always with your consent, and with an opt-out (see Advertising, Affiliate Links & Lead Referrals)

Information We Collect

Account Information

• Google Sign-In: You sign in to the Sheets add-on with your Google account; we receive and store your Google account email. For Location Reports, your email is collected at Stripe checkout for delivery.
• Email Address: Stored for account identification and communication. Your email is stored both in plaintext (for operational purposes like support and notifications) and as a SHA-256 hash (for secure system identification)
• Authentication Tokens: Temporary session tokens (expire after 30 minutes)
• Account Metadata: Creation date, last login, platform preferences

Processing Data

• Job Rows: Submitted addresses and their results are stored for about 48 hours to enable delivery and recovery, then deleted
• Cached Results: Location data retrieved from Google Maps Platform may be cached for up to 30 days (and place identifiers indefinitely), as permitted by Google's caching terms, so repeat lookups are faster and cheaper
• Job Metadata: Job IDs, status, costs, and timestamps (retained for 90 days for billing reconciliation)

Billing Data

• Credit Balance: Current credit balance and usage history
• Transaction Records: Purchase history, amounts, dates (retained for 7 years for tax compliance)
• Payment Methods: Only last 4 card digits, brand (Visa/Mastercard), and billing country (full card data handled exclusively by Stripe)

How We Use Your Information

1. Service Delivery: Process your address enrichment requests
2. Authentication: Verify your identity and maintain secure sessions
3. Billing: Calculate costs, process payments, issue refunds
4. Customer Support: Respond to your questions and technical issues
5. System Monitoring: Track performance and reliability — logs carry technical diagnostics and pseudonymous identifiers, never your addresses, results, or email contents

Third-Party Services

Google Cloud Platform

We use Google services to process your addresses:

• Google Maps Platform APIs: Geocoding, Address Validation (with USPS data), Places, Places Aggregate, Air Quality, Pollen, Solar, Weather, Routes, Elevation, Time Zone, and Street View metadata — used to retrieve the location data we deliver to you
• Google Vertex AI (Gemini): Used only for the Location Report PDF, to generate its narrative analysis. Never used for the Sheets add-on, and never trained on your data

Important: We use paid-tier Google services where your data is NOT used for model training or advertising, and we never use your data to train AI models ourselves. Address data is sent to Google APIs for processing and results are returned to you; Google's retention is governed by their privacy policies.

Google Maps Platform: Location data in our services is provided via Google Maps Platform. By using our services you also agree to be bound by the Google Terms of Service, and the Google Privacy Policy applies to Google's handling of that data.

Stripe

Payment Processing: All credit card processing handled by Stripe (PCI-DSS Level 1 compliant)

• We never see or store full credit card numbers, CVV codes, or expiry dates
• Only last 4 digits, card brand, and billing country stored for user convenience

SendGrid

Transactional Email: SendGrid sends our service emails (receipts, job notifications, report delivery) on our behalf and processes your email address for that purpose only.

What We DON'T Do With Your Product & Account Data

These commitments apply to the data you process through our products (the Sheets add-on and the Location Report) and to your account and billing data:

• We do NOT sell your product, address, or account data to anyone
• We do NOT use your product or account data for advertising
• We do NOT share your product or account data with marketing companies
• We do NOT track your product usage across other websites
• We do NOT use your data to train AI models

Separately, our public marketing website carries third-party advertising and optional lead-referral forms. That is explained — with your opt-out choices — in Advertising, Affiliate Links & Lead Referrals below.

Advertising, Affiliate Links & Lead Referrals

Our public marketing website (expanddata.com), including its neighbourhood and community report pages, is supported in part by advertising. This section applies to visitors of that website and is separate from the Product & Account Data commitments above.

Affiliate Links & Click-to-Call Advertising

• Some pages contain affiliate links and click-to-call advertising for third-party products and services (for example, solar, moving, home warranty, mortgage, insurance, and real-estate offers).
• If you click an affiliate link or a tracked phone number and then take an action (such as placing a call, submitting a form, or making a purchase), we may earn a commission or a per-call/per-lead fee from that partner or advertising network, at no additional cost to you.
• Those partners and their advertising networks may use cookies, tracking links, or similar technologies to attribute the referral to us. That activity is governed by those partners' own privacy policies, not this one, and we do not control their data practices.
• When you click through, you leave our website and deal directly with the third party, who collects whatever information you choose to give them.

Optional Lead-Referral Forms

• Some pages may offer an optional form (for example, "connect with a local expert") that you can choose to complete.
• If you submit such a form, we share the contact information you provide (such as your name, email, phone number, and the details of your request) with one or more relevant third-party partners — for example, licensed real-estate professionals, service providers, or lead-referral networks — so they can contact you about your inquiry.
• We do this only when you voluntarily submit the form. The form will tell you that you may be contacted by phone, text, or email, identify who may contact you, and ask for your consent.
• Under certain privacy laws (including the California Consumer Privacy Act, as amended by the CPRA), this forwarding may be considered a "sale" or "sharing" of personal information. You can opt out at any time — see Your Privacy Choices below.
• We act as a marketing and advertising publisher, not as a real-estate, mortgage, or insurance provider, and we are never paid based on whether any transaction closes. The third parties you connect with are responsible for their own services and for their own handling of your information.

Your Privacy Choices: Do Not Sell or Share

• You can tell us not to sell or share your personal information by emailing support@expanddata.com with the subject line "Do Not Sell or Share."
• We honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where technically feasible.
• Browsing our website or clicking an affiliate link does not by itself submit your personal information to a lead partner — only completing and submitting an optional lead-referral form does.

Data Security

Protection Measures

• Encryption in Transit: TLS 1.2+ for all data transmission
• Encryption at Rest: AES-256 for database storage
• Hashed Identifiers: User IDs hashed with SHA-256
• Secure Sessions: 30-minute token expiration, cryptographically signed (JWT)
• Access Controls: Role-based access with principle of least privilege
• Secret Management: All API keys stored in Google Cloud Secret Manager

Data Breach Response

If a security incident occurs:

• Initial assessment within 24 hours
• User notification within 72 hours
• Regulatory reporting within 72 hours (GDPR, CCPA)
• Immediate remediation and system hardening

Data Retention

Your Rights

What You Can Do

• Access Your Data: View all account and billing information
• Export Your Data: Download transaction history and usage data
• Delete Your Account: Permanently remove your account (except transaction records required for tax compliance)
• Correct Information: Update your account details and preferences
• Opt-Out: Stop using the service at any time

How to Exercise Your Rights

Contact support@expanddata.com to:

• Request a copy of your data
• Delete your account
• Correct account information
• Ask questions about privacy

We respond to requests within 30 days.

Compliance

We comply with major privacy regulations:

• GDPR (European Union): Full compliance with data protection principles
• CCPA/CPRA (California): Consumer privacy rights implemented, including the right to opt out of the "sale" or "sharing" of personal information (see Advertising, Affiliate Links & Lead Referrals); we also recognize Global Privacy Control (GPC) signals
• PIPEDA (Canada): Personal information protection compliance
• PCI-DSS (Payment Cards): Via Stripe - we handle no card data directly

Data Location

• Primary Processing: Google Cloud us-central1 (United States)
• Database: Cloud SQL PostgreSQL in us-central1
• Backups: Encrypted backups in multiple geographic regions
• International Transfers: Standard Contractual Clauses for EU-US transfers

Children's Privacy

Expand Data is not intended for children under 13. We do not knowingly collect information from children. If we discover a child under 13 has provided information, we delete it immediately.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or regulations. When we do:

• Material changes: 30-day advance notice via email
• Version history maintained for reference
• Clear summary of what changed

Contact Information

Email: support@expanddata.com

EU Data Protection Authority: EU residents may contact their local Data Protection Authority with privacy concerns.

By using Expand Data, you acknowledge that you have read and understood this Privacy Policy.