Privacy policy
This policy explains what the Expoly app and website collect, why, where it is kept, and your choices. Expoly is run by Scramble Labs Technology Private Limited, India (“we”). We follow India's Digital Personal Data Protection Act, 2023 (DPDP).
1. Two kinds of data
Your account. When you use Expoly, we keep your name, work email, optional phone number and job title, and your company's name, logo and settings. We use it to sign you in, show your business card, and run your team.
Leads your team saves. Visitors' names, phone numbers, emails, notes and answers belong to your company. Your company decides why they are collected and how long they are kept; it is the data fiduciary. We process leads only to provide Expoly to your company and never use them for anything else. We never sell, rent or share leads for advertising.
2. What we collect and why
| Data | Why | Where |
|---|---|---|
| Account details (name, email, phone, job title) | Sign-in, team, business card | Supabase, Mumbai (India) |
| Leads, events, targets, payment-request records | The service your company uses | Encrypted on the phone; Supabase, Mumbai |
| Usage events (e.g. “lead saved”, the screen opened, phone model, app version). No lead details or contact data. People are known only by a scrambled ID. | To learn which features help and where people get stuck | PostHog, EU. You can switch this off in Settings → Share usage data. |
| Crash reports (error, phone model, app version; names, numbers and emails are removed) | To fix bugs | Sentry |
Camera and microphone, only when you tap them. The camera reads a visiting card or badge QR on your phone; the photo is deleted right after reading and never uploaded. The microphone turns a spoken note into text using your phone's own speech service (on the phone where supported, otherwise Google's speech service on your phone). Expoly never receives the audio, only the text you keep in the note.
We do not collect location, your phone's contacts, call logs or SMS, and there are no ads.
3. Services that help us run Expoly
- Supabase: database and sign-in (Mumbai region).
- Google: sign-in. If your admin connects a Google Sheet, leads are copied to a sheet in their Google Drive. Expoly can open only the sheet it created.
- WhatsApp Business messaging partner: on Pro, sends your company's WhatsApp message to leads who agreed to receive it.
- PostHog (usage analytics) and Sentry (crash reports), as described above.
4. Security
Leads on the phone are kept in an encrypted database whose key is held in Android's secure key store. All uploads use HTTPS. On our servers, every company's data is kept separate by database rules, and each person sees only what their admin allows.
5. How long we keep data
We keep data while your company's account is active, because your company decides how long to keep its leads. When an owner deletes the company account, everything is deleted after 7 days. Backups are erased within 30 days after that. When a member deletes their account, their personal details are erased at once, and the leads they saved stay with their company.
6. Your rights
You can ask to see, correct or erase your personal data, and you can withdraw consent. In the app, go to Settings → Delete my account, or see how to delete your account. If you are a visitor whose details were saved by a company using Expoly, please contact that company first. We will also help: write to us and we will pass your request on within 7 days.
7. Children
Expoly is a business tool for adults and is not meant for anyone under 18.
8. Contact and grievances
Grievance officer, Scramble Labs Technology Private Limited: privacy@expoly.tech. We reply within 7 days and resolve complaints within 30 days. You may also complain to the Data Protection Board of India.
9. Changes
If this policy changes, we will update the date above and tell admins in the app before the change takes effect.