Privacy Policy

• Account information: your name, work email address, job title, company and role in your organization. Your password is stored only as a salted scrypt hash.
• Content you add: decision cases, framings, interview answers, evidence, options, risks, notes, comments, agenda items, documents you upload, and your conversations with Ask EXPAR.
• Voice answers: if you choose to answer by voice, your microphone audio streams directly from your browser to our speech-to-text provider for transcription. EXPAR does not receive or store the audio; only the text you keep becomes part of your answer.
• Google data you choose to connect: described in detail in section 3.
• Technical and security records: a sign-in session cookie, and an audit log of significant actions (for example sign-ins and changes to a decision) with the time and the account that made them.

We do not use advertising or third-party analytics cookies. The only cookie EXPAR sets is the one that keeps you signed in.

• To provide the service: run your decision workflows, agenda, reminders, Brief and Ask EXPAR.
• To send the notifications and emails you have switched on, such as reminders and a daily digest.
• To secure the service, prevent abuse, and keep the audit trail your organization relies on.
• To answer your support requests and to meet legal obligations.

We do not sell personal information, and we do not use it for advertising. Within your organization, what others can see follows EXPAR’s access rules: personal decisions, your agenda, your Ask EXPAR conversations and your connected Google data are visible to you alone, including to your CEO and administrators.

You can connect your own Google account from the Integrations screen in EXPAR. Connecting is optional, and Google’s consent screen lets you grant Calendar, Gmail or both. EXPAR requests read-only access only and never creates, changes, sends or deletes anything in your Google account.

What we access

• Basic profile (openid, email): the email address of the Google account you connected, so we can show which account is linked.
• Google Calendar (calendar.readonly): events on your primary calendar from the start of yesterday to 30 days ahead: each event’s title, start and end time, whether it is all-day, and its link back to Google Calendar. Cancelled and declined events, working-location and out-of-office entries are skipped.
• Gmail (gmail.readonly): for messages in your inbox from the last 7 days (up to 100): the sender’s name and address, the subject, the short preview text Gmail provides (the snippet), the time received, and whether the message is unread or marked important. EXPAR never reads or stores the full body of an email or any attachment.
• Mail history (gmail.readonly, only if you turn on “Learn from my mail history”; off by default): for the last 90 days of the email threads you wrote in, and threads in your primary inbox written to you (up to 800 of your threads and 400 others): who each message was from and to, how many people were in To and Cc, when it was sent, Gmail’s labels, and whether it looks automated (a mailing list or notification). For emails you sent, also the opening line Gmail provides as a preview, with any quoted earlier message cut off. EXPAR never stores what someone else wrote to you here, nor any full email or attachment.

How we use it

• Your calendar events appear on your EXPAR agenda, with reminders before meetings.
• Your recent inbox appears on your Brief, is summarized in your own daily digest email (a count of unread mail and up to three important senders and subjects), and can be used by Ask EXPAR to answer questions you ask it.
• When you ask Ask EXPAR a question, up to 12 recent email headers and snippets and your upcoming meetings may be sent to our AI model provider to generate the answer for you. This happens only in response to your request, and the answer is shown only to you.
• If you turn on learning from your mail history, EXPAR computes numbers about how you communicate (how quickly and how often you reply, when you write, how many people you write to) and shows them only to you on “How you communicate”. When you ask it to, EXPAR sends those numbers and up to 40 opening lines of your own sent emails to our AI model provider to write a short reading of your communication style, which is stored for you. While the switch is on, the numbers and that reading accompany each question you ask Ask EXPAR (the opening lines of your emails do not). None of it is ever added to the Executive Profile that others in your organization can read.

Who can see it. Google data is visible only to the person who connected it. Other members of your organization, including the CEO and administrators, cannot see your calendar copy or your inbox. Audit records about your Google connection contain no email or event content. EXPAR personnel do not read your Google data unless you ask us to for support, it is needed for security purposes such as investigating abuse, or the law requires it.

Storage and security. Google’s access token stays in server memory only until it expires. The refresh token is stored encrypted with AES-256-GCM and never reaches your browser. Our copy of your inbox covers only the last 7 days: messages older than that, or archived or deleted in Gmail, are deleted from EXPAR on the next sync (about every 10 minutes). The mail history, if you turned it on, covers only the last 90 days and is deleted, together with EXPAR’s reading, when you turn it off, turn Gmail off or disconnect. Calendar events removed from Google are removed from your agenda.

Disconnecting. You can disconnect at any time from the Integrations screen in EXPAR. We then revoke EXPAR’s access at Google, delete the stored token, delete our copy of your inbox and your mail history with its reading, and delete synced upcoming meetings. Past meetings you marked done, linked to a decision or added notes to stay on your agenda as part of your own record until you delete them or your account. Turning Calendar or Gmail off separately deletes that part’s copy in the same way. You can also remove EXPAR’s access from your Google Account permissions page.

Limited Use. EXPAR’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features described above; we do not sell it; we do not use or transfer it for advertising, including personalized or retargeted ads; we do not use it to determine credit-worthiness or for lending; and we do not use it to develop, improve or train generalized AI or machine learning models.

We share information only with providers that help us run EXPAR, under agreements that limit their use of it to providing their service to us:

• Hosting and database: the cloud infrastructure that runs the EXPAR app and its database.
• AI model providers: our AI gateway and the language model behind it, which process the content needed to answer a request (for example drafting a framing, an interview question or an Ask EXPAR reply) and the documents you choose to have EXPAR read. Speech-to-text for voice answers is provided by OpenAI.
• Email delivery: Resend, which sends the notifications and digests you have switched on.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to apply to the information transferred.

We keep your account and content for as long as your organization uses EXPAR. Connected Google data is kept only as described in section 3. When an account or organization is deleted, its data is removed from the live database, and from our backups as they expire within 14 days. Audit records may be kept longer where your organization or the law requires an unaltered history.

EXPAR is built with privacy boundaries first: access is checked on every request, each organization’s data is separated at the database level, traffic is encrypted in transit, sensitive tokens are encrypted at rest, and significant actions are written to a tamper-evident audit log. No system is perfectly secure, and we will notify affected users of a breach as the law requires.

You can view and correct your information in the app, disconnect Google at any time, and switch email notifications and the daily digest off on your account page. Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to or restrict how we process it. To make a request, write to demo@expar.ai. If EXPAR was provided to you by your employer, we may refer your request to your organization, which controls its workspace.

EXPAR is a business service and is not intended for anyone under 18.

We will post any change to this policy on this page and update the date above; if a change is significant, we will also tell you in the app or by email. Questions about this policy or about your data can be sent to demo@expar.ai. See also our Terms of Service.