Expeal Application — Privacy Policy

1. What this policy covers

This Privacy Policy describes how Expeal handles information when you use the Expeal application at app.expeal.com (the "Application"). It applies to the Application only. Our informational website at expeal.com has its own privacy policy.

In this policy, "Expeal," "we," "us," and "our" refer to Expeal, Inc.

Expeal is a legal technology service provider, not a law firm. Information you share with us is not protected by the attorney-client privilege. See the Application Terms of Service for the full scope of what Expeal is and is not.

2. What we collect

The Application exists to prepare your expungement or sealing case, so — unlike our informational website — it necessarily collects sensitive information you choose to provide:

Account information. The email address you register. Sign-in passcodes are never stored in readable form (we store only a cryptographic digest, which expires after use).
Your case answers. The answers you give in the guided workflow. These include criminal-history information (charges, dispositions, dates, counties) and the personal identifiers Florida courts and agencies require on filing documents — which may include your full name, date of birth, address, and government identifiers such as your Social Security number or driver's license number. If you choose to bring your answers from the eligibility check on expeal.com, the Application keeps them in your browser tab, not on our servers, until you sign in and choose to use them. They are cleared when you close the tab, when you sign out, or after 30 minutes. Once you use them, they are case answers like any others.
Generated documents. Documents are generated on demand when you or our staff request them and are delivered as files; the Application does not keep a stored copy of the generated document itself (the underlying answers above are what we retain).
Payment information (only where payments are offered). Payments are processed by Stripe. We receive and keep transaction records (what was purchased, when, and payment status); we do not store your full card number.
Messages you send us. Emails to any Expeal address, kept as long as needed to respond and for reasonable record-keeping.
Server and application logs. Our hosting platform (Heroku) keeps routine logs (IP address, time, request path, browser reported) for operating, securing, and troubleshooting the Application. Logs are retained for approximately one week and are not sent to any third-party analytics or logging service.

3. What we do not do

We do not use tracking or analytics tools. No Google Analytics, no advertising pixels, no session-recording tools of any kind.
We do not use advertising cookies. The Application sets only the essential cookies required to keep you signed in and secure. It does not use browser storage to track you.
We do not sell your information, and we do not share it for advertising.
We do not build advertising or marketing profiles about you. The only analysis we perform on your answers is the eligibility assessment and document preparation you asked for.

These are commitments. If we ever change any of them, we will update this policy and notify you before the change takes effect.

4. How we use what we collect

To assess your eligibility for expungement or sealing under Florida law, based on your answers.
To prepare your legal documents from those answers.
To process your case. Our staff review submitted applications, manage case status, and may contact you about your case.
To sign you in and communicate with you. We email one-time passcodes and case-related notices to your account address.
To operate and secure the Application, using the logs described above.
To comply with law, when a lawful process requires us to retain or disclose information.

We do not use your information for advertising, and we do not make automated decisions about you other than the eligibility assessment you explicitly request.

5. Who sees your information

Our staff, to review and process your case.
Service providers that host and deliver the Application: Heroku (application hosting and database), Amazon SES (email delivery), and — where payments are offered — Stripe (payment processing). These providers process information only to deliver their service to us.
No one else for commercial purposes. We do not sell, rent, trade, or transfer your information to advertising networks, data brokers, or any third party for their own use.
When legally compelled (subpoena, court order, or similar process), when needed to protect a person's safety, or to investigate activity we reasonably believe to be illegal.

Documents you generate are yours; you decide what to file and with whom to share them. We do not submit your documents to courts or agencies on your behalf through the Application.

6. Security

We treat the security of criminal-record information as a first-order obligation. Measures include: HTTPS encryption of all traffic; a strictly enforced Content Security Policy; passcodes stored only as cryptographic digests; encryption of data at rest on our database platform; a second layer of encryption that the Application itself applies to your case answers before they are stored; access controls limiting case data to authorized staff; and security review of changes before release.

No system is perfectly secure. If a security incident affects your information, we will notify you and any applicable authorities as required by law. Security researchers can report vulnerabilities under our Vulnerability Disclosure Policy.

7. How long we keep your information

We keep each kind of information below for the period shown, then delete it. These periods take effect on December 15, 2026. Until then, we do not delete information on a schedule, and you can still ask us to delete it at any time (Section 8).

A submitted case. Your case answers are kept for 2 years after the last change to the case.
A case that is not submitted. Its answers are kept for 180 days after the last change to it.
A paid case (only where payments are offered). Kept for 2 years after the last change to it, like any submitted case. The transaction record of the payment is kept after the case is deleted, anonymized.
Your account. Your email address is kept as long as your most recent case. An account with no case is deleted 30 days after the later of two dates: the last sign-in passcode we sent to it, and its last sign-in.
Records of activity on your case. The record of each change to your case is deleted with the case. When a case is deleted, we keep a record of the deletion for 3 years: when it was deleted, by whom or by this schedule, the case's last status, and which questions had been answered, never the answers themselves. We also keep a record of each time our staff opened or downloaded your case for 3 years from that time, even after the case is deleted: who, when, and what they opened, never your answers.

Information we already hold on December 15, 2026 counts its period from that date, never from an earlier one.

You may request deletion at any time (Section 8). Where law or legitimate record-keeping requires it — for example, records of completed transactions — we may retain or anonymize specific records rather than erase them.

When we delete information, copies of it can remain in the backups our hosting provider (Heroku) keeps of our database until those backups are themselves deleted.

8. Your rights

You have the right to know what we hold about you, to access a copy, to correct inaccuracies, to request deletion, to receive your information in a usable format, and to non-discrimination for exercising these rights. We do not sell or share your information for advertising, so there is nothing to opt out of on that front.

Send requests to privacy@expeal.com from your account email address (or include enough information for us to verify you). We will respond within 45 days; if we need more time, we will tell you why and how long (up to an additional 45 days where permitted). If we deny a request, we will explain why, and you may appeal by replying with "Appeal" in the subject line.

9. Children

The Application is for adults. You must be at least 18 years old to use it. We do not knowingly collect information from anyone under 18 through the Application; if you believe we have, contact privacy@expeal.com and we will delete it.

10. Users outside the United States

The Application is operated from the United States, is intended for matters arising under Florida law, and processes information in the United States.

11. Changes to this policy

If we change this policy, we will update the "Last updated" date and, for substantive changes, notify you in the Application or by email at least 30 days before the change takes effect. If a change would materially reduce your privacy rights, we will seek your affirmative consent before applying it to information we already hold. A change to any Section 3 commitment is, by definition, a substantive change.

12. Governing law

This policy is governed by the laws of the State of Florida. Any dispute concerning it will be resolved in accordance with the Application Terms of Service.

13. How to contact us

For privacy matters: privacy@expeal.com. For general inquiries: contact@expeal.com. For security reports: security@expeal.com. Mailing address: Expeal, Inc., 6050 Collier Boulevard, Suite 132, Naples, FL 34114.