Expeal Application — Privacy Policy

Effective date: 2026-07-31 · Version: 1.0 · Last reviewed: 2026-07-31

1. What this policy covers

This Privacy Policy describes how Expeal handles information when you use the Expeal application at app.expeal.com (the "Application"). It applies to the Application only. Our informational website at expeal.com has its own privacy policy.

In this policy, "Expeal," "we," "us," and "our" refer to Expeal, Inc.

Expeal is a legal technology service provider, not a law firm. Information you share with us is not protected by the attorney-client privilege. See the Application Terms of Service for the full scope of what Expeal is and is not.

2. What we collect

The Application exists to prepare your expungement or sealing case, so — unlike our informational website — it necessarily collects sensitive information you choose to provide:

• Account information. The email address you register. Sign-in passcodes are never stored in readable form (we store only a cryptographic digest, which expires after use).
• Your case answers. The answers you give in the guided workflow. These include criminal-history information (charges, dispositions, dates, counties) and the personal identifiers Florida courts and agencies require on filing documents — which may include your full name, date of birth, address, and government identifiers such as your Social Security number or driver's license number.
• Generated documents. Documents are generated on demand when you or our staff request them and are delivered as files; the Application does not keep a stored copy of the generated document itself (the underlying answers above are what we retain).
• Payment information (only where payments are offered). Payments are processed by Stripe. We receive and keep transaction records (what was purchased, when, and payment status); we do not store your full card number.
• Messages you send us. Emails to any Expeal address, kept as long as needed to respond and for reasonable record-keeping.
• Server and application logs. Our hosting platform (Heroku) keeps routine logs (IP address, time, request path, browser reported) for operating, securing, and troubleshooting the Application. Logs are retained for approximately one week and are not sent to any third-party analytics or logging service.

3. What we do not do

• We do not use tracking or analytics tools. No Google Analytics, no advertising pixels, no session-recording tools of any kind.
• We do not use advertising cookies. The Application sets only the essential cookies required to keep you signed in and secure. It does not use browser storage to track you.
• We do not sell your information, and we do not share it for advertising.
• We do not build advertising or marketing profiles about you. The only analysis we perform on your answers is the eligibility assessment and document preparation you asked for.

These are commitments. If we ever change any of them, we will update this policy and notify you before the change takes effect.

4. How we use what we collect

• To assess your eligibility for expungement or sealing under Florida law, based on your answers.
• To prepare your legal documents from those answers.
• To process your case. Our staff review submitted applications, manage case status, and may contact you about your case.
• To sign you in and communicate with you. We email one-time passcodes and case-related notices to your account address.
• To operate and secure the Application, using the logs described above.
• To comply with law, when a lawful process requires us to retain or disclose information.

We do not use your information for advertising, and we do not make automated decisions about you other than the eligibility assessment you explicitly request.

5. Who sees your information

• Our staff, to review and process your case.
• Service providers that host and deliver the Application: Heroku (application hosting and database), Amazon SES (email delivery), and — where payments are offered — Stripe (payment processing). These providers process information only to deliver their service to us.
• No one else for commercial purposes. We do not sell, rent, trade, or transfer your information to advertising networks, data brokers, or any third party for their own use.
• When legally compelled (subpoena, court order, or similar process), when needed to protect a person's safety, or to investigate activity we reasonably believe to be illegal.

Documents you generate are yours; you decide what to file and with whom to share them. We do not submit your documents to courts or agencies on your behalf through the Application.

6. Security

We treat the security of criminal-record information as a first-order obligation. Measures include: HTTPS encryption of all traffic; a strictly enforced Content Security Policy; passcodes stored only as cryptographic digests; encryption of data at rest on our database platform; access controls limiting case data to authorized staff; and security review of changes before release.

No system is perfectly secure. If a security incident affects your information, we will notify you and any applicable authorities as required by law. Security researchers can report vulnerabilities under our Vulnerability Disclosure Policy.

7. How long we keep your information

During this early period of the service, we retain your account and case answers for as long as your account exists, so your case can be processed and resumed. We are finalizing published retention durations and will update this policy when we set them; that update will follow the notice process in Section 11.

You may request deletion at any time (Section 8). Where law or legitimate record-keeping requires it — for example, records of completed transactions — we may retain or anonymize specific records rather than erase them.

8. Your rights

You have the right to know what we hold about you, to access a copy, to correct inaccuracies, to request deletion, to receive your information in a usable format, and to non-discrimination for exercising these rights. We do not sell or share your information for advertising, so there is nothing to opt out of on that front.

Send requests to privacy@expeal.com from your account email address (or include enough information for us to verify you). We will respond within 45 days; if we need more time, we will tell you why and how long (up to an additional 45 days where permitted). If we deny a request, we will explain why, and you may appeal by replying with "Appeal" in the subject line.

9. Children

The Application is for adults. You must be at least 18 years old to use it. We do not knowingly collect information from anyone under 18 through the Application; if you believe we have, contact privacy@expeal.com and we will delete it.

10. Users outside the United States

The Application is operated from the United States, is intended for matters arising under Florida law, and processes information in the United States.

11. Changes to this policy

If we change this policy, we will update the "Last updated" date and, for substantive changes, notify you in the Application or by email at least 30 days before the change takes effect. If a change would materially reduce your privacy rights, we will seek your affirmative consent before applying it to information we already hold. A change to any Section 3 commitment is, by definition, a substantive change.

12. Governing law

This policy is governed by the laws of the State of Florida. Any dispute concerning it will be resolved in accordance with the Application Terms of Service.

13. How to contact us

For privacy matters: privacy@expeal.com. For general inquiries: contact@expeal.com. For security reports: security@expeal.com. Mailing address: Expeal, Inc., 6050 Collier Boulevard, Suite 132, Naples, FL 34114.