Privacy Policy • Expreso

Capix, Inc. ("we," "us," "our") has established this Privacy Policy to explain how we collect, use, disclose, and protect your information when you use Expreso, our software-as-a-service product, including related software, applications, and websites (collectively, the "Services"). By using our Services, you acknowledge that you have read and agree to all terms of this Privacy Policy. If you do not agree to these terms, please immediately cease using or accessing the Services. We strongly recommend that you read this policy in detail before taking any action. To optimize your user experience, we need to process your personal information. If you do not wish to have your personal information processed as described in this policy, or if you are under 16 years of age, please stop using our Services. We primarily collect and use your information to: - Provide and improve our Services and user experience - Facilitate connections between users - Ensure the security and integrity of the platform - Fulfill our legal obligations When necessary, we will share your information with trusted third parties and service providers to provide services, meet legal requirements, and achieve other purposes detailed later in this policy. 1. Information We Collect We collect personal information that you provide to us, including: - Basic Information: first name, last name, email address, and password - User Content: any personal information collected when you use our Services, including information provided in inputs, file uploads, feedback, or outputs - Email Content and Metadata: when you connect your email account to Expreso, we access and process the content, headers, metadata, attachments, and other data within your emails as necessary to provide the Service, including drafting responses, building your profile, and organizing your inbox - Profile Data: information contained in your Expreso profile, whether provided by you directly or generated by the Service based on your email and other inputs - Connection Data: information about your connections with other Expreso users, including connection status and interactions - Communication Content: any communications we exchange, including chatbot interface communications, survey responses, or feedback We also automatically collect information, including application, browser, and device information (such as device type, operating system, browser information, IP address, and other device characteristics), service usage data (including activity information, diagnostic and troubleshooting information), and information from cookies and similar technologies. We may also process limited information about third parties contained in emails you receive, as necessary to provide the Service. We do not build profiles on non-users and do not share non-user data with other Expreso users. Personal information does not include de-identified, anonymized, or aggregated information. When data is de-identified or anonymized, we maintain it in that form and do not attempt to re-identify the information. 2. How We Use Your Information We use your personal information primarily for the following purposes, while ensuring you receive a secure, smooth, efficient, and customized experience: - Account Creation and Maintenance: We use your basic information to create and maintain your account, which is necessary for fulfilling our contract with you. - Providing Services: We use your basic information, email content and metadata, communication content, application information, browser and device information, service usage data, and other information you submit to provide the Service, including reading and acting on your email, building and maintaining your profile, and drafting responses. This is necessary for fulfilling our contract with you. - Facilitating Connections: We use your profile data and connection data to facilitate professional connections between you and other Expreso users, based on mutual opt-in consent. This is necessary for fulfilling our contract with you. - Customer Support: We use your basic information, communication content, service usage data, application information, and browser and device information to provide customer support. We rely on our legitimate interest in ensuring you can optimally use the Services. - Service Communications: We use your basic information and communication content to send service-related communications. This is necessary for fulfilling the contract and based on our legitimate interest in ensuring you can optimally use the Services. - Security and Integrity: We process your information to facilitate the security, integrity, and protection of the Services, based on our legitimate interest in maintaining effective operation and delivery of the Services. - Legal Compliance: We use your information to comply with legal and regulatory obligations, based on our legitimate interest in complying with laws in the jurisdictions where we operate. - Service Improvement: We process your information to customize your experience and improve our Services, based on our legitimate interest in understanding how users interact with the Services. - Safety and Fraud Prevention: We use your information to promote the safety and integrity of the Services, network, users, employees, and the public, based on our legitimate interest in preventing fraud, unauthorized use, and harmful behavior. - Research and Innovation: We use your information to improve and iterate the Services through user feedback, based on our legitimate interest in improving the Services. In the European Economic Area and the United Kingdom, where we rely on legitimate interests, you have the right to object to and request restriction of such processing. 3. How and Why We Share Your Information We commit not to sell or share your personal information with third parties for targeted advertising purposes. Additionally, we have never sold or shared personal information of individuals under 16 years of age for targeted advertising purposes. To provide the Services, we may need to share necessary information with the following categories of third parties: 1. Service Supporters We disclose necessary personal information to third-party service providers who assist in providing the Services. Our service supporters include PostHog, a product analytics platform that helps us understand how users interact with our Services, optimize user experience, and improve our product features. PostHog does not store any chat or email data you provide; it only stores event data, such as usage patterns and feature interactions. 2. Connected Users When you opt in to a connection with another Expreso user, certain profile information will be shared with that user as necessary to facilitate the connection. You control which connections you accept, and no profile information is shared without your mutual consent. Once shared, the recipient may retain information they have viewed in accordance with their own records. 3. User-Initiated Sharing When you use active sharing features such as conversation links, the information recipients will depend on whom you choose to share with. 4. Legal Compliance Scenarios We may share information with advisors, regulatory bodies, or government agencies in the following situations: - Responding to legal and regulatory requirements, court orders, or government requests - Fulfilling statutory obligations and regulatory requirements - Investigating and preventing fraud and security issues - Protecting the rights and personal safety of all parties 5. Corporate Account Association If you register using a corporate email, we may share account existence and basic information (such as email address) with that organization to allow corporate administrators to manage account permissions. 6. Group Internal Collaboration Based on service efficiency requirements, information may be shared among affiliated companies or group members. 7. Asset Transaction Scenarios During company mergers, acquisitions, reorganizations, bankruptcy, or other changes in control, your information may be transferred as a transaction asset. 8. Disclosure at Your Request When you explicitly instruct or contractually stipulate disclosure. Please note: Our Services may include links to third-party websites, whose privacy policies are independent of ours. When you leave Expreso for other websites or use other services, we cannot and have no obligation to protect the personal information you provide on these third-party platforms. 4. Security We have implemented a series of reasonable technical, administrative, and organizational measures aimed at comprehensively protecting the security of your personal information. These protective measures cover both online and offline environments, with the purpose of preventing the loss, misuse, unauthorized access, disclosure, alteration, or destruction of your personal information. However, no security system can provide absolute protection. When using our Services, you need to understand and accept this reality: despite our best efforts to protect your information, the risks associated with using our Services ultimately must be borne by you personally. 5. Retention We retain your personal information only for as long as necessary to provide the Services, fulfill legal obligations, or protect relevant rights. We consider factors such as when the information was collected, service requirements, legal requirements, and security factors to determine retention periods. When you revoke Expreso's access to your email account or delete your account, previously processed email data will be deleted in accordance with our retention schedule and applicable law. When information is no longer needed or you request deletion, we will promptly process it. We are committed to respecting your control over your personal data while meeting our business needs. 6. Children's Personal Information Our Services are designed for users aged 16 and older and are not intended for children. We do not knowingly solicit or collect personal information from children. According to our Terms of Service, all users must be at least 16 years old to use our Services (or older if required by local law). If you discover that we have collected personal information from individuals under the minimum age without appropriate consent, please contact us immediately, and we will promptly delete the relevant data. 7. International Data Transfers To support global business operations, we and our partners may transfer, store, and process your personal information worldwide (including in the European Union, United Kingdom, and United States). For residents of the European Union, Switzerland, or the United Kingdom, we strictly adhere to lawful data transfer mechanisms, such as the European Commission's Standard Contractual Clauses and relevant local regulations (such as the UK's International Data Transfer Addendum), ensuring your personal data receives appropriate protection during cross-border transfers. 8. How You Can Exercise Your Personal Rights Depending on the laws in your region, you may have the following rights related to your personal information. Even if local laws do not explicitly provide for these rights, we may at our discretion offer you these choices. - Right to Access Information and Data Portability: You have the right to obtain a copy of your personal information that we hold, understand how we use and disclose your information, and request that we provide specific information in a standardized, commonly used machine-readable format. - Right to Deletion: You can request that we delete your personal information. After account termination, we will process or delete your related information according to our data retention policy. - Right to Correction: You can request that we update or correct personal information that you believe is incomplete or inaccurate. - Right to Restrict Processing and Object: You can limit or object to our use or transfer of your personal information based on legitimate interests, public interest, or direct marketing purposes. However, we may continue to process your information in situations permitted or required by law. - Right to Withdraw Consent: When we process information based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of our processing of your information prior to your withdrawal. - Right to Appeal: If we refuse your request, you can appeal our decision. - Right to Complain: You have the right to file a complaint with your local data protection authority. You can submit requests by sending an email to support@expreso.ai. We will not discriminate against you for exercising your legal rights. To protect your privacy and security, we may verify your identity before processing your request, including asking for additional information. If we cannot verify your identity, we may refuse your request. Under certain U.S. privacy laws, you can designate an authorized agent to make requests on your behalf. We will require the agent to provide proof of your authorization and may need you to directly confirm your identity. Please note that the above rights are not absolute and may only apply in specific situations or may be reasonably refused. 9. Contact Us If you have any questions or concerns about this Privacy Policy, or if you have a complaint, please contact us at support@expreso.ai. 10. Changes to This Privacy Policy To continuously optimize our service quality, we may periodically update this Privacy Policy. All policy changes will be posted on this page, and significant changes will be communicated to you with reasonable notice as required by law. You can always check the date at the top of the page to see when the policy was last updated. We encourage you to review this policy regularly to stay informed about how we protect your personal information.