Logo
Features Pricing About Help & FAQ Contact
Log in Register

Privacy Policy

Last Updated: October 3, 2026
Effective Date: October 3, 2026

1. Introduction

Xpendee ("we", "our", or "us") is a product of Finity Sync, a remote-first company operating from Gujranwala, Pakistan. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at https://xpendee.com. Please also review our Terms of Service.

By using Xpendee, you agree to the collection and use of information as described in this policy.

2. Who We Are

3. Who This Policy Applies To

This policy applies to all users of Xpendee, including:

  • Tenants (Agencies and Businesses who register and use the platform)
  • Clients (individuals or businesses who receive invoices, proposals, or contracts through Xpendee)
  • Freelancers (individuals whose work records are managed within the platform by a Tenant)

4. Information We Collect

4.1 Account Registration (Tenants)

When you create an account, we collect:

  • Full name and email address
  • Password (stored in encrypted form)
  • Company name, phone number, address, and website
  • Tax number (if provided)
  • Google Account ID (if you sign in via Google)
  • IP address at the time of registration

4.2 Client Information

When Tenants create invoices, contracts, or proposals for their clients, the following client data is stored on our platform:

  • Full name, email address, phone number
  • Company name and address
  • E-signature data (name, email, signature image, and timestamp) when a contract is signed

4.3 OTP and Authentication Data

  • One-time passwords (OTPs) and their expiry times for email-based verification
  • Two-factor authentication (2FA) setup data via Google Authenticator

4.4 Expense and Financial Data

  • Expense categories, amounts, currencies (USD/PKR and others)
  • Expense descriptions
  • Uploaded receipts (images or PDF files)

4.5 Technical Data

  • IP address
  • Browser and device information (collected passively via server logs)

5. How We Use Your Information

We use the collected information to:

  • Create, authenticate, and manage your Xpendee account
  • Generate and deliver invoices, contracts, and proposals
  • Process and verify electronic signatures
  • Send essential transactional emails (OTPs, password resets, billing receipts, and security alerts)
  • Dispatch platform release updates and product improvements strictly to verified, active subscribers (with preference controls provided)
  • Maintain expense records and financial reports for your business
  • Provide white-label client portal access to your clients
  • Ensure email delivery hygiene and prevent unsolicited dispatches by suppressing invalid or bouncing email recipients
  • Allow Super Admins (Finity Sync team) to maintain system reliability, troubleshoot issues, and provide technical support
  • Protect platform infrastructure against abuse, automated bots, and security vulnerabilities

6. Third-Party Services

We use selected third-party service providers who assist in operating our platform:

  • Google OAuth (via Laravel Socialite): For authentication via Google accounts. Google's Privacy Policy applies: https://policies.google.com/privacy
  • Google Authenticator: For two-factor authentication setup. Data is processed locally on your device.
  • Billing & Payment Processors: We partner with Merchant of Record solutions (such as Paddle) to securely handle online transactions, VAT/sales tax compliance, and automated billing. Payment details are handled directly by the processor and are never stored on our servers.
  • SMTP Email Delivery: For transactional and operational email transmissions. Recipient email addresses are routed securely via our delivery partners.

7. Data Storage, Retention, and Lifecycle Policies

  • Hosting & Encryption: All data is stored on secure servers located in Pakistan, provided by our local infrastructure partners. We enforce strict enterprise-grade controls, including hashed authentication credentials, time-sensitive OTP verification, and hardened multi-tenant isolation.
  • Active Subscriptions: Tenant business data, client profiles, invoices, expense records, and uploaded receipts are retained securely for the full duration of your active paid subscription.
  • Unverified & Abandoned Accounts: Registrations where the email address remains unverified and no business activity (such as invoice generation or client creation) is detected are automatically and permanently purged after 14 days to mitigate automated bot registrations and database bloat.
  • Expired Free Trials: Inactive accounts resulting from expired free trials are transitioned into an archived state. Data is retained for a grace period of 60 to 90 days following expiration to facilitate subscription upgrades or data exports. Following this 90-day window, all associated database records and uploaded media are permanently and irreversibly destroyed.
  • Account Deletion Requests: When an account holder formally requests account deletion, all personal information, client records, and stored attachments are permanently expunged within 30 days, except where financial, tax, or legal auditing statutes require temporary preservation.

8. Data Sharing

We do not sell, rent, or trade your personal information to any third party. We may share data only in the following cases:

  • With third-party service providers listed in Section 6, solely to operate the platform
  • If required by Pakistani law or a valid legal request from authorities
  • To protect the rights, safety, or property of Finity Sync or its users

9. Your Rights

As a user of Xpendee, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Withdraw consent for data processing (where applicable)

To exercise any of these rights, contact us at [email protected].

10. Cookies & Tracking Technologies

We use cookies and similar browser storage technologies to maintain platform functionality, safeguard your account, and analyze aggregate platform usage:

  • Strictly Necessary Cookies: Required for fundamental operations such as secure authentication, session persistence (xpendee-session), CSRF token validation (XSRF-TOKEN), and Paddle billing integrations. These cannot be disabled.
  • Performance & Analytics Cookies: With your prior consent, we use Google Analytics (_ga, _gid) with IP anonymization enabled to understand visitor flows, popular features, and user journeys so we can improve platform speed and capabilities. We do not use third-party advertising cookies or cross-site tracking pixels.

You have full control over your cookie preferences. You can update or withdraw your consent at any time by clicking here or via the link in our website footer.

11. Children's Privacy

Xpendee is a business-to-business (B2B) platform intended for users who are 18 years of age or older. We do not knowingly collect information from minors. If we become aware that a minor has registered, we will delete their account immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of Xpendee after changes constitutes acceptance of the updated policy.

13. Contact Us & Terms

For any privacy-related questions or requests: