Privacy
Privacy policy
What we collect, why, where it lives and how to have it removed, in plain words.
01Policy
How Xpand handles personal data
- 01
Who runs Xpand
Xpand is run by Knoxed. For anything on this page, use the contact form at xpand.knoxed.com/contact. We reply from a thread address, so the conversation stays in one place.
- 02
What we collect
When you sign up: your name, email address, fund or company name, and the plan you pick. When you use Xpand: the contacts, companies, deals, notes and files you add, and the founder applications sent to your workspace. We also keep basic logs (time, page and error) to keep the service running.
- 03
Why we use it
To run your workspace, sign you in, send the emails you ask for, and score founders and leads with AI. We do not sell personal data and we do not use your workspace data to train AI models.
- 04
Where it is stored
In a database hosted in the EU (Ireland). Each workspace is separated by row-level security in the database, so one workspace cannot read another’s records. Pitch decks sit in private storage behind links that expire after an hour.
- 05
Who processes it for us
Supabase (database and sign-in, EU), Vercel (hosting), Resend (email), and Anthropic, with OpenAI as a fallback (AI scoring and drafting). Each one only gets what it needs to do its job.
- 06
How long we keep it
For as long as your workspace is open. If you close it, we delete your workspace data within 30 days, apart from anything we must keep by law.
- 07
Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it. Ask through the contact form. You can also complain to your local data protection authority.
- 08
Changes
If this policy changes in a way that matters, we will tell signed-up users by email before the change takes effect. Last updated 9 November 2026.