Privacy Policy
Xplens is operated by SomlokSolutions LLC (Robbinsville, NJ, USA). This policy explains what we collect, why, who else sees it, and how you can export or delete it. Xplens is currently in an invitation-only pilot.
1. Information We Collect
- Account information: your name, email address, and a hashed password (some early pilot accounts also have a phone number we collected earlier) (we never store your password itself).
- Expense data: receipts, invoices and statements you upload (images, PDFs, spreadsheets) and the details we extract from them: merchant, date, amount, currency, category, line items, payment-card label (e.g. "Visa ****1234") and notes.
- Optional connections: if you connect Google Drive or Microsoft OneDrive, we store an access token for that connection and the name of the folder you chose. We request read-only access and only read files in that folder.
- Usage and diagnostics: sign-in times, your IP address and browser type in server logs, and error details, used to keep the service secure and fix bugs.
- Reports you send us: when you submit feedback or a bug report we store your message together with your account email, the page you were on, the app version and your browser type.
We do not use advertising or third-party analytics trackers. The only cookie we set is the sign-in session cookie that keeps you logged in.
2. How We Use Your Information
- To operate Xplens: extract data from your uploads, categorise spending, show your dashboards, budgets, alerts and reports.
- To send service emails: sign-in codes, account notices, and (if you opt in) summaries.
- To secure the service, prevent abuse, and diagnose problems.
- To count usage against your plan's monthly receipt allowance.
We do not sell your personal data and we do not share it for advertising.
3. Who Can See Your Data
- You. Your expenses are private to your account by default.
- Your family group. If you create or join a group, every member of that group can see the group's expenses and receipts, including those you add. You can leave a group at any time and your expenses are then removed from the group view.
- Xplens administrators. A small number of administrators can access account records and uploaded receipts when needed to operate the service, investigate a problem you report, or process a deletion request.
4. Service Providers We Rely On
- Anthropic (Claude API): receipt images and documents you upload are sent to Anthropic to read and extract the transaction data, and some features (e.g. food insights) send item names for analysis. Anthropic processes this under its own privacy policy and commercial terms.
- Amazon Web Services: hosting, database and encrypted file storage in the United States.
- Google (Gmail / Google Drive) and Microsoft (OneDrive): Gmail is used to send sign-in codes and notices; Drive and OneDrive are used only if you connect them.
- Cloudflare Turnstile: a bot check on sign-in pages.
5. Storage, Security and Retention
Data is stored on AWS in the United States. Files are kept in encrypted Amazon S3 storage and the database is encrypted at rest. Traffic uses HTTPS and sign-in uses one-time email codes. No system is perfectly secure, but we limit access and log administrator activity.
We keep your data while your account is active. If you delete your account, we delete your profile, expenses, receipt files, budgets, alerts, bug reports and cloud connections. Encrypted backups and previous file versions are overwritten or expire automatically within about 35 days.
If an upload cannot be read as an expense document, the file is discarded rather than kept.
6. Your Choices and Rights
- Access and export: download all your expenses any time as a CSV from the Receipts page (/export.csv when signed in).
- Correct: edit or delete any expense in the app.
- Delete your account and data: in the app under Groups & Settings, or at xplens.app/delete-account. We email a one-time code to confirm the request is yours, then complete deletion within 30 days and confirm by email.
- Disconnect Google Drive or OneDrive at any time from Groups & Settings.
7. Children
Xplens is not directed to children under 13 and we do not knowingly collect their information.
8. Changes
If we make a material change we will tell you by email or in the app before it takes effect.
9. Contact
Privacy questions or requests: somloksolutions@gmail.com
SomlokSolutions LLC, Robbinsville, NJ, USA