Sign in Get started Open Xpense

Privacy Policy

Effective: 2027-01-01 · Also available in French and Spanish.

In short: we collect what is needed to run your expense reports, we encrypt what people write and attach, we never sell personal information or use it for advertising, and you can see, correct or delete what we hold about you. Questions go to our person in charge of the protection of personal information: Rodney Moffat, [email protected].

1. Who we are and who is responsible

Xpense is operated by Rodney Moffat, 1723 Vallée du Rhône, Saint-Lazare (Québec) J7T 2C1, Canada. We follow Quebec's Act respecting the protection of personal information in the private sector and Canada's Personal Information Protection and Electronic Documents Act.

For your account and your personal workspace, we are responsible for your personal information. For a company workspace, the company (often your employer) decides what is collected and why; we keep and process that information on its behalf, under these rules and its instructions. Requests about company records may be sent to the company or to us; we will help.

2. What we collect

  • Account: your name, e-mail address, preferred language, profile photo if you add one, and your password as a one-way hash.
  • Membership: the companies you belong to, your roles, your supervisor and approval route.
  • Expenses: receipts (photos, PDFs, e-mails), places, dates, amounts, taxes, vendor tax numbers, descriptions and reasons, names of attendees you enter, mileage, vehicles and odometer readings, card statements you import, messages between employees and approvers, approvals and corrections.
  • Technical: the date and time of sign-ins, the IP address of attempts (to slow down password guessing), and the information your browser stores to keep you signed in and remember your language.
  • Contact form: your name, e-mail, company and message.

We collect this information from you, from the company that invited you, and from the files you choose to import.

3. Why we use it

  • To provide Xpense: prepare, route, approve, pay and record expense reports, and show each person what their role allows.
  • To read receipts and translate messages when you ask.
  • To send notices and e-mails about your reports and your account.
  • To keep the service secure, prevent fraud, and keep records the law requires.
  • To answer your questions and improve the service. We do not use your information for advertising, and we do not sell it.

4. Who sees it

Within a company workspace, people see information according to the roles the company sets: for example your approvers see your reports, and accounting sees approved lines. Nobody from a company sees your personal workspace.

We share information only with service providers who help us run Xpense, under contracts that require them to protect it and use it only for us:

  • hosting and network: Xpense server in Saint-Lazare (Québec), Canada;
  • e-mail delivery: Microsoft 365 (GoDaddy);
  • artificial intelligence, only for the receipts, statements or messages you ask to read or translate: the AI provider enabled by the operator (DigitalOcean or Anthropic, in the United States);
  • phone notifications, if you use the mobile app: Google (Firebase) and Apple.

We may also disclose information when the law requires it, for example to answer a valid order from an authority.

5. Where it is kept, and transfers outside Quebec

Xpense's data is stored in: Saint-Lazare (Québec), Canada. Some providers listed above, in particular the AI services, process the information you send them in the United States. Before sending information outside Quebec, we assess the protection it will receive, and we use only providers bound by contract to protect it.

6. How we protect it

  • What people write and attach (names, e-mail addresses, descriptions, places, messages, receipts and photos) is encrypted in the database with AES-256-GCM, with a separate key for each company; the keys are kept apart from the database.
  • Connections use HTTPS. Passwords are stored only as a bcrypt hash; repeated failed sign-ins pause the account for 15 minutes.
  • Access is limited by role, checked on the server for every request, and changes are recorded.

No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people concerned, and keep a register of incidents as the law requires.

7. How long we keep it

  • Account information: while your account is open, then deleted within 90 days of closing it.
  • Expense records in a company workspace: as long as the company keeps them; tax laws generally require businesses to keep records for six years.
  • Personal workspace: until you delete it or close your account.
  • Contact form messages: up to two years. Security logs: up to twelve months. Backups are replaced on a rolling basis and kept encrypted.

8. Browser storage and cookies

Xpense stores in your browser only what it needs to work: your sign-in session and your language. We do not use advertising or tracking cookies, and this website has no third-party analytics. You can clear this storage from your browser; you will then need to sign in again.

9. Automated processing

Receipt reading suggests values that you review. Xpense also matches card charges to expenses and flags rule-based warnings. No decision about you is based solely on automated processing; people approve or refuse every report.

10. Your rights

You may ask to see the personal information we hold about you, to correct it, to receive it in a structured, commonly used technological format, to have it deleted or no longer disseminated when the law allows, and to withdraw a consent you gave. Write to [email protected]. We answer within 30 days. We may need to confirm your identity first.

If you are not satisfied with our answer, you may file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

11. Age

Xpense is meant for adults. We do not knowingly collect information about anyone under the age of majority.

12. Changes

We will update this policy as Xpense changes and show the effective date at the top. We will tell you of an important change by e-mail or in Xpense before it applies.

13. Contact

Person in charge of the protection of personal information: Rodney Moffat · [email protected] · Rodney Moffat, 1723 Vallée du Rhône, Saint-Lazare (Québec) J7T 2C1, Canada