Skip to main content
Expanly

Privacy Policy

Last Updated: 28.10.2026

Introduction

Welcome to Expanly ("Expanly," "we," "our," or "us"). We are committed to protecting your privacy and handling your personal data transparently and securely. This Privacy Policy explains how we collect, use, and protect your information when you visit https://expanly.com ("Website") and when you use the Expanly software-as-a-service platform ("Service").

Data we collect

Automatically collected data

IP address, browser type, operating system, pages visited, time spent on pages, and other analytical data via Google Analytics.

Provided data

When you contact us or submit a website form, we may collect your name, work email address, company or agency name, website, country, message and the commercial details relevant to your request. Depending on the form, these details may include advertising spend, catalog size, client count, how you heard about us and whether you have an immediate client need.

If you arrive on our Website through a tagged campaign link or an online advertisement, then with your marketing-cookie consent we store the ad click identifier (such as a Google Ads click ID) and campaign parameters from the address of the page you landed on. If you then submit our audit request form, we include these values and your current marketing-consent status with the submission so we can attribute your enquiry to the campaign that brought you. We stop using these values 90 days after your arrival; an expired record is deleted from your browser the next time you visit, and rejecting or withdrawing marketing-cookie consent deletes it immediately. The stored values are sent with your audit request to the form provider named below and, where you have allowed marketing cookies, may be used to report the resulting enquiry back to the advertising platform that referred you.

Service data

When you use the Service, we process data retrieved from third-party platforms that you connect, such as Google Ads, Google Analytics, and Google Merchant Center. This data may include campaign performance metrics, product data, and conversion data. We process this data on your behalf as a data processor, as set out in the Data Processing Agreement appended to our Terms of Service.

When you connect Shopify, we process order and product information, including product and variant identifiers, quantities, sales amounts, discounts, cancellations, and refunds, to calculate product-level performance and support your product prioritization rules. This integration does not request customer names, email addresses, phone numbers, or billing and shipping addresses.

AI applications you connect

You can connect an AI application, such as Claude or ChatGPT, to the Service through the Expanly MCP server. MCP (Model Context Protocol) is a standard way for AI applications to use other services. Your organisation's owner decides whether this is allowed, and whether the AI application can only read data or can also make changes.

When you use an AI application this way, it sends requests to the Service on your behalf, using your Expanly account, and we send back the data it asks for. That data can include personal data: the Expanly user IDs of your team members, and the email address of the Google account used to connect a data source or destination.

We do not receive your conversations with the AI application, only the requests it sends to the Service.

Records of AI application use

When your organisation's owner accepts the terms for AI applications, we record which user account accepted, when, and which version of the terms. This is our record that your organisation accepted them.

For each request an AI application sends to the Service, we record what was requested, which user account sent it, in which organisation and workspace, the names of the settings it sent (not their contents), the result and how long it took. These records do not contain your name or email address. We keep them for up to 400 days.

When an AI application changes rules, connector configuration or destinations, or starts a pipeline run or a publish, we also store with that change that it came through the MCP server and which user account made it. Your team can see this in the rule history and the pending changes. We keep it for as long as the workspace exists. Creating a workspace, changing a workspace's schedule or settings, and starting a data backfill are recorded only in the records of AI application use above.

How we use your data

We process your data for the following purposes:

  • To analyze website traffic and improve user experience.
  • To comply with legal obligations.
  • To respond to and manage inquiries, audit requests, agency applications and related communications.
  • To provide the Service to you, including retrieving, processing, and analyzing data from connected platforms such as Google Ads, Google Analytics, and Google Merchant Center.
  • To let AI applications you connect read and change your data in the Service at your request, and to record who made each change.

Legal basis for processing

Under GDPR, we rely on the following legal bases for processing your data:

  • Consent: For analytical and marketing cookies when you accept them through our cookie banner.
  • Steps before entering into a contract: When you ask for an audit, product discussion or other service-related information that you may use to evaluate working with Expanly.
  • Legitimate interest: To respond to general business, partner, investor and media inquiries, manage business correspondence, improve our Website, and keep records of AI application use to secure the Service, investigate problems and show who made each change, provided these interests are not overridden by your rights and interests.
  • Legal obligation: When required by law.

Cookies and tracking technologies

We use cookies and similar tracking technologies to analyze traffic and enhance user experience. When you visit our Website, you will see a cookie banner allowing you to manage your preferences. For more details, please see our Cookie Policy.

Data sharing & third parties

We do not sell or rent your personal data. However, we may share data with:

  • Service Providers: Google Analytics (to analyze Website traffic). Google processes data according to its Privacy Policy .
  • Advertising Partners: LinkedIn Insight Tag (to measure ad campaign effectiveness and conversion tracking). LinkedIn processes data according to its Privacy Policy .
  • Website form provider: HubSpot receives and manages submissions from our contact, audit request and agency partner forms, together with the related communications. HubSpot processes data according to its Privacy Policy .
  • AI applications you connect: The Service offers a functionality that lets you connect a third-party AI application if your organisation's owner has enabled this feature. Your organisation is responsible for authorising transfers of personal data to the connected application and ensuring that appropriate transfer arrangements are in place. For the terms governing these transfers and the application's processing of personal data, please contact your organisation.
  • Legal Authorities: If required by law.
  • Sub-processors: We use third-party sub-processors to provide the Service, including Google Cloud Platform (hosting, EU/EEA) and Auth0 (authentication). A full list of our third-party sub-processors is maintained in the Data Processing Agreement appended to our Terms of Service.

Google API Services User Data Policy Compliance

Expanly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We transfer information received from Google APIs to another app only at your request. This happens when your organisation's owner has allowed AI applications, and you or your team ask for that information through an AI application you connected.

Data storage & retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law.

International data transfers

We primarily host and process personal data within the EU/EEA. Some personal data may nonetheless be transferred to, or accessed from, outside the EU/EEA, for example by certain sub-processors or their group companies. Where this happens, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), as described in the Data Processing Agreement appended to our Terms of Service.

The Expanly MCP server runs in the EU/EEA. An AI application you connect may retrieve your data from outside the EU/EEA. Which provider you use, and where it processes your data, is your organisation's choice, under the terms your organisation has with that provider.

Your rights under GDPR

As an EU visitor, you have the following rights:

  • Access: Request access to your personal data.
  • Correction: Request correction of inaccurate data.
  • Erasure: Request deletion of your data.
  • Objection: Object to data processing.
  • Data Portability: Request data transfer.
  • Withdraw Consent: Withdraw cookie consent at any time.

To exercise your rights, please contact us at contact@expanly.com.

Data security

We implement security measures to protect your personal data. However, no online service is 100% secure.

Changes to this policy

We may update this Privacy Policy periodically. The latest version will always be available on our Website.

Contact us

For any questions or concerns regarding this Privacy Policy, contact us at:

Expanly Oy (Business ID 3506966-5)
Siltasaarenkatu 12 C, 00530 Helsinki, Finland
contact@expanly.com