1.Who this covers
This policy explains how Exposure Amp (“Exposure,” “we,” “us”) handles information about three groups of people:
- Customers: business owners and their team members who create an account.
- Visitors: people who view a Spotlight page or ask its assistant a question.
- Scanners: people who scan a QR code or open a short link made with the Service.
For visitors and scanners, the business whose page or code you used decides why that information is collected. We process it for them as a service provider. Questions about how a particular business uses your information should go to that business; you can also contact us.
2.What we collect
From customers
- Account details: name, email address, and a password if you set one (stored only in hashed form by our authentication provider). Sign-in codes are single-use and expire.
- Business details: business name, type, address, phone, contact email, website, hours, social links, logo, photos, offers, answers you approve, and anything else you add.
- Billing: plan, subscription status and billing history. Card details are collected and stored by Stripe, not by us.
- Setup answers, such as how you heard about us.
- Support messages you send us.
From visitors and scanners
- Page activity: that a page was viewed, which buttons or links were tapped, and when.
- Questions typed into a page’s assistant, and whether it could answer. Please don’t type sensitive personal information into these boxes.
- QR scans: which code was scanned, when, and which destination it sent you to.
- Approximate context: city, region and country (worked out from your IP address by our hosting provider), device type (phone, tablet or computer), and the website that referred you, if any.
We do not store visitors’ or scanners’ full IP addresses with this activity. IP addresses are used briefly to block abuse and limit excessive requests and are discarded within about 24 hours. We don’t ask visitors or scanners for their names, emails or precise location, and we don’t build profiles of them.
Automatically, from everyone
- Technical logs kept by our hosting providers for security and reliability (such as IP address, browser type, pages requested and error details), retained for a short time.
- Cookies and similar storage described in Section 6.
3.How we use information
- To provide the Service: host your pages, redirect your QR codes, answer visitor questions from your approved facts, run AI visibility checks, and show you analytics.
- To keep accounts secure, prevent fraud, spam and abuse, and enforce our terms.
- To process payments and manage subscriptions.
- To send account and service messages, such as sign-in codes, receipts, security alerts, changes to our terms, and weekly reports you’ve opted into.
- To provide support and respond to requests.
- To understand how the Service is used and improve it, mostly with aggregated information.
- To comply with law and protect our rights and the rights of others.
We don’t use visitors’ or scanners’ information to advertise to them, and we don’t sell anyone’s personal information.
4.AI processing
When someone asks a page’s assistant a question, we send the question and the business’s approved information to an AI provider (currently OpenAI) to write the answer. AI visibility checks send questions about the business’s category and city to AI providers. These providers process the data to return a result under their business API terms, which by default do not allow them to use it to train their models. We don’t send customers’ account passwords, payment details or visitors’ IP addresses to AI providers.
7.How long we keep information
- Account and business information: while your account is open. After you close it, we delete it within 30 days, except where we must keep it longer by law (for example, billing records for tax purposes).
- Page activity, questions and scan data: while the business’s account is open, unless the business deletes it sooner.
- Deleted items: items moved to Trash can be restored for 30 days, then are permanently removed.
- Change history and backups: kept for a limited time (up to 90 days for change history and 30 days for backups) so we can recover from mistakes and failures, then deleted automatically.
- Abuse-prevention data, such as IP addresses used for rate limiting: about 24 hours.
8.How we protect information
We use industry-standard safeguards, including encryption in transit (HTTPS), encryption at rest by our providers, row-level access rules so each business can reach only its own data, limited staff access, rate limits against abuse, change history, regular backups and security reviews of our code. No method of storing or transmitting data is completely secure, so we can’t guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and any authorities as required by law.
9.Your choices and rights
- Access and export: download a copy of your data from Settings → Account → Download My Data.
- Correct: edit your information in the app at any time.
- Delete: delete items in the app, or ask us to close your account and delete your data.
- Email: unsubscribe from optional emails using the link in them or in Settings. We’ll still send essential account and security messages.
Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas and other U.S. states, the EU/UK, and elsewhere, you may have additional rights: to know what we collect and how we use it, to access, correct, delete or move your information, to object to or restrict certain processing, and to appeal our decision. We don’t sell personal information or share it for cross-context behavioral advertising, and we won’t discriminate against you for using your rights.
To make a request, email support@exposureamp.com. We may need to verify your identity and will respond within the time required by law (generally 30 to 45 days). If you’re a visitor or scanner, we may refer your request to the business whose page or code you used. You may use an authorized agent where the law allows.
10.Children
The Service is for businesses and isn’t directed to children. Accounts are for people 18 and older. We don’t knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we’ll delete it.
11.Where data is stored
We are based in the United States, and our main providers store data in the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those where you live. Where required, we rely on appropriate safeguards for these transfers.
12.Changes to this policy
We may update this policy as the Service changes or the law requires. If a change is material, we’ll notify customers by email or in the Service before it takes effect. The “last updated” date at the top shows the latest version.
Questions?
Email support@exposureamp.com. We read every message.