Privacy policy
Draft for legal review. Replace every highlighted placeholder and have an attorney review this policy before launch. Remove this notice once it's final.
1. Who we are
I A Expand: Communications (“I A Expand,” “we,” “us”) is [legal entity name and type, e.g. “I A Expand and Communications LLC, an Arizona limited liability company”], located at [street address, city, state, ZIP]. We provide a platform that businesses use to send text message campaigns to their own customers.
2. Whose information this covers
This policy explains how we handle personal information about:
- Website visitors who browse this site or contact us.
- Customers: the businesses that use our platform and the people on their teams who have accounts.
- Message recipients: people whose phone numbers our customers upload so they can send them texts.
For message recipients, our customer decides who to message and why. The customer is responsible for that information under privacy law (often called the “controller” or “business”), and we process it on the customer’s behalf and under their instructions (as a “processor” or “service provider”). Section 11 explains what this means if you receive texts.
3. Information we collect
Information you give us
- Contact form: your name, company, email, phone number, expected message volume and your message.
- Account signup and use: business name and website, your name, work email, phone number, time zone, password (stored only as a secure hash) and team members you invite.
- Support and feedback: what you write to us through the portal.
- Connection details: if you connect a database or SFTP server, the host, username and password you provide. We encrypt passwords before storing them.
Information customers upload about their contacts
- Phone numbers, and optionally names, email addresses and other fields the customer chooses to include.
- Message content, delivery status, replies and opt-out requests (for example, replying STOP).
Information collected automatically
- IP address, browser type and the pages you request, in our server logs.
- Security records such as sign-ins, failed sign-in attempts and account changes, which we keep in an audit log.
Payment information
Card payments are handled by our payment processors, Stripe and Square, on their own secure pages. We never receive or store your full card number. We receive a record that a payment succeeded, its amount and a reference number.
4. How we use information
- To provide the platform: send messages, import contacts, report delivery, process replies and honor opt-outs.
- To review new accounts, register sending numbers with carriers and prevent spam, fraud and abuse.
- To bill you and keep financial records.
- To secure accounts, including two-step verification, login protection and audit records.
- To answer enquiries, provide support and send service notices (for example, password resets).
- To comply with law, carrier rules and valid legal requests.
We do not sell personal information. We do not use our customers’ contact lists or message content for our own marketing, and we do not use them to train artificial intelligence models.
5. Mobile numbers and text messages
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the carriers and service providers needed to deliver messages.
If you text STOP (or UNSUBSCRIBE, CANCEL, END or QUIT) in reply to a message sent through our platform, that sender will stop messaging you. Reply START to opt back in. Message and data rates may apply.
6. Who we share information with
We share personal information only as needed to run the service:
- Telecommunications carriers and messaging providers that transmit text messages to recipients’ phones.
- Payment processors (Stripe and Square) to take payments.
- Hosting, storage, email delivery and error monitoring providers that operate our infrastructure under contract. [Name them here or link a subprocessor list, e.g. Render, your storage provider, your email provider.]
- Carrier registration bodies, when registering a customer’s business and sending numbers for text messaging (for example, 10DLC or toll-free verification).
- Authorities or others when required by law, to protect rights and safety, or to investigate abuse.
- A buyer or successor if our business is sold or merged, subject to this policy.
Service providers may use personal information only to provide services to us.
7. Cookies
We use only cookies needed to run the site: a session cookie that keeps you signed in and a security cookie that protects forms. We do not use advertising or cross-site tracking cookies.
Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads. [Optional: self-host the fonts to remove this and delete this paragraph.]
8. How long we keep information
- Account information: while the account is open, and for [e.g. 2 years] after it closes.
- Contact lists: until the customer deletes them or closes the account, then within [e.g. 90 days].
- Message records and delivery reports: [e.g. 24 months], so customers can review campaign history.
- Opt-out records: as long as needed to keep honoring the request.
- Billing and payment records: [e.g. 7 years], for tax and accounting.
- Security and audit logs: [e.g. 2 years].
- Contact form enquiries: [e.g. 2 years].
9. Security
We protect information with encryption in transit (HTTPS), encryption of stored connection passwords, two-step verification for staff, role-based access limited to what each person needs, login protection, audit logging and separate systems for customer and staff access. No system is perfectly secure; if a breach affects your personal information, we’ll notify you and authorities as the law requires.
10. Your choices and rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy;
- correct inaccurate information;
- delete your information;
- object to or restrict certain uses; and
- not be treated differently for using these rights.
Account holders can update most details in the portal. To make a request, email [privacy@messaging.iaexpand.com]. We’ll verify your identity before acting and reply within the time the law requires (usually 30 to 45 days). You may use an authorized agent where the law allows. If you’re in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.
11. If you receive texts from one of our customers
The business that texted you controls your information on our platform. To stop messages, reply STOP. For questions about how that business uses your information, contact the business directly. If you contact us instead, we’ll pass your request to them and help them respond.
12. Children
Our services are for businesses and are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where that is the local threshold). If you believe a child has given us information, contact us and we’ll delete it.
13. International transfers
We are based in the United States, and we store and process information in the United States [and other locations where our providers operate]. If you are outside the United States, your information will be transferred here. Where the law requires, we use appropriate safeguards such as standard contractual clauses.
14. Changes to this policy
We may update this policy. We’ll change the “last updated” date above and, for significant changes, tell account holders by email or in the portal before the changes take effect.
15. Contact us
Email [privacy@messaging.iaexpand.com], write to [legal entity name, street address, city, state, ZIP], or use our contact form.