Data Processing / Data Protection
High-level processing information for Expenu. This is not a signed DPA and does not claim GDPR certification.
Describes implemented processing. Counterparty DPA details remain placeholders.
Roles
For marketing leads and account data we process as 9VN Communication Pvt Ltd (controller details incomplete until SCR 201, 3rd Floor, 150 Meters from Venus Inn Restaurant, Towards Mausima Flyover, Bapuji Nagar, Bhubaneswar, Odisha 751009 is published).
For workspace financial content you enter, you determine purposes as the workspace operator; we process that content to provide the hosted service.
[PLACEHOLDER: DPA counterparty details]
Categories of data
Account credentials metadata and profile fields; MarketingLead enquiry fields; workspace membership; ledger and related finance objects; optional AI prompt/receipt content; attachments on disk; operational logs and rate-limit keys.
Purposes and legal bases (high level)
Provide and secure the service, respond to enquiries, optional AI assistance you request, and transactional email when configured.
We do not invent a jurisdiction-specific legal-basis matrix while governing law remains [PLACEHOLDER: governing law].
Processors actually integrated
Resend — email delivery when configured.
OpenAI / Anthropic / Gemini — AI inference when configured.
Redis — jobs and rate limiting infrastructure.
Attachment files — local filesystem storage on the API host (not a marketed third-party object store in code).
Security measures (honest scope)
Tenant isolation, JWT auth, argon2 password hashes, AES-256-GCM for reversible webhook secrets (not all data), HMAC-SHA256 webhook signatures, import preview-before-write, AI answer-guard for fabricated figures.
See /security for the public overview. No SOC 2 / ISO claims.
International transfers
AI and email providers may process data in regions they operate. Specific transfer mechanisms are not published here; contact /contact for enterprise questionnaire needs rather than assuming SCCs we have not attached.
Retention
[PLACEHOLDER: published retention periods] and [PLACEHOLDER: deletion request SLA] remain unpublished. See /privacy.
Contact
[email protected] or /contact. Full privacy narrative: /privacy.