This is a template for Exspedio’s counsel to review before launch. It describes how the platform is built to work; it is not yet legal advice or a binding agreement.
Who we are
Exspedio (“Exspedio”, “we”, “us”) runs exspedio.com, a platform that event and expo organizers use to sell tickets and booths and to run their event websites. This policy explains what we do with information about organizers and about the people who buy from them. If anything here is unclear, write to [email protected].
Organizers and buyers
Two kinds of people use Exspedio, and the rules differ:
- Organizers — the organizations and their team members who create events. For their account data, Exspedio is the controller.
- Buyers — attendees and exhibitors who buy on an organizer’s site. The organizer is the seller and the controller of that data; Exspedio processes it on the organizer’s instructions to run the sale, issue the tickets and check people in. The organizer’s own privacy policy applies to how they use it; this policy describes what Exspedio does.
What we collect from organizers
Your account
- Your name, email address and a hashed password; two-factor and passkey details if you turn them on.
- Your organization’s name, country, currency, time zone, support email, its members and their roles, and invitations you send.
- Your connected payment account: the account id Stripe or Square gives us, its status, and (for Square) the access tokens needed to create payments on your account, stored encrypted. We never see your bank details.
What you create
- Events, ticket types, packages, booth types, floor plans, exhibitor listings, pages, themes, uploaded images and the domains you connect.
- Orders, tickets, refunds and check-ins on your events.
When you use Exspedio
- Technical information such as your IP address, browser and device, pages visited and errors, kept in logs to run and secure the service.
- A session cookie to keep you signed in, and your light or dark mode preference. We don’t use advertising or cross-site tracking cookies on exspedio.com.
- Messages you send to support.
What we collect from buyers
When someone buys a ticket or a booth, applies to exhibit, or checks in on an organizer’s site, we process for that organizer:
- The buyer’s name, email address and phone number, and the names on each ticket if the organizer asks for them.
- Answers to the organizer’s checkout or application questions, and an exhibitor’s company details, logo and description.
- What was bought, when, for how much, the payment’s reference at the processor, and refunds. Card details go straight to Stripe or Square and never reach Exspedio.
- Each ticket’s QR code and when and by whom it was scanned.
- The technical information above, for the organizer’s site.
We use buyers’ information only to provide the service to the organizer: to complete the purchase, send the receipt and tickets on the organizer’s behalf, run check-in, and show the organizer their orders. We don’t use it for our own marketing, we don’t sell it, and we don’t combine it across organizers.
How we use it
- To do what you ask: serve your site, sell your tickets and booths, issue tickets, run check-in, and show you your orders and attendees.
- To run your organization: invitations, roles, and the emails that go with orders, exhibitor applications and support.
- To collect our fee, prevent fraud and abuse, keep the service secure, fix problems and answer support requests.
- To improve Exspedio using aggregated, de-identified usage information.
We don’t sell personal information, we don’t use it for advertising, and we don’t use organizers’ or buyers’ data to train AI models.
Payments
Payments are made on the organizer’s own Stripe or Square account. Card numbers are entered into Stripe’s or Square’s own payment fields and handled by them under their privacy policies; Exspedio receives only the payment’s id, amount, status and the last four digits and card brand where the processor shares them. Exspedio’s fee is collected by the processor as an application fee at the moment of each sale.
Organizer sites and cookies
Each organizer’s site is served by Exspedio at their subdomain or their own domain. It sets a session cookie for that site (needed for checkout) and nothing else of ours. Organizers may add their own analytics — Google Analytics, Google Tag Manager or the Meta Pixel — by entering an id; those tools then run on the site under the organizer’s and the tool’s own terms, and the organizer is responsible for any consent they need. Exspedio doesn’t read or use those analytics.
Who we share it with
- The organizer — buyers’ orders, tickets, answers and check-ins are shown to the organizer they bought from and to its team members.
- Stripe or Square — the payment details needed to charge the buyer on the organizer’s account, under their terms.
- Service providers — companies that host and run Exspedio for us under contract: cloud hosting and file storage (Laravel Cloud), email delivery (Postmark), and certificate and edge services for organizer domains. They may use the data only to provide their service to us.
- When the law requires it — to comply with a valid legal request, or to protect the rights and safety of our users or others.
- If Exspedio changes hands — in a merger or acquisition, this policy continues to apply to your information.
How long we keep it
- Your account, organization and content: for as long as your account exists.
- Orders and tickets: for as long as the organizer’s organization exists, because they’re the organizer’s sales records. An organizer can delete an event’s buyer data at a buyer’s request.
- Payment account tokens: until you disconnect the account or delete your organization.
- When an organization is deleted, we delete its data within 30 days; copies in backups are overwritten within a further 30 days. Records of our fees are kept as long as tax law requires.
Security
Exspedio is served only over HTTPS, including every organizer’s domain. Payment tokens are encrypted at rest, card details never reach us, and access to production systems is limited to the people who run Exspedio. Organizers can protect their accounts with two-factor authentication and passkeys. No system is perfectly secure; if we learn of a breach that affects you, we’ll tell you promptly — and tell organizers so they can tell their buyers.
Your choices and rights
Organizers can see and edit most of their information in Exspedio, disconnect their payment account, export orders and attendees, and delete their organization. Buyers should contact the organizer they bought from, whose details are on their receipt and on the event site; organizers can correct or delete a buyer’s record. If you can’t reach the organizer, email us and we’ll help. Depending on where you live (for example in the EU, UK or California) you may also have rights to access, correct, delete or port your information, and to object to or restrict how it’s used. Email [email protected] and we’ll respond within 30 days. You can also complain to your local data protection authority.
Children
Exspedio accounts are for businesses and people aged 18 and over. Organizers may sell tickets for families; a buyer must be an adult. We don’t knowingly collect information from children; if you think a child has given us information, contact us and we’ll delete it.
Changes
If we change this policy we’ll update the date at the top, and for significant changes we’ll email organization owners before they take effect.
Contact
Questions or requests about privacy: [email protected].