Privacy Policy

ExpireMate respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your data when you use our application.

We collect the following data:

• Information about your account (email address)
• Information about your documents (document type, expiration date, notes)
• Notification settings
• Information about app usage and errors

Important: We do not collect or store images of your documents or other sensitive information such as document numbers.

Customer data entered by Business users. If you use ExpireMate Business, you may enter contact details (such as the name and phone number) of your own customers in order to send them service reminders. For this data, you act as the data controller and ExpireMate acts as the data processor, processing it only to deliver the reminders you schedule. You are responsible for having a lawful basis to provide us with this data.

Through the service CRM you enter and store the following data about your clients and their equipment:

• Client details: name, phone number, email address, street address and city. For a legal entity, also the company name, the tax ID (PIB) and the name of the contact person.
• Equipment details: manufacturer, model, serial number, installation location and date, warranty details and the service interval. The installation location is normally the address where the unit sits.
• Service records: what was done, parts installed, the price, recommendations, the date and time of the visit and the name of the technician.
• Consent records: whether the client agreed to SMS reminders, the "do not message" flag and a record of opt-outs.
• Message history: the text of the reminder that was sent, the phone number it went to, the date and time it was sent, the delivery status, the client's reply if they answer, and the name of the team member who sent it by hand.

Obtaining the client's consent is your job. Because you are the data controller for this data, it is your obligation to inform the client about the processing and to obtain consent before the first message - ExpireMate does not do this for you. We record consent as you enter it and we honour it: when consent is revoked or a client is marked "do not message", sending stops. The reminder reaches the client under the sender name you configure for your company and register with the SMS operator - what the client sees in the message is your firm, not ExpireMate, so it is you they answer.

We use your data to:

• Provide the service of tracking document expiration dates
• Send notifications about document expiration
• Improve and maintain the application
• Resolve technical issues

We process your personal data on the following legal bases:

• Performance of a contract: to provide the service you signed up for (account, document tracking, notifications, billing).
• Legitimate interest: to maintain, secure and improve the application, and to prevent abuse.
• Consent: where required, for example optional communications; you may withdraw consent at any time.
• Legal obligation: where we are required to retain certain records (e.g. billing) under applicable law.

We keep your personal data only as long as necessary for the purposes described in this policy:

• Account and document data: for as long as your account is active. If you delete your account, this data is removed within 30 days, except where we must retain limited records to comply with legal obligations (e.g. billing records).
• Usage and error logs: kept for a limited period and then deleted or anonymised.
• Erasing a client's personal data: in the CRM you can erase one client's personal data without deleting your account. The name, phone, email and address are then permanently removed, the client stays in the list marked as erased, and consent for messages is revoked. The equipment's service history stays - what was done, when, which parts and which recommendations - but with no owner details attached. The maintenance history of a unit still has a purpose once you stop working with that client: warranty, the next service and the unit's next owner all rely on it. This action cannot be undone.
• Client data entered by a business: kept for as long as the company has an account in ExpireMate. When a subscription ends, access to the Business part of the app closes but the data is not deleted - it waits for you if you come back. When the owner deletes the company, it enters a 30-day window in which everything can be restored; after that, client, equipment and service data is permanently deleted. You can export a copy from the company settings at any time before deletion.
• Data on the device: the mobile app keeps the list of clients, equipment and services on the phone itself so you can work without a signal, and syncs what you entered once the network is back. This means your clients' personal data also sits on the technician's phone, so protect it like any other work device. The copy on the phone is removed when you switch company in the app or delete the app.

Under applicable data protection law (including the Serbian Law on Personal Data Protection and, where applicable, the GDPR), you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (the "right to be forgotten");
• request a copy of your data in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@expiremate.com. You also have the right to lodge a complaint with the competent supervisory authority (in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection).

If you are a service company's client and have no account with us. Your data was entered by the technician who maintains your equipment, and they are the controller of that data. Send any request for access, correction or deletion to them - they can do all of it in the app. If you contact us instead, we may not change or delete the data without the company's instruction, so we will pass your request to the company that holds your record and tell you we have done so. If you don't know which company that is, write to privacy@expiremate.com - the phone number the message arrived on is enough for us to find them. Opting out of reminders needs none of this: if the message you received carries a reply link, you can switch off future reminders through it yourself.

We rely on a small number of specialized providers to operate the service. They process data only on our behalf and only for the purposes listed here:

• Supabase: authentication and database hosting (account and application data)
• Vercel: hosting for our website and the server that serves it (technical request logs)
• Paddle: payment processing and billing (we never see or store your full card number)
• OneSignal: delivery of push and email notifications
• Sentry: crash and error reporting for the web and mobile apps (technical error data; configured not to include personal information)
• BudgetSMS: delivery of SMS reminders (recipient phone number and message text)
• Cal.com: scheduling of demo calls booked through our website; the name, email address and time slot you enter in the booking form are processed by Cal.com and the appointment is synced to our Google Calendar
• Google Analytics: measuring traffic on our website. It sets its own cookies in your browser and the visit data is processed by Google. We do not pass it the contents of your documents or your clients' CRM data.

Alongside Google Analytics, on our public marketing pages we record our own anonymous usage events (for example, that a "book a demo" button was clicked). These events contain no personal data, are stored on our own infrastructure, use no cookies and do not follow you across other sites.

When you enter your clients' data through Business, these providers process it as our sub-processors - on your behalf and only for the purposes listed above. Client, equipment and service records are stored in our database at Supabase, and the phone number and message text reach BudgetSMS only when a reminder is actually sent.

If you have questions regarding our privacy policy, you can contact us at privacy@expiremate.com.