Privacy & cookies

Updated November 5, 2026

Xponent uses the information you share to respond to enquiries, provide its AI opportunity audit and arrange requested calls. For privacy questions or requests, contact the Xponent Team at ryan@xponent.studio.

What we collect and why

Messages sent to the Xponent AI audit chat are stored along with the assistant’s replies, usage records and the business context you provide. If you share contact details, we store your name, email address, verification status and follow-up preferences. Requested bookings include the selected time and calendar event details. Technical request and security records help us operate the service and prevent abuse. Please do not send passwords, payment information or sensitive personal records.

AI chat and team follow-up

You are speaking with an AI guide. Messages are processed through OpenRouter and the configured model provider so the guide can respond; generated advice can be incomplete or wrong. Email addresses and verification codes are handled by the server and redacted from the conversational transcript. This does not remove other personal information you choose to type.

After End chat or 15 minutes without a new message, we queue a summary and transcript for the Xponent Team. Delivery may be delayed. The team can review conversations and contact details to respond to your request. Email verification confirms control of an address; it does not subscribe you to a newsletter or authorize marketing.

Service providers

Vercel hosts the website; Supabase stores service data and supports protected account sign-in; OpenRouter and its configured AI provider process chat responses; Resend delivers verification and team emails; Google Calendar handles requested bookings and invitations. Cloudflare Turnstile protects contact forms against abuse. These providers may process data outside your country, under their applicable terms and safeguards. We use Google Analytics only after your optional consent. Following our Substack link opens a separate service with its own privacy and subscription choices.

Our reasons for processing

We process requested enquiries, follow-up and bookings to take steps you ask for before a service agreement or to provide that service. Operating and securing the website relies on our legitimate interests, balanced against your rights. Optional analytics relies on consent, which you can withdraw. Where a legal obligation requires particular records, that obligation applies separately. Marketing requires its own applicable permission.

Retention

We retain chat and contact records to respond to enquiries and manage the resulting business relationship, subject to deletion requests and any applicable legal recordkeeping obligations. Contact us to request deletion or ask about a particular record. Verification codes expire after 15 minutes. The browser cookie preference described below expires after 180 days.

Your choices and rights

You can ask for access, correction, deletion, a portable copy or restrictions on processing, and object where applicable. You can withdraw consent without affecting processing that was lawful before withdrawal. We may need to verify your identity and explain any legal limits on a request. You can also complain to your local data protection authority. Contact ryan@xponent.studio to exercise these rights.

Cookies and browser storage

Essential storage supports requested sign-in, security and your privacy choices. Our cookie preference record, xponent-cookie-consent, stores a version, analytics choice and timestamp in this browser for 180 days. It contains no name or email address. Chat state is held in the open page; optional analytics is not required to chat or book.

Google Analytics is off until you choose Accept analytics or explicitly enable it in Cookie settings. If enabled, it uses analytics cookies such as _ga and _ga_* to measure public page visits and fixed action labels. We exclude URL query strings and do not send your chat text or contact fields as analytics events. Analytics cookies are configured to expire after 180 days. Use Cookie settings in the footer to reject or change this choice; withdrawing disables analytics, clears accessible analytics cookies and reloads the page to remove the loaded tracker. Essential sign-in storage is preserved.

Updates and contact

We update this notice when the service or its data use changes. A material analytics-choice change requires a new consent version. See our website terms or contact the Xponent Team with questions.