Privacy & Data Protection Policy
Last updated: July 22, 2026
Xpansive is a software studio based in Bogotá, Colombia. This policy explains what personal data we collect through our website, xpansive.co, why we collect it, who processes it, and the rights you can exercise over it — wherever you are in the world.
We keep the site deliberately light: no accounts, no advertising, no tracking. The only data we hold about you is what you choose to send us through the two forms on the site. This policy describes exactly what happens to it.
For anything related to your data — questions, requests, objections — write to hola@xpansive.co. That single channel handles every right described below.
Who we are and what this policy covers
Xpansive is a software studio based in Bogotá, Colombia. For this policy, Xpansive is the data controller: the party that decides why and how your personal data is processed.
The policy covers the website xpansive.co and the forms it contains — the contact form and the talent application form. It does not cover client projects, which are governed by their own written agreements.
Our contact and data-rights channel is hola@xpansive.co. Every request described in this policy — access, correction, deletion, objection — goes through that address.
What we collect
Contact and lead form: your name, email, company (optional), a message (optional), and the language of the page you wrote from. That’s it.
Talent applications: your name, email, phone number, your LinkedIn profile URL, an optional free-text story about yourself, an optional CV or LinkedIn-profile PDF, and the page language.
There is no account system, no advertising, and no tracking cookies. The only thing stored in your browser is a localStorage entry with your theme preference (light or dark) — and it never leaves your device. Our server logs record ordinary technical events but do not store the contents of the forms.
Voice dictation
The application form offers voice dictation. That dictation is performed entirely by your own browser or operating system’s speech service — the audio is captured and transcribed on your side and never reaches Xpansive’s servers.
Because the speech service belongs to your browser vendor, its processing of your voice is governed by that vendor’s own privacy policy, not by this one. Only the resulting text, once you choose to submit it, comes to us.
How AI helps us review applications
Uploaded CVs and application text are processed by Claude, an AI model provided by Anthropic acting as our data processor. Claude produces a structured summary of each application — skills, roles, education, highlights — that helps a human review it faster and more fairly.
Anthropic processes this data in the United States under its data-processing terms. Your application data is not used to train AI models.
No automated decision producing legal effects is made about you: a human reviews every application, and the AI summary is an aid to that review, never a replacement for it.
You can object to this processing or request deletion of your data at any time by writing to hola@xpansive.co.
Purposes and legal bases
We process contact-form data to respond to your inquiry and, if a conversation follows, to prepare a proposal. We process application data to evaluate your candidacy and stay in touch during the process.
Where the GDPR applies, our legal basis for both is your consent, given when you submit the form. For basic security and anti-abuse measures — rate limiting, spam filtering, log analysis — we rely on our legitimate interest in keeping the site safe.
You can withdraw consent at any time; doing so does not affect processing that happened before the withdrawal.
Who receives your data
We use a small set of service providers (processors) that act only on our instructions: cloud hosting and database infrastructure, which may process data in the United States, and Anthropic, the AI processor described above.
We never sell your personal data, and we don’t share it with advertisers or data brokers. Beyond our processors, data leaves Xpansive only if the law requires it.
International transfers
Because part of our infrastructure and our AI processor operate in the United States, your data may be transferred outside your country. When that happens, we rely on appropriate safeguards — contractual data-protection commitments with each provider, such as standard contractual clauses and equivalent terms — so your data keeps the protection this policy promises, wherever it is processed.
How long we keep your data
Leads and inquiries: for as long as needed to handle the conversation, and no longer than 2 years from the last contact.
Talent applications: up to 24 months after the process ends, so we can reach out if a matching role opens. We delete earlier on request — one email to hola@xpansive.co is enough.
Your rights in the EU and EEA (GDPR)
If you are in the European Union or the European Economic Area, you hold the rights of articles 15 to 21 of the GDPR: access to your data, rectification, erasure, restriction of processing, data portability, and objection.
You can also withdraw any consent you have given, at any time, and you have the right to lodge a complaint with your local supervisory authority.
To exercise any of these rights, write to hola@xpansive.co. We respond within the terms the GDPR sets.
Your rights in the United States (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we hold about you, to have it deleted, to have it corrected, and to not be discriminated against for exercising those rights.
We do not sell or share personal information as the CCPA/CPRA defines those terms — there is nothing to opt out of.
Your rights in Colombia (Ley 1581 de 2012)
If you are in Colombia, the habeas data regime of Ley 1581 de 2012 gives you the right to conocer (know), actualizar (update), rectificar (correct) and suprimir (delete) your data, and to revocar (revoke) the authorization you gave for its processing.
The supervisory authority is the Superintendencia de Industria y Comercio (SIC), before which you may file complaints once you have first addressed your request to us.
Our full Colombian-law policy — including the consulta and reclamo procedures with their legal response terms — is the Personal Data Processing Policy, published on this site.
Elsewhere in Latin America
If you write to us from Brazil, the LGPD (Lei Geral de Proteção de Dados) grants you a closely equivalent set of rights; from Mexico, the LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) does the same, including its ARCO rights.
Wherever you are, we honor the same requests through the same channel: hola@xpansive.co. We apply the strongest of the applicable protections, not the weakest.
Security
All traffic to and from xpansive.co is encrypted in transit. Access to submitted data is restricted to the people who need it, behind access controls, and the backoffice where applications are reviewed is password-gated.
No system is invulnerable, but the small amount of data we hold and the small number of people who can touch it keep the attack surface deliberately minimal.
Children
The site and its forms are not directed at anyone under 18. We do not knowingly collect data from minors; if you believe a minor has submitted data, write to hola@xpansive.co and we will delete it.
Changes to this policy
When this policy changes, we publish the new version here with an updated date at the top. If a change meaningfully affects how we process data you have already given us, we will tell you before it takes effect.