Legal

Privacy Policy

Last updated: October 2, 2026

1. Who we are

Expona (“we”, “our”, “us”) is a consulting practice based in Salt Lake City, Utah. This policy explains how we handle personal information on expona.ai (the “site”) and when we talk with prospective clients and deliver engagements.

When you hire us, a Master Services Agreement and a Statement of Work also govern how we handle your company’s information. Where this policy and a signed agreement differ, the agreement governs.

2. Information we collect

Information you give us

  • Inquiry form: your name, work email, company, revenue range, the decision you want to talk about, and the topic you chose.
  • Contact form: your name, email and message.
  • Decision Line Assessment: your answers about the recurring decisions in your business, such as how often they come up and how long the preparation takes. If you ask for the full breakdown, we also collect your name, company and work email so we can send it.
  • Blog updates: your email address, if you subscribe.
  • Scheduling: if you book time with us through Calendly, the details you enter there.
  • Conversations: what you tell us by email, by phone or in meetings.

Information collected automatically

  • Analytics: through Google Analytics, loaded by Google Tag Manager, we see which pages are visited, the referring site, device and browser type, and approximate location derived from your IP address. You can turn this off at any time; see our Cookie Policy.
  • Server logs: IP addresses and request times, used to keep the site secure and working.

Information we handle during an engagement

During an engagement, your people tell us how their work gets done in interviews, timed walkthroughs and working sessions, and we may receive read access or exports you choose to give us. A few rules hold on every engagement:

  • We never request, receive or store your production credentials.
  • By default we do not take on protected health information, payment card data or government ID numbers.
  • In the AI Adoption Baseline we report patterns, not people, and never name who uses which tool.
  • The systems we build run in accounts you own, on your own contracts with your providers. Data those systems process stays under your agreements with those providers.

3. How we use information

  • To answer your inquiry and follow up with you
  • To send the assessment report you asked for
  • To prepare for and deliver engagements you hire us for
  • To send blog updates you subscribed to (every email has an unsubscribe link)
  • To understand how the site is used and improve it
  • To keep the site secure and prevent misuse of its forms
  • To meet legal obligations

We do not sell personal information, and we do not use it for advertising.

4. Who we share it with

We share personal information only with providers that help us run the practice, and only as much as they need:

  • Email delivery: Resend, which sends our emails, including your assessment report
  • Client records: a customer relationship management system we operate, and Google Workspace for email and records
  • Analytics: Google Analytics and Google Tag Manager
  • Scheduling: Calendly, when you book a call
  • Hosting: the cloud providers that host the site, in the United States

We may also share information with our professional advisers, when the law requires it, or as part of a sale or reorganization of the business, in which case this policy continues to apply.

5. How long we keep it

  • Inquiries and assessment requests: up to 24 months after our last contact, or until you ask us to delete them
  • Blog subscriptions: until you unsubscribe
  • Engagement records: as set out in your Master Services Agreement
  • Analytics: Google Analytics keeps event level data for 2 months and user level data for 14 months. After that, only aggregated reports remain.

6. Your choices and rights

You can ask us to show you, correct or delete the personal information we hold about you, and you can unsubscribe from emails at any time. Depending on where you live, you may have additional rights under local law. Email privacy@expona.ai and we will respond within 30 days.

7. Security

We take reasonable measures to protect the information we hold, and we limit who can see it. No system is completely secure, so we keep only what we need.

8. Where information is processed

We are based in the United States, and the information we collect is processed and stored here.

9. Children

The site is not directed to anyone under 18, and we do not knowingly collect their information. If we learn that we have, we will delete it.

10. Changes

When we change this policy we will update the date at the top of this page. For significant changes, we will also email people we have an active relationship with.

11. Contact

Questions about this policy: privacy@expona.ai, or through our contact page.