1. Who we are
XpoMag is a platform for creating, commissioning, publishing and experiencing interactive magazines and newsletters. For privacy enquiries, contact support@xpomag.com. The legal operator and responsible-party address must be confirmed before production launch.
2. Information we receive
When you sign up using an email code or Google sign-in, we receive your email address and, for Google sign-in, your verified Google account identifier and basic profile information such as your name. We retain account identity and session records to enable secure access. Google authentication currently requests only openid, email and profile; it does not request Gmail, Drive or Contacts access.
When you send us an enquiry, we receive your name, email, organisation, project details and correspondence. Depending on enabled publication features, users may also submit comments, reactions, polls, stickers or other participation content, and we may collect technical usage events necessary to operate or understand the experience.
3. Why we process this information
- To create and secure your account, deliver one-time verification codes and maintain authenticated sessions.
- To respond to enquiries and deliver services you request.
- To operate interactive publications and prevent abuse, fraud and service disruptions.
- To provide publication and engagement reporting where that functionality is enabled and appropriately disclosed.
- To meet applicable legal obligations.
4. Google sign-in
When you choose Google authentication, Google supplies the account identity information needed for login. We use this information for customer identification and account linking, and do not access other Google products or sell Google user information to advertisers. You may manage your Google authorization through your Google Account settings.
5. Service providers and data transfers
We expect to use hosting and security infrastructure such as AWS, including SES for transactional email. Authentication emails may pass through AWS infrastructure to reach your mailbox. Other operational providers should be listed here before launch; their data locations and international transfer safeguards must be assessed.
6. Retention and security
Short-lived email verification codes expire after 10 minutes. Access tokens are short-lived; refresh sessions are intended to expire within 30 days unless revoked earlier. Longer-term account, publishing, security and enquiry retention schedules must be documented before production use. We use access controls, secure session cookies and restricted access to secrets; no online system can guarantee absolute security.
7. Your choices and rights
You can request access to, correction of, or deletion of personal information where applicable, object to certain processing, or raise a concern with the relevant data-protection regulator. Please contact support@xpomag.com to begin a request. Requests are assessed under applicable law, including South Africa's Protection of Personal Information Act (POPIA) where it applies.
8. Cookies and local storage
We use essential session and OAuth security cookies. See the Cookie policy for names and purposes. Optional analytics or advertising cookies must not be enabled without updating the policy and applying required consent controls.
9. Updates and contact
We may update this policy as the service evolves. Material changes should be explained on the site or through an appropriate account notice. Contact support@xpomag.com with questions about this policy.