What we record, and whose it is.

Expenety is operated by BKPCELA d.o.o., Ostrogovićeva ulica 10, 10000 Zagreb, Croatia. OIB 53066589531. Reach us at lovro@expenety.com. This page says in plain words what this site records and why. Last updated 11 October 2026. What changed: a section on when we email your business.

Two kinds of booking

On expenety.com you book a call with us. For that booking we decide what happens to your details: in the words of the EU's data protection law (GDPR), we are the controller, and this page is our notice to you.
On a booking page we run for a home-improvement company, you book with that company. It decides what happens to your details, and we handle them only for it and on its instructions: we are its processor. Its own privacy page, linked on that page, is its notice to you. This page says what we do on its behalf.

When you book a time

We store what you type: name, phone, email, the time you picked, and anything you add in the optional note.
On a company's booking page we also store your street address and zip code where the page asks for them, and your answers to its short questions: whether you are in its area, whether you own the home, and what you want done.
If you add photos of your room after booking, we store them with your booking, for the company you booked with.
We store the exact consent wording you agreed to, with the booking, word for word and dated. Not a ticked box: the sentence you actually read. With it we keep the time, the IP address and the browser you booked from. That is the proof you agreed, and it is kept four years after your booking, even if you ask us to delete the rest.
We contact you about that appointment and nothing else, by email only: a confirmation with a calendar invite, a new one if the time moves or is cancelled, reminders before it, and one question the day before or the morning of. Nothing after the time of the call or visit. If you pick a time and do not finish, or ask for a call we have not made yet, one email about it. We do not text you. The link in any email moves or cancels your time.
Your phone number is never shared for marketing. It is used to reach you about the appointment you booked, and for nothing else. Your number is never sold, and it is never passed to another company to be marketed to.
We store which link brought you here (the ad or page), so the booking knows its source. That lives in one first-party cookie for 90 days.

When you text or call us first

If you text or call +1 (866) 989-4568, we keep your number and what you wrote with your record, so the answer can find it.
If you leave a voicemail, on our number or on a number we run for a company, the recording and its transcript are kept with your record.
Nobody texts back automatically; Lovro answers by phone or email.

When we call your business

We call numbers your company publishes, about a service for your business. We found you on your own website or through your ads in Meta's ad library.
We don't record our calls, and nothing on the call is transcribed or taken down by software. Lovro types a few notes himself: your company, your name, and what you told him.
If you tell us not to call again, we won't, and we keep your number on our own do-not-call list so it stays that way.
Why we may do this: our legitimate interest in offering our service to businesses like yours (GDPR Art. 6(1)(f)). You can ask what we hold about you, or ask us to delete it: write to lovro@expenety.com. You can also complain to AZOP, the Croatian data protection authority.

When we email your business

Where we found you. Your company's own website, your ads in Meta's public ad library, your state's contractor licence lookup, and public review pages about your company. We never buy a list.
What we keep. Your company's name, the owner's or office's name, a work email and phone your company publishes, the ads and pages we looked at, and notes on what you told us.
Why we may do this: our legitimate interest in offering our service to businesses like yours (GDPR Art. 6(1)(f)).
Your right to object. Reply "no", or write to lovro@expenety.com, and we stop writing. We keep your address on our own do-not-contact list only so it stays that way (GDPR Art. 21).
How long. Until you ask us to stop, and no longer than 24 months after our last contact. You can ask what we hold about you, or ask us to delete it, at any time, and complain to AZOP (below).

When a business works with us

A business on the system sends us photos of its own jobs, and we keep them to make its ads. A homeowner's own photo is never used for an ad picture.
We keep the owner's name, email and phone, the letter they signed, and their billing details. The card itself is held by Stripe, not by us.

One thing we look up, that you did not tell us

Before the business calls you, we check the phone number you gave against the phone network's own records. It tells us whether the number is real and reachable, what kind of line it is, and the name the carrier has registered to it. Nothing else, once per booking, through Twilio Lookup, and never from anywhere but the carrier.

Why: a call booked on a number nobody answers costs the business its time, and a visit on one costs a trip across town. We would rather find that out before, and telling you we do it is part of doing it.

How long we keep it

Your booking stays while the business you booked with is a client of ours, so that both of you can look up what was agreed.
Ask us to delete it and we will, whenever you like. See below.
A call you book with us on expenety.com is deleted 24 months after the call: your name, number, email and answers go by themselves. The consent record is kept four years, as above.
Backups are the one thing that lags. Our host keeps a rolling thirty-day window we cannot reach into, so a deletion reaches the live record straight away and the last copy of a backup within thirty days.

Counting, not tracking

Pages count their own views: page, day, source. No identifier, no profile.
The short video page linked from your booking email measures how much of the video is played (the start, a quarter, half, three quarters, the end). Opened from that link, it is kept with your booking so we can tell whether the video helps. Nothing else about you is recorded there, and no cookie is set.
We use the Meta pixel so the ads that pay for this page can be measured. If you book, Meta is told a booking happened, keyed so it is not double-counted. See Meta's own privacy policy for what Meta does with its cookie.
Google's ad tag does the same for ads bought on Google. It is told the click and the fact of a booking, never your name, phone or email.

When a business connects its ad accounts

A business on the system connects its own Google Ads and Meta ad accounts. We sign in with Google for two things only: to read what the ads cost, and to send back whether a booked appointment actually happened.
What we take from Google is limited to spend, impressions, clicks and the ad's own name, by day and by ad. We do not read Gmail, Drive, contacts, or anything about a personal Google profile, and we never ask for permission to.
The sign-in credential is encrypted at rest and used only by this system. We do not sell it, pass it to anyone else, or use Google data to build advertising audiences or train models. No person at Expenety reads it except to support the business it belongs to, or where the law requires it.
A business can withdraw access at any time, from its own Google account or by asking us. When access ends we stop reading and delete the stored credential.
Expenety's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

When a business connects its calendar

A business on the system can connect its own Google Calendar, so the booking page never offers a time the owner has already given away, and so a booked call or visit lands on the owner's calendar by itself. We ask Google for three permissions and no more: to see whether a time is busy or free, to see the list of the owner's calendars (to find the main one), and to add, move and remove the calls and visits booked through this system.
From the busy-or-free check we keep only the times: the start and end of each busy block, for the next sixty days, refreshed as the calendar changes. We never read the title, the guests, the place or the notes of any event, and we never ask for permission to.
What we write to the calendar is only the calls and visits booked here: the customer's name, address and phone, at the booked time. We move or remove only the events this system created, and nothing else on the calendar, ever.
The sign-in credential is encrypted at rest under a key that lives outside the record, and used only by this system. We do not sell calendar data, pass it to anyone else, use it for advertising, or use it to train models. No person at Expenety reads it except to support the business it belongs to, or where the law requires it.
A business can disconnect at any time, from its own settings screen or from its Google account. When access ends we revoke the credential, delete it, and stop reading; the busy times we kept are deleted; the bookings already on the calendar stay, because they are the owner's.
Expenety's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

When a business asks a question about its own numbers

A business on the system can ask a plain question and get a plain answer about its own bookings. Most answers are worked out here, from the record, with no outside company involved.
Where a question needs a language model, the request goes to xAI Corp. in the United States. Every name, phone number, email address and street address is swapped for a placeholder before the request leaves us, and swapped back in the answer on this side. The model is never sent one. A test in our build fails if a real name or number ever reaches the request.
Under our contract with xAI they keep nothing after answering: the request is not stored and is not used to train their models.
The full list is on who else touches the data.

Whose it is

For businesses on the system: everything the system records about your business is yours, and it leaves with you when the engagement ends.
We do not sell or share booking data with anyone who is not needed to deliver the appointment. Every company that touches it is named on one page: who else touches the data. If we add one, that page changes first.
On a company's booking page we are its processor: we handle your details only to run that page, the emails and the count, and never for ourselves or for another company.
Once your booking reaches the office of the business you booked with, it is theirs. Asking us to delete something cannot reach their inbox, so ask them too. We would rather say that than let you assume otherwise.

For a call you book with us: the law we rely on

Why we may hold it. Your booking and the emails about it are steps you asked us to take before any agreement (GDPR Article 6(1)(b)). The phone check and the ad measurement rest on our legitimate interest in reaching real numbers and knowing which ads work (Article 6(1)(f)). You can object to either by email, and the button below stops the measurement.
Where it goes. The companies on who else touches the data are mostly in the United States, so your details are transferred there. We rely on the European Commission's standard contractual clauses in their data processing terms, or on the EU-US Data Privacy Framework.
Your rights. You can ask to see, correct or delete what we hold, to limit it, to object, or to take a copy with you. One email below does any of these.
Where to complain. If you think we got it wrong, you can complain to the Croatian data protection authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would rather hear it first.

Do not sell or share my personal information

We do not sell anything. We do share one thing: if you book, the ad platform that paid for the page is told a booking happened, so the ad can be measured. Several US states count that as sharing and give you the right to switch it off. Two ways, both of which we honour:

If your browser sends the Global Privacy Control signal, we already stop. Nothing loads and nothing is sent. You do not have to do anything.
Otherwise, use this button. It stops the measurement on this browser.

It sets one flag in this browser, so it applies here and not on your other devices. It changes nothing about a visit you have booked: you still get the confirmation and the reminder.

Do Not Track

Browsers can send a signal called Do Not Track. There is no agreed standard for what a site should do with it, so this site does not change what it does when the signal arrives. The Global Privacy Control signal above is the one we act on: with it on, nothing is shared.

Two other companies can recognise you across sites through this one: Meta, through its pixel, and Google, through its ad tag. Both are there to measure our ads, and the same two switches turn both off.

When this page changes

The date at the top changes with every edit. When a change matters, such as a new kind of detail we keep or a new use for it, a note at the top of this page says what changed, and a business on the system hears from us by email before it takes effect.

Your say

Want your details corrected or deleted, or want to know exactly what we hold about you? One email: lovro@expenety.com. We answer from the record, not from a form letter.