Account details
Your name, work email, organization, role, billing details, and authentication records help us create and manage an account.
Policy / 01
Privacy is part of the message.
Your trust is built on transparency. This policy explains how Xpress Link LLC collects, uses, protects, and retains information when you use our secure messaging services.
Effective date: June 1, 2025
A clear record
The short version: we use account and service data to operate messaging, keep systems safe, and answer support requests. We do not sell personal information or use message content for advertising.
01 / Scope
Our Commitment to Your Privacy
This secure messaging privacy policy applies to the websites, accounts, support channels, and messaging services operated by Xpress Link LLC from Allentown, Pennsylvania. It covers information submitted by individuals and organizations, including clients in healthcare, legal, financial, and other regulated fields.
Our controls are designed with HIPAA-conscious privacy, GDPR, and CCPA requirements in mind where those rules apply. A Business Associate Agreement is available for eligible healthcare relationships. Specific contract terms control when they provide stronger protection.
HIPAA BAA available
GDPR-aware controls
CCPA rights supported
02 / Inputs
What Data We Collect and Why
We collect what the service needs. Nothing extra for its own sake.
Message metadata
We record timestamps, delivery events, sender and recipient identifiers, and routing details. Metadata helps deliver messages and investigate faults.
Device signals
Browser, device, IP, login, and usage events help us spot unusual access and improve service performance. We keep this collection limited.
03 / Purpose
How Your Data Is Used—And Not Used
Service first. Advertising never.
Service delivery and support
We route messages, maintain accounts, respond to support cases, process billing, and communicate about service operations.
Security and compliance
We review access events, monitor system health, test controls, and keep records needed for legal, audit, and incident-response duties.
Boundaries we keep
Xpress Link LLC does not sell personal information, build advertising profiles, or use message content to target ads. Legal and financial data privacy requires that line to stay firm.
04 / Protection
How We Protect Your Data
Security controls have to work on ordinary days and during a serious incident. We test them, record access, and assign ownership.
CONTROL 01
Encryption in transit and at rest
TLS 1.3 protects connections. AES-256 protects stored data. Message content is isolated from routine analytics and advertising systems.
CONTROL 02
Restricted access
Role-based permissions, authentication safeguards, and audit logs limit who can reach operational data. Access is reviewed against job need.
CONTROL 03
Incident response
We investigate suspected incidents, contain affected systems, preserve records, and notify customers and authorities when applicable law requires it.
05 / Lifecycle
When We Share and How Long We Keep Data
Retention follows purpose and duty. It doesn't drift forever.
| Data area | Why it may be shared | Retention approach |
|---|---|---|
| Service operations | Vetted subprocessors may process hosting, delivery, support, or billing data under written safeguards. | Kept while needed for the service and contractual records, then reviewed for deletion. |
| Regulated records | Information may be disclosed when a valid legal request or regulatory obligation applies. | Held for the period required by the applicable contract, law, or industry rule. |
| Deletion requests | Account owners can ask us to remove eligible personal information through support. | We verify the requester, assess exceptions, and confirm the result within a reasonable operational period. |
Our subprocessors are assessed for security and compliance fit. A current list can be requested through [email protected].
06 / Control
Your Rights and Choices
You can ask to see, correct, delete, or move eligible personal information. Start with a written request.
-
Access: ask what personal information we hold and how it is used.
-
Correction: tell us when account information is inaccurate or incomplete.
-
Deletion and portability: request removal or a usable copy where the law permits.
-
Communications: opt out of non-essential messages. Service and security notices still need to reach you.
For questions or a rights request, contact our Data Protection Officer at [email protected].
07 / Record
Changes to This Policy
We may revise this policy when our services, contracts, or legal duties change. The revised version will show a new effective date.
Material changes will be communicated by email or an in-app banner before they take effect when practical. Earlier versions remain available in our policy records.
PRIVACY QUESTIONS
Send a clear request to the Data Protection Officer.