Privacy Policy

Catontech Management Systems LLC · Effective 2026-10-20

Expositus™ is the door access and member software at expositus.net, provided by Catontech Management Systems LLC ("Catontech", "we") to gyms, apartment and office buildings and other organizations (each an "Organization"). This policy explains what information Expositus keeps about you, why, who sees it, how long it is kept, and how to have it corrected or deleted.

Your Organization decides what it collects about you and how it uses it. Catontech keeps and handles that information for your Organization, under its instructions and this policy. Your Organization's own privacy practices also apply; ask it about them.

1. What we keep

• Your details: your name and, when your Organization asks for them, your birth date, gender, address, phone numbers, email, emergency contact, and any other fields your Organization adds. The same for household members you sign up.
• Your membership or access: your plan, its price and dates, renewal requests, and notes your Organization's staff keep.
• Sign-up records: the documents you agreed to and their exact versions, your signature and typed name, the time, and the internet address and browser you signed from. Proof you upload for a discount, such as a photo of a badge or card, is stored encrypted.
• Identity documents: if your Organization records an ID number, it is stored encrypted and shown to staff only as its last digits.
• Door access: each time your card, fob or phone pass is used, which door, when, and whether it opened. Your phone keeps the secret it uses to draw your door pass.
• Signing in: your password (only as a one-way scrambled form we cannot read back), sign-in times, and the internet address and device used.
• Payments: when your Organization takes payments online, they are made on Stripe's secure page. We receive whether a payment succeeded, its amount and date, and may receive the card type and last four digits. We never receive or keep your full card number, security code or bank account number.

2. Why we keep it

To run Expositus for your Organization: to open its doors for the right people at the right times, show your door pass, keep your membership and its records, take payments through Stripe, send you emails about your account (such as set-up links and copies of what you signed), keep the service and its doors secure, provide support, and meet legal obligations. We do not sell your information, use it for advertising, or let others use it for their own marketing.

3. Who sees it

• Your Organization: its staff see and manage what is kept about you.
• Catontech: our staff see it only to run, secure and support the service.
• Service providers working for us under contract: SendGrid (Twilio) sends our emails, Stripe processes online payments, and our hosting providers in the United States run the servers.
• When the law requires it: for example a court order, or to protect someone's safety.
• If Catontech's business is sold or merged: the buyer, under this policy.

4. Cookies and your phone

expositus.net uses only the cookies it needs to work: one that keeps you signed in while you use the site, and, if you choose "Keep me signed in", one that keeps you signed in on that device for 7 days from your last visit. Your browser also keeps your door pass and your name, so the pass works at a door with no signal. There are no advertising, tracking or analytics cookies. Signing out removes the sign-in cookies.

5. How long it is kept

While you are a member, tenant or otherwise have access, and for 7 years after your membership or access ends, so your Organization keeps a record of what was agreed, signed and paid. After that it is deleted or made anonymous. Your Organization may delete information sooner. Copies in our backups are replaced as the backups are renewed.

6. How it is protected

Connections to expositus.net are encrypted. Passwords are stored only in scrambled form. ID numbers and uploaded proof are encrypted with a key kept for each Organization. Staff access is limited to the people who need it, and each time uploaded proof is opened, it is logged. No system is perfectly secure; if a breach affects your information, you will be told as the law requires.

7. Seeing, correcting or deleting your information

You can see and update your contact details in My account on expositus.net, and read what you signed there. For anything else, including a copy of your information, a correction, or deletion, ask your Organization first: it holds your records and decides what it must keep. If you cannot reach it, or it does not answer, email support@catontech.com and we will help. Some information may have to be kept for the period above, for example a signed agreement, or to meet the law.

8. Children

Expositus is not meant for children to use on their own. Information about a child under 13 is only entered by a parent or guardian, for example when signing up a household, or by the Organization's staff. A parent or guardian can ask the Organization, or us, to see or delete it.

9. Changes

We will post any change here with a new effective date. If a change is significant, you will be told when you next sign in.

10. Contact

Catontech Management Systems LLC · support@catontech.com