Privacy Policy

Xpert is operated by Xpert Networks Ltd. (“Xpert”, “we”), which is the data controller for the personal data described here. You can reach us about anything in this document at privacy@xpertmarketplace.co.

This policy covers xpertmarketplace.co and the booking, payment and session tooling behind it. It does not cover what an Xpert does with information you choose to tell them during a session; in that respect the Xpert is acting on their own account, and their own professional obligations apply.

We collect what the product needs to run and very little else. There is no advertising business here, and we do not buy or sell personal data.

Account details

Your name, email address and the timezone you set. The timezone is not incidental — every session time in the product is converted into it, so a wrong timezone is a missed session.

Booking records

Who booked whom, the start and end time, the duration, the price and platform fee as they stood at the moment of booking, the question you wrote for the Xpert, the session status, and any cancellation, refund or no-show attached to it.

Payment metadata

The identifiers Stripe gives us for a payment, a refund and, for Xperts, a connected payout account, plus amounts, currency and status. See section 4 for what we deliberately never receive.

Credential documents (Xperts only)

The licence, registration or qualification documents you upload so we can verify them, together with the issuing body, the reference number and the verification outcome. These files are private to you, our reviewers and, where required, the issuing body we check with.

Google Calendar access (Xperts who connect a calendar)

A Google refresh token, which lets us create the calendar event and Google Meet link for each booked session. It is encrypted before it is stored — see section 6.

Reviews

The rating and text you leave after a completed session, published with your display name against that Xpert.

Technical and operational records

Your authentication session, transactional email delivery outcomes, and server logs kept to keep the service working and to investigate abuse. We do not run behavioural analytics or advertising trackers.

Under the UK GDPR and the EU GDPR we have to have a lawful basis for each use. Ours are:

• Performance of a contract. Creating your account, holding a slot, taking payment, producing the session link, paying an Xpert out and handling cancellations and refunds. Without this data there is no booking to perform.
• Legitimate interests. Verifying credentials, preventing fraud and abuse, keeping the platform secure, resolving disputes between a client and an Xpert, and improving the product. Verification in particular is the interest that makes the marketplace worth using at all; we balance it against the applicant’s privacy by keeping the underlying documents out of every public view and logging each staff access to them.
• Legal obligation. Keeping financial and tax records of completed transactions, and responding to lawful requests.
• Consent. Marketing email, which is off by default and which you can switch on or off at any time in your account settings. Withdrawing it does not affect the transactional email a booking has to send you.

Payments are processed by Stripe. Your card details are entered into fields hosted by Stripe and are sent to Stripe directly. Xpert never receives or stores your full card number, and we could not retrieve it if we wanted to. What we hold is the metadata Stripe hands back: a payment identifier, the amount and currency, the status, and at most the card brand and last four digits that Stripe exposes for your own reference.

Xperts are paid through Stripe Connect. To pay you, Stripe collects identity and bank details from you directly under its own terms and does the identity checks that financial regulation requires. We see whether your account is ready to receive payouts and the payout records themselves, not the underlying documents.

Stripe is an independent controller for the data it collects in its own right.

If you apply to join the roster, we ask for documents evidencing the licence, registration or qualification you want to be verified against. We check them with the issuing body where the body offers a register or a confirmation route.

These files are the most sensitive thing on the platform, because they usually carry a licence number and other identifiers. They are stored in private storage, they are never exposed on your public profile, and no client ever sees them. What a client sees is the outcome: the credential type, the title, the issuing body and whether it was verified. Staff access to a credential file is logged.

Sessions run on Google Meet. When an Xpert connects their Google Calendar, Google gives us a refresh token so we can create the event and its Meet link for each confirmed booking and keep it in step if the booking changes.

A refresh token is a standing key to somebody’s real calendar, so it is never written to our database in plaintext. It is encrypted with AES-256-GCM using a key held outside the database, with a fresh initialisation vector per value and an authentication tag stored alongside, so tampering fails loudly rather than decrypting to something plausible. An Xpert can disconnect the calendar at any time, which revokes our access.

Google’s own privacy policy governs what Google does with the calendar event and the meeting itself, including anything recorded inside Meet by a participant. We do not record sessions.

We share personal data with the counterparty to your booking and with the processors that run the service. Nothing else.

The other side of a booking

An Xpert sees the name, session time and question of a client who books them. A client sees the Xpert’s public profile, verified credentials and session times. Because both of you are attendees on the calendar event for a confirmed session, each of you can see the other’s email address there; nothing else about either account is passed across.

Stripe

Payments, refunds and Xpert payouts, including Stripe Connect onboarding.

Google

Calendar events and Google Meet links for booked sessions.

Resend

Transactional email — booking confirmations, reminders, cancellations, refunds and payout notices.

Supabase

Database, authentication and file storage hosting.

Issuing bodies and registers

For Xperts only, to confirm that a credential you have submitted is genuine and current.

Professional advisers, authorities and successors

Where we are legally required to disclose, where we need to take or defend legal advice, or where the business is transferred — in which case this policy travels with the data.

We set first-party cookies to hold your authentication session — they are what keeps you signed in between pages, and they are strictly necessary for the service, so they are set without a consent banner. There are no advertising cookies, no third-party tracking pixels and no cross-site profiling on this platform.

Clearing these cookies, or blocking them, signs you out. Stripe and Google may set their own cookies on the pages and windows they host as part of paying for or joining a session; those are governed by their policies.

Account details

For as long as the account is open, and then as set out in section 12.

Booking and payment records

Retained for the statutory period that applies to financial and tax records — currently six years from the end of the relevant accounting period in the UK — because these are the records of a completed transaction, not preferences we can discard on request.

Credential documents

Kept while the listing is live, so that a verified badge can be substantiated, and for a limited period after it closes in case the verification is later challenged. Rejected applications are cleared once the appeal window has passed.

Google refresh tokens

Deleted when the calendar is disconnected or the account is closed.

Reviews

Retained after an account closes, detached from the reviewer’s name, because removing them would misrepresent an Xpert’s record.

Server and email logs

Short operational retention, then deleted.

Some of our processors — Stripe, Google, Resend and Supabase among them — operate outside the UK and the European Economic Area, including in the United States. Where personal data is transferred there, we rely on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one covers the recipient, and we expect the processor to apply technical measures appropriate to the data it is handling.

Subject to the usual legal limits, you can ask us to:

• Confirm what we hold about you and give you access to it.
• Correct anything inaccurate — your name, email and timezone you can change yourself in your account settings.
• Export your data in a portable, machine-readable form.
• Erase your data, within the retention limits in section 9.
• Restrict or object to a use we base on legitimate interests.
• Withdraw consent to marketing email, at any time, without giving a reason.

Write to privacy@xpertmarketplace.co and we will respond within one month. We may ask you to confirm you control the account before we act — an access request is also the most obvious way to attack one. If you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office in the UK, or to your local supervisory authority in the EEA.

A deletion request is submitted from your account settings, at /settings. You do not need to email anyone first.

What happens then:

• You submit the request from account settings, and we confirm it by email to the address on the account.
• We review it — chiefly to check there is no session still upcoming, no payment in flight, no payout held and no open dispute. If there is, we will tell you what has to settle first.
• On completion, your profile, your account details, any connected calendar token and, for an Xpert, the credential files we no longer need are deleted, and you are signed out permanently.
• Legally-required booking and tax records are retained for the statutory period even after the account is closed. This is the one part of a deletion request we cannot honour in full: the record that a particular sum was paid on a particular date is an accounting record we are obliged to keep. It is reduced to what the obligation needs and is not used for anything else.
• Reviews you left stay published, detached from your name.

Closing an Xpert listing does not cancel sessions clients have already paid for. Cancel or complete them first; if you close the listing with sessions outstanding, those sessions are cancelled and the clients refunded in full, which is treated as an Xpert cancellation under the Refund & Cancellation Policy.

Access to data is enforced in the database itself with row-level security, so a client can read their own bookings and nobody else’s regardless of what any page asks for. Money-bearing records are never written from a browser. Credential files sit in private storage with logged access. Google refresh tokens are encrypted before storage. Payment card data never reaches us at all.

No system is perfectly secure. If a breach affects your rights we will tell you and the relevant regulator within the time the law allows.

Xpert is for adults. You must be 18 or over to hold an account, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

We will update this policy as the product changes. The date at the top is the date of the current version. If a change materially affects how we use data you have already given us, we will email the address on your account rather than relying on you to re-read the page.

Privacy questions, access requests and complaints: privacy@xpertmarketplace.co. Everything else about these documents: legal@xpertmarketplace.co.