This policy explains what Experly collects, why, who else sees it, and what you can do about it. It covers experts, clients and visitors.
Experly is operated by a company registered in Wyoming, United States. For people in the European Economic Area and the United Kingdom, Experly is the data controller for the personal data described here.
Contact us about anything in this policy at privacy@experly.io.
1. The short version
- We collect what we need to run the service: your account details, what experts upload, what clients answer, and payment information handled by Stripe.
- Expert material and client questionnaire answers are sent to third-party providers to produce programs. Those providers are named in section 5. This is the disclosure most people most want, so it is near the top.
- We do not sell your personal information.
- Your data is stored in the United States.
- You can access, correct, export and delete your data. Section 9 explains how.
2. What we collect
2.1 Account and profile
Name, email address, password (stored hashed, never in readable form), and if you sign in with Google, the name, email and profile image Google gives us. Experts additionally provide a public display name, biography, profile image, category, website, professional email and any credentials or links submitted for verification.
2.2 Expert Content
Documents, video, audio, transcripts, images, connected video channels, questionnaires and profile material that experts upload or link.
2.3 Client questionnaire answers and progress
The answers a client gives to an expert's questionnaire, plus lesson completions, reflections, journal entries, uploaded deliverables and progress through a program.
Please read this if you use a health, fitness, nutrition or mental wellbeing category. Questions in those categories may invite you to describe your health, diet, symptoms or state of mind. Where those answers reveal health information they are special category data under UK and EU law. We process them only to produce your program, make it available to the expert you chose, and evaluate the quality of that program (section 6), and only on the basis of your explicit consent, which you give by submitting the questionnaire. You can withdraw that consent by deleting your answers or your account. Please do not enter more detail than your expert needs.
2.4 Payment information
Payments are processed by Stripe. We do not receive or store full card numbers. We receive and store the fact of a transaction, amounts, status, and Stripe identifiers. Experts who receive payouts provide identity and bank details directly to Stripe under Stripe's own agreement; we do not hold them.
2.5 Technical and usage data
IP address, browser and device information, pages viewed, referring page, approximate location derived from IP, and diagnostic logs. Some of this is collected by cookies and similar technologies; see our Cookie Policy.
2.6 Communications
Messages you send us, support requests, and records of the emails we send you and whether they were delivered.
2.7 Consent records
When you make a cookie choice or accept our terms we record the choice, when it was made, and the version accepted, so we can demonstrate it. Cookie consent records are keyed to a random identifier, not your IP address.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (UK/EU) |
|---|---|---|
| Create and run your account | To provide the service | Performance of a contract |
| Produce programs from expert material and client answers | Core function of the service | Performance of a contract; explicit consent for health-related answers |
| Evaluate and improve the quality of generated programs | To check that programs are accurate, well structured and personalised, and to fix problems in how they are produced | Legitimate interests; explicit consent for health-related answers |
| Take payment and pay experts | To complete transactions | Performance of a contract |
| Send service and transactional email | To operate your account | Performance of a contract |
| Send marketing email | To tell you about Experly | Consent, withdrawable at any time |
| Analytics and product improvement | To understand and improve use | Consent, where cookies are used |
| Verify experts, review content, handle takedowns | Trust, safety, legal obligations | Legitimate interests; legal obligation |
| Security, fraud prevention, abuse detection | To protect the service and its users | Legitimate interests |
| Keep records of consent and terms acceptance | To demonstrate compliance | Legal obligation |
Where we rely on legitimate interests, we have considered the effect on you and you may object (section 9).
4. Who can see what
Your expert sees your questionnaire answers, your progress and anything you submit within a program. That is how the service works. Do not enter anything you are not willing to share with them.
Clients see the expert's public profile and the program delivered to them. They do not see the expert's underlying uploaded material.
Experts do not see other experts' content. Expert Content is isolated per expert.
Public pages. An expert's public profile and published program listings are visible to anyone, including search engines. Experts choose what goes there.
Experly personnel. Our quality and analytics dashboards show scores, issue types, counts and costs, not program text or questionnaire answers. A limited number of authorised personnel can access content, including through AI tools operated on our behalf, only where needed to evaluate a specific program's quality, provide support you ask for, investigate security or abuse, enforce our terms, or meet legal obligations. They are bound by confidentiality.
5. Service providers who process your data
We use the providers below. All are located in the United States unless noted. This list is current as of the effective date; we update it when it changes.
| Provider | What it processes | Purpose |
|---|---|---|
| Supabase | Account data, questionnaire answers, programs, files | Database, authentication, storage |
| Vercel | Request data, IP address, logs | Hosting, security filtering |
| Amazon Web Services | Uploaded files, video, generated program data | Storage, processing pipeline, video encoding |
| Google (Gemini) | Expert Content and client questionnaire answers | Automated program generation, transcription, image analysis, automated quality evaluation of programs |
| OpenAI | Same categories of content | Automated generation, text embeddings |
| Anthropic (Claude) | Same categories of content | Automated generation; automated quality evaluation of programs, including through Claude tools used by authorised Experly personnel |
| OpenRouter | Same categories of content | Routing requests to model providers |
| HeyGen | Script text, avatar and voice identifiers | Avatar video generation, where an expert uses it |
| Stripe | Name, email, payment and payout details | Payments, subscriptions, expert payouts |
| Resend | Email address, message content | Sending email |
| Google Analytics | Usage, device, approximate location | Site analytics, only with your consent |
| Google OAuth | Name, email, profile image | Optional sign-in |
| YouTube Data API | Expert's own channel and video identifiers | Importing an expert's own video content |
| Calendly | Name, email, scheduling details | Booking one-on-one time |
| Apify | Publicly available web content | Expert verification |
We require providers to protect your data and to use it only to provide their service to us. We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under US state privacy laws.
6. Automated processing
Programs are produced by automated systems, using the providers named above. Expert material and client answers are transmitted to them for that purpose.
Output is generated automatically and is reviewed and approved by your expert before it reaches you. No decision producing a legal or similarly significant effect about you is made by automated means alone.
Quality evaluation. After a program is produced we may evaluate it with automated tools and with the providers above, to score its quality and find problems in how programs are produced. The result is a set of scores and issue types tied to lesson positions. It does not change your program, is not shown to you or anyone outside Experly, and is not used to make decisions about you. We do not use your content or answers to train AI models.
7. International transfers
Your data is stored and processed in the United States. Our infrastructure runs in US East (Virginia and Ohio) and US West (Oregon).
If you are in the EEA, UK or Switzerland, this is a transfer outside your region. We rely on Standard Contractual Clauses and equivalent safeguards with our providers. You can request details of the safeguards that apply by writing to privacy@experly.io.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is open, then deleted or anonymised within 90 days of closure |
| Expert Content | Until you delete it or close your account, then removed from live systems within 90 days |
| Programs delivered to clients | For the period the client has access, then per the client's own account |
| Questionnaire answers | With the program they produced, subject to the above |
| Payment and transaction records | Up to 7 years, to meet tax and accounting obligations |
| Consent and terms-acceptance records | 3 years from the date given |
| Security and access logs | Up to 12 months |
| Program quality records (scores, issue types, lesson positions, processing costs and content fingerprints; no program text or questionnaire answers) | Kept after the program is deleted, so we can track quality over time. Linked to an expert's account until the account is closed, then de-identified within 90 days. |
| Backups | Removed on the ordinary backup cycle, within 90 days |
9. Your rights
Wherever you live, you can ask us to:
- access the personal data we hold about you,
- correct it if it is wrong,
- delete it,
- export it in a portable format,
- object to or restrict processing based on legitimate interests,
- withdraw consent at any time, including for marketing and cookies.
Email privacy@experly.io. We will respond within 30 days, or sooner where the law requires. We will not treat you differently for exercising a right.
If you are in the EEA or UK, you may complain to your local supervisory authority. If you are in California or another US state with a privacy law, you have rights to know, delete, correct and opt out of sale or sharing; we do not sell or share as defined by those laws, and we honour the Global Privacy Control browser signal as a valid opt-out. If you are in Canada, you may complain to the Office of the Privacy Commissioner, or to the Commission d'accès à l'information if you are in Quebec.
Account deletion is also available directly in your settings.
10. Security
We protect your data with measures including:
- AES-256-GCM encryption of uploaded expert content at rest,
- encryption in transit using TLS, with HTTP Strict Transport Security,
- row-level security on every database table, so accounts can only reach their own records,
- private file storage with public access blocked at the bucket level,
- a Content Security Policy and other protective response headers,
- restricted internal access and audit logging of administrative actions.
No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant regulator where the law requires, without undue delay.
We do not currently hold SOC 2, ISO 27001 or HIPAA certification, and Experly is not a HIPAA-covered entity. Do not use Experly to process protected health information in a regulated capacity.
11. Children
Experly is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@experly.io and we will delete it.
12. Changes
We may update this policy. When changes are material we will give notice by email or in the product before they take effect. The effective date and version are at the top, and we keep previous versions available.
13. Contact
Experly Privacy: privacy@experly.io Security: security@experly.io General: support@experly.io