Privacy Policy

0. Roles (Controller/Processor)

If you use the Service on behalf of an organization, your organization is typically the "controller" (or equivalent) for User Content containing personal data, and Expertand is a "processor" (or equivalent) acting on your instructions. For account/admin and billing data, Expertand is typically the controller. Where required, processing terms are addressed in our DPA.

1. Information We Collect

1.1 Information You Provide

We collect information you directly provide to us, including:

• Account Information: Name, email address, password, and organization details when you create an account
• User Content: Documents, files, text, images, and other materials you upload to create context for AI tools
• Tool Configurations: Prompts, rules, workflows, and settings for AI tools you create
• Communications: Messages, feedback, and support requests you send to us
• Payment Information: Billing details processed through our third-party payment processors

We may also collect profile or workspace metadata you choose to provide (e.g., display name, team name, avatar).

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage Data: Features used, actions taken, timestamps, and interaction patterns
• Device Information: Browser type, operating system, device identifiers, and IP address
• Log Data: Server logs, error reports, and performance metrics
• Cookies and Similar Technologies: Information collected through cookies, pixels, and similar tracking technologies

Cookies. We use cookies for authentication, security, and basic analytics. Where required by law, we provide a cookie notice/consent mechanism. You can control cookies through your browser settings, but disabling cookies may affect functionality.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your transactions and manage your account
• Enable AI functionality by transmitting your inputs and context to AI providers
• Improve our prompts, AI tool configurations, and service quality
• Facilitate sharing and collaboration features you enable
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraud and security issues
• Comply with legal obligations

Service Improvement. We may use aggregated and de-identified usage data to improve reliability, safety, and performance. We will use User Content to improve the Service only as described in the Terms, your settings, and (if applicable) an Order Form or DPA.

3. Third-Party AI Providers

The Service uses AI models from third-party providers to deliver AI functionality. When you use AI features:

• Your inputs, prompts, and context materials may be transmitted to OpenAI, Anthropic, or Google
• These providers process your data to generate AI outputs
• Data handling by these providers is subject to their respective privacy policies and terms

We have agreements with our AI providers to help protect your data. However, provider practices may vary by provider, plan, region, and API configuration. We encourage you to review their privacy practices:

• OpenAI: openai.com/privacy
• Anthropic: anthropic.com/privacy
• Google: policies.google.com/privacy

You should not submit sensitive personal information or regulated data unless we have expressly agreed in writing to support such processing.

4. How We Share Your Information

We may share your information in the following circumstances:

• With Your Consent: When you authorize us to share information with third parties
• Collaborators and Reviewers: With users you designate as collaborators, experts, or reviewers for your tools and content
• Service Providers: With vendors who perform services on our behalf (hosting, analytics, payment processing)
• AI Providers: With third-party AI providers to enable AI functionality as described in Section 3
• Legal Requirements: When required by law, legal process, or government request
• Protection of Rights: To protect the rights, property, or safety of Expertand, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

We do not "share" personal information for cross-context behavioral advertising unless we explicitly disclose it and provide any legally required choice mechanisms.

5. Data Storage and Security

5.1 Data Storage

Your data is stored on cloud infrastructure provided by Supabase and Cloudflare, with servers located in the United States. We implement appropriate technical and organizational measures to protect your data.

5.2 Security Measures

We use industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Secure development practices

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Security Incidents. If we become aware of a security incident affecting personal information, we will take reasonable steps to investigate and mitigate it and will provide notifications as required by applicable law and/or an applicable DPA.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may also retain information to:

• Comply with legal obligations
• Resolve disputes and enforce agreements
• Improve our services and develop new features
• Maintain security and prevent fraud

When you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, except where retention is required by law or for legitimate business purposes.

Backups. Deletions from active systems may not immediately remove information from backups. We retain backups for a limited period consistent with our security and business continuity practices, after which the information is overwritten or deleted.

Shared Content. If you shared content with other users, deletion by you may not delete copies retained by recipients.

7. Your Rights and Choices

7.1 Access and Control

You can:

• Access and update your account information through your account settings
• Delete your User Content through the Service
• Request a copy of your data by contacting us
• Delete your account at any time
• Opt out of promotional communications

Requests. We may need to verify your identity before fulfilling certain requests. We will respond within the timeframes required by applicable law.

7.2 Cookies

Most browsers allow you to control cookies through settings. Note that disabling cookies may affect the functionality of the Service.

8. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission for international data transfers.

If required, additional transfer impact and supplementary measures may be implemented consistent with applicable law.

9. Rights for EEA, UK, and Swiss Users

If you are located in the EEA, UK, or Switzerland, you have additional rights under applicable data protection laws, including the right to:

• Access your personal data
• Rectify inaccurate personal data
• Request erasure of your personal data
• Object to processing of your personal data
• Request restriction of processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise these rights, please contact us using the information in Section 13.

If you believe we process your personal data based on legitimate interests, you may object as provided by applicable law.

10. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect, use, and disclose
• The right to delete personal information
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at privacy@expertand.com.

If we ever "share" personal information for cross-context behavioral advertising (as defined by California law), we will provide a right to opt out as required.

11. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

The Service is not directed to children under 13. If you believe a child under 13 has provided personal information, contact us and we will take appropriate steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on our website and updating the "Effective Date" at the top of this policy. Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

For material changes, we may also provide additional notice (such as email or in-product notice) where appropriate.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

More Better Ventures LLC
d/b/a Expertand
Email: privacy@expertand.com
Website: expertand.com

For data protection inquiries in the EU, you may also contact us at: dpo@expertand.com

Appendix: Data Processing Summary

Clarification: "Service improvement" refers to aggregated/de-identified usage analytics and improvements within your workspace/settings, unless otherwise agreed in an Order Form or DPA.

Provider processing for AI generation is described in Section 3.