Privacy Policy

ExpertMatch holds data about two groups, and the rules differ for each:

• Clients — people at a firm who hold an ExpertMatch seat, plus anyone who submits the access request form.
• Experts — practitioners we identify from public sources and contact about a paid consultation, whether or not they reply.

If you are an expert and you only want to stop hearing from us, skip to section 08.

• Identity and account. Your name, work email address, firm name, job title if you give one, time zone, and your role and status within your organization’s account.
• Payment. A card, entered directly into Stripe’s form. ExpertMatch never receives or stores your card number. We hold a Stripe reference to it, plus the billing history — what was charged, when, and for which call.
• Your briefs. The research questions, sectors, geographies and context you submit, and the notes you add to a project. These are often deal-adjacent, so treat them the way you would treat any working document — and see section 06 on how long we keep them.
• Availability. If you connect Google Calendar, free/busy blocks only. If you paste a Calendly link, the open slots it exposes. If you enter windows by hand, those windows.
• Messages. What you write to an expert through the platform, and what comes back.
• Access requests. If you fill in the access form, the name, firm, work email and description of what you are researching that you enter. We use it to decide on access and to contact you about it.
• Technical. Session cookies (needed to keep you signed in) and standard server logs including IP address. We do not run advertising trackers or third-party analytics.

We contact experts who did not sign up for anything, so this section is deliberately specific.

• Public professional information. Name, current and previous roles, employer, seniority, and the public web pages that evidence them. This is gathered from publicly available sources.
• A business email address. Found and verified through professional contact data providers so we can send one outreach message. We do not buy or store home addresses, personal phone numbers, or personal email addresses for this purpose.
• Message content. The emails we send an expert and the replies they send back, including anything they tell us about conflicts, restrictions, availability, and rate.
• Engagement and payment. For experts who take a call: the call record, and the payout details they provide directly to Stripe Connect. We do not hold their bank details.
• Opt-out record. If an expert opts out or declines, we keep their email address on a suppression list precisely so that we do not contact them again.

Our basis for the initial outreach is our legitimate interest in offering a paid professional engagement to someone whose public professional background fits it. Every outreach email carries a one-click opt-out and our postal address.

• Running the service: sourcing candidates, contacting experts, scheduling, hosting the call, and billing it.
• Screening messages in both directions so identities and contact details do not cross before a call is scheduled.
• Keeping the platform secure — rate limiting, abuse prevention, and fraud checks.
• Support, and telling you about changes to the service or these terms.
• Meeting legal, tax, and accounting obligations.

We do not sell personal data, and we do not share it with anyone for their own advertising.

We use the companies below to run the service. Each receives only what its job needs.

Beyond these, we share personal data only when the law requires it, or when it is needed to establish or defend a legal claim. If ExpertMatch is ever acquired or merged, data may transfer with the business; you would be told before that happened.

Clients and experts see each other only through the platform, and only what the platform reveals: an expert’s identity is withheld from the client until a call is scheduled, and an expert is never told the client firm’s name before that point.

• Account and organization records — for as long as the account is open, then 12 months before deletion.
• Briefs, projects, and messages — for the life of the account, so your team can go back to earlier work. Tell us and we will delete a specific project.
• Billing records — kept for as long as tax and accounting law requires, which is longer than the account itself.
• Expert records — kept while the engagement is live and afterwards as part of the call and payment record. Candidates we contacted who never replied are deleted 24 months after the last message.
• Opt-out list — kept indefinitely. This is the one record we will not delete on request, because deleting it is what would cause us to contact you again.
• Caches, rate-limit counters, and short-lived tokens — minutes to hours, then they expire automatically.

Access to client data is scoped per organization and enforced in the database, not just in the interface. Card details go directly to Stripe and never touch our servers. Credentials and provider tokens are stored encrypted. Internal tools are restricted to platform administrators.

We do not currently hold a SOC 2 report or any other third-party security certification, and we will not claim one until we do.

Every email we send an expert ends with a one-click opt-out link and our postal address. Following that link adds your address to a permanent do-not-contact list immediately — you do not need to sign in, reply, or confirm anything, and the link is specific to your address so nobody else can use it.

Replying to say you are not interested has the same effect: a decline puts the address on the same list.

Once an address is on that list, ExpertMatch will not contact it again for any client.

Whether you are a client or an expert, you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, or stop using it for outreach. Depending on where you live you may also have the right to object to processing or to complain to your local data protection authority.

Send the request to ashergoldsteinbusiness@gmail.com. We will respond within 30 days. We may need to verify who you are first, particularly for a deletion request.

Two limits worth naming up front: we cannot delete billing records the law requires us to keep, and we will not delete the opt-out list (section 08).

We set a session cookie when you sign in, and cookies needed to carry you safely through sign-in and calendar connection. That is all — no advertising cookies, no third-party analytics, no cross-site tracking. There is nothing here to opt out of, so we do not show a cookie banner.

ExpertMatch and the companies in section 05 are based in the United States, and data is processed there. If you are in the UK or EU, your data will be transferred to the US. Transfers from the UK or EU rely on standard contractual clauses with each processor.

ExpertMatch is a business product. It is not for anyone under 18, and we do not knowingly collect data about children.

If we change this policy materially, we will email account holders before it takes effect. The effective date at the top of the page always reflects the current version.

Privacy questions, rights requests, and complaints go to ashergoldsteinbusiness@gmail.com, or by post to 4502 Mayflower Hill, Waterville, ME 04901.