ExpertBridge is operated by Elevatexcel Consulting Private Limited, a company registered in India at Plot No. 361, Industrial Area, Phase 1, Chandigarh 160002, India ("ExpertBridge", "we", "us", "our").

We are the data controller for the personal data described in this policy.

For any question about this policy, or to exercise any of the rights in section 11, contact privacy@expertbridge.co.

ExpertBridge connects organisations ("Clients") that need specialist expertise with experienced professionals ("Experts"). A Client describes a requirement, we identify suitable Experts, and the two work together through our platform in scheduled video sessions, written exchanges, and on deliverables.

Two things about how we work shape everything below.

Confidentiality is built into the product, not added to it. Experts appear to Clients under an anonymised identifier rather than a name, unless the Expert chooses to be identified. Clients are not identified to Experts beyond a first name, unless the Client chooses otherwise. Expert profiles are not visible to anyone who is not signed in, and are not published to the open internet.

We use AI to assess Experts and to draft requirements. Section 6 explains both in full, including what is recorded, what is kept, who can see it, and your right to a human review.

3.1 If you are a Client

You give us:

• Your name and work email address. Registration requires a corporate email address; free webmail addresses are not accepted.
• Your organisation's name, your job title, your country, and your telephone number where you provide one.
• The requirement you describe, including the contents of any file you upload (we accept PDF, DOCX, JPG and PNG).
• Billing information. Card and bank details are entered directly with our payment providers and never reach our systems — see section 5.
• Anything you write in messages to Experts or to us.

We generate or observe:

• Records of your engagements: sessions booked, hours purchased and used, invoices, payments, wallet balance.
• Account and sign-in records, including one-time passcodes.
• Technical data: IP address, device and browser type, pages visited. See section 9.

3.2 If you are an Expert

You give us:

• Your name, email address, telephone number, country, and a profile photograph if you choose to provide one.
• Your CV or professional biography, work history, qualifications, areas of expertise, and any professional profile links you share.
• The details we need in order to pay you, which depending on your country may include bank account details, IFSC or routing codes, and tax identifiers such as PAN or GSTIN.
• Your availability, your proposed rates, and anything you write in messages.
• Your signature on our Expert Terms of Work, captured through our own e-signature system at sign.expertbridge.co.

We generate or observe:

• Your Atlas assessment, if you take one: the interview recording, its transcript, competency scores and the resulting report. See section 6.
• Records of engagements you take part in, hours logged, and payments made to you.
• The same account, sign-in and technical data described above.

3.3 If you are a website visitor

If you browse without registering, we collect only the technical data described in section 9. You can use the site without providing personal data, but you cannot engage an Expert without an account.

Where the UK or EU GDPR applies, we rely on the bases set out below.

Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object at any time — see section 11.

We do not sell personal data. We do not share it with advertisers or data brokers, and we do not use it for cross-context behavioural advertising.

We share it in these situations only.

Between Clients and Experts, as the service requires

A Client engaging an Expert sees that Expert's professional profile and, where one exists, their Atlas report and transcript. An Expert sees the Client's first name and whatever else the Client chooses to disclose during the engagement. Everything shared inside an engagement is subject to the confidentiality obligations in our Expert Terms of Work and our Terms of Service.

With service providers acting on our instructions

Each is bound by contract to process personal data only for the purposes we specify.

Our e-signature system is operated by us on our own infrastructure; signed documents are stored in our AWS account in India and are not sent to a third-party signature service.

Your mobile telephone number is never shared or sold to any third party for marketing purposes. We pass it only to the messaging provider named above, and only to deliver the service messages described in section 4.

Card numbers and full bank details are entered directly with the payment provider and are never stored on our systems.

Where the law requires it

In response to a court order, a lawful request from a public authority, or a tax obligation, or where we need to establish, exercise or defend a legal claim.

In a business transfer

If the business is sold, merged or reorganised, personal data may transfer with it. We will tell you before that happens.

6.1 The Atlas assessment — for Experts

What happens. Atlas conducts a structured interview, typically around fifteen minutes. Questions are generated from your CV and from your answers as the interview proceeds. The interview is recorded, transcribed, and scored against five competencies — technical depth, problem solving, communication, domain expertise and collaboration — producing a tier and a written report containing the scores, supporting quotations from your answers, and the full transcript.

Taking an assessment is optional. Experts who have not taken one can still be engaged, and are shown to Clients as manually screened rather than assessed.

What a Client sees. A Client evaluating you can read your full report and transcript. Your name is not shown; you appear under your ExpertBridge identifier. Transcripts do not carry your name — but they are linked to your profile in our systems and describe your own career, so we treat them as your personal data throughout, and every right in section 11 applies to them.

Automated decision-making, and your right to challenge it. The assessment result affects whether you are listed to Clients. This is the only place we use automated processing to reach a decision about you. You have the right to obtain human intervention, to express your point of view, and to contest the decision. Write to privacy@expertbridge.co and a person will review it.

Human oversight. Every Expert proposed to a Client is reviewed by a member of our team before the proposal is made. The assessment informs that decision; it does not make it.

What we keep, and for how long.

• Interview recordings are deleted automatically within 60 days, and usually sooner.
• Transcripts, scores and reports are kept while your Expert profile remains active on the platform, and are deleted when it is closed.

6.2 The requirement-drafting tool — for Clients

When you type a one-line description of what you need, we send it to the same AI service to draft a fuller engagement brief, which you then edit. The text you enter and the draft produced are processed for that purpose only.

6.3 About the AI service

Both features run on the Microsoft Azure OpenAI Service, using OpenAI GPT models hosted by Microsoft. We select the specific model from time to time as models are updated or retired; all are GPT models on Azure.

Microsoft processes this data as our processor under contract. Your data is not used to train or improve any AI model, and is not shared with OpenAI. Microsoft's terms for this service prohibit both.

We are based in India and our platform is hosted in India. If you are in the United Kingdom, the European Economic Area, or another region with data transfer rules, your personal data will be transferred to and processed in India, and in some cases in the United States where a provider listed in section 5 is located there.

India is not the subject of an adequacy decision by the European Commission or the UK Government. Where we transfer personal data out of the UK or EEA, we rely on:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where the UK GDPR applies; together with
• supplementary technical and organisational measures, including encryption in transit and at rest, access controls limiting who can reach your data, and the confidentiality obligations described in section 2.

You may request a copy of the transfer mechanism we rely on by writing to privacy@expertbridge.co.

Our representative in the EU and the UK

Article 27 of the EU and UK GDPR requires organisations outside those regions to appoint a local representative where they regularly offer goods or services to people there. Article 27(2) exempts processing that is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to people's rights.

We have assessed our position and rely on that exemption at present: our processing of EEA and UK personal data is occasional, we do not process special categories of data, and we do not use personal data for advertising, profiling or any purpose beyond delivering an engagement you have asked for.

We will appoint representatives in the EU and the UK, and name them here, once we are engaged by clients in those regions on a regular basis. Until then, you can reach us directly at privacy@expertbridge.co, and we will respond within the timeframes set out in section 11.

You can also complain to your national supervisory authority at any time:

• European Economic Area — the authority in your country, listed at edpb.europa.eu
• United Kingdom — the Information Commissioner's Office, ico.org.uk

When we no longer need personal data, we delete it or anonymise it so that it can no longer identify you.

Strictly necessary cookies

These keep you signed in, hold your session, and protect the site against automated abuse through Google reCAPTCHA. They cannot be switched off without breaking the service, and they do not require your consent.

Analytics and advertising cookies

We do not currently run analytics or advertising cookies. If we introduce them, we will not set them until you have given consent through the cookie banner, and this policy will be updated to list them before they are used.

Your choices

Where we use non-essential cookies, the banner on our site lets you accept them or reject them. Rejecting is as easy as accepting, and you can change your choice at any time through the cookie settings link in the footer. You can also block or delete cookies in your browser settings, though blocking the necessary cookies will prevent you from signing in.

We hold personal data on infrastructure we control, with encryption in transit and at rest, access restricted to staff who need it for their role, multi-factor authentication on administrative access, and logging of access to production systems. Passwords are stored only as salted hashes and are never readable by us or anyone else. Nightly backups are taken and verified.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within the time the law requires, and will tell you where the law requires it.

Depending on where you live you have some or all of the following rights. We make them available to everyone who uses ExpertBridge, wherever you are, except where the law requires us to keep the data.

• Access — a copy of the personal data we hold about you
• Rectification — correction of anything inaccurate or incomplete
• Erasure — deletion, where we have no continuing legal or contractual need to keep it
• Restriction — to have us pause processing while a dispute is resolved
• Objection — to processing based on our legitimate interests, and to direct marketing at any time
• Portability — a copy of the data you gave us, in a structured machine-readable format
• Withdrawal of consent — where we rely on consent, without affecting processing carried out before you withdrew it
• Human review of an automated decision — see section 6.1
• Complaint — to your data protection authority

To exercise any of these, write to privacy@expertbridge.co. We respond within 30 days and will tell you if we need longer. We may ask you to verify your identity first, so that we do not disclose your data to someone else.

If you are in the EEA or the UK

All of the rights listed above apply to you. You may complain to your national supervisory authority at any time — in the EEA, the authority in your country, listed at edpb.europa.eu; in the UK, the Information Commissioner's Office at ico.org.uk. We would rather hear from you first, at privacy@expertbridge.co, so that we have the chance to put things right.

See section 7 for our position on an Article 27 representative.

If you are a United States resident

State privacy laws in California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas and other states give residents rights over their personal data. Where those laws apply to you, you have the right to know what we collect and disclose, to access a copy, to correct inaccuracies, to request deletion, to opt out of any sale, sharing or targeted advertising, and not to be treated differently for exercising those rights.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We have not done so in the preceding twelve months. There is therefore nothing to opt out of, but if that ever changes we will say so here before it happens and provide an opt-out mechanism.

Categories we collect, using the terms these laws use: identifiers (name, email address, IP address); customer records (telephone number, billing details); commercial information (engagements booked and hours used); professional and employment information (work history, qualifications, CV); audio recordings and transcripts (Atlas assessments, and session recordings where made); and internet activity (pages visited on our site).

We do not conduct profiling for advertising purposes. The only automated decision-making we carry out is the Atlas assessment described in section 6.1, which applies to Experts and carries a right to human review.

Authorised agents. You may use an authorised agent to make a request on your behalf. We will ask for either a valid power of attorney, or a signed letter from you naming the agent and authorising the request, and we may contact you directly to confirm.

Appeals. If we refuse a request, you may appeal by replying to our response. We will review the appeal and give you a written decision with our reasons. If we refuse the appeal, we will tell you how to complain to your state attorney general.

Nevada residents may ask us not to sell their personal data. We do not sell personal data, but you may submit a request to privacy@expertbridge.co.

If you are in India

The Digital Personal Data Protection Act 2023 gives you rights of access, correction, erasure, grievance redressal and nomination. Our Grievance Officer can be reached at privacy@expertbridge.co and will respond within the statutory period.

ExpertBridge is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to privacy@expertbridge.co and we will delete it.

Our site links to websites we do not control. This policy does not cover them. Read their privacy policies before giving them your data.

We may update this policy as the service develops or the law changes. The revised version will be posted here with a new date at the top, and where a change is significant we will tell you by email or through the platform before it takes effect.