ExpertiseGrid, operated by Incedym Universal — last updated September 13, 2026 (draft)
Account information you provide at signup. For consultants, identity and, where relevant, professional-license verification documents — see Why we verify consultants. For clients, much lighter: email, and payment details when you book. We also collect session, messaging, and shared-document metadata needed to operate a booking, and standard technical data (device, browser, IP address) for security.
To create and secure your account; to run consultant verification as described in How consultant verification works; to operate scheduling, video sessions, document sharing, and payments; and to meet legal and regulatory obligations that apply to us.
Confirmed platform commitment: your personal and verification data is stored within your own country's region, matching the data protection law that applies to you. As ExpertiseGrid operates in more countries, each gets its own regional storage.
Confirmed pattern: verification data is retained while your account is active, plus a reasonable window after closure for disputes, then deleted automatically. Exact figures per country are still being finalized with legal input.
We share data only where necessary to run the marketplace: with the licensed payment processor that handles split payments, with the relevant professional-license registry when verifying a regulated consultant, and with law enforcement or regulators where legally required. We do not sell personal data, and documents shared during a session are visible only to the two participants in it.
Verification documents, session documents, and account credentials are encrypted at rest and in transit. Access is limited to what the automated pipeline and, where a case needs one, a human reviewer actually require.
Depending on where you're located, you generally have the right to access, correct, and request deletion of your personal data (subject to our retention obligations above), and to object to or restrict certain processing. See the regional section below for the specific rights and regulator where you are, and contact us to make a request.
We may update this policy as the platform evolves or as country-specific legal review is completed. We'll post the updated version here with a new "last updated" date.
Questions about this policy, or a request to exercise your rights, can be sent via Contact support.
Which law applies to you depends on where you're located. Where possible, we detect this automatically from your connection using Cloudflare's edge geolocation, based on your network's location — not your browser's language setting. Select your country below if it's wrong, or if nothing was detected.
Depending on your state of residence, applicable law may include the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable comprehensive privacy laws in states such as Virginia, Colorado, Connecticut, and Utah.
California residents specifically have the right to know what personal information is collected, request its deletion, correct inaccurate information, opt out of the sale or sharing of personal information (we do not sell personal information), and non-discrimination for exercising these rights.
Governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) federally, and applicable provincial privacy legislation. You have the right to access your personal information, request correction, and withdraw consent for further collection or use.
Complaints can be directed to the Office of the Privacy Commissioner of Canada.
Governed by the Digital Personal Data Protection Act (DPDP Act). You have the right to access a summary of your personal data and how it's being processed, request correction and erasure, and nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
Complaints can be directed to the Data Protection Board of India.
Governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the right to access personal information we hold about you and request correction of inaccurate information.
Complaints can be made to us directly, or to the Office of the Australian Information Commissioner (OAIC).
As an EU member state, governed by the General Data Protection Regulation (GDPR). You have the right to access, rectify, and erase your personal data, restrict or object to processing, and request data portability.
Complaints can be directed to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).
Governed by the Personal Data Protection Act (PDPA). You have the right to access and request correction of your personal data, and to withdraw consent for its collection, use, or disclosure.
Complaints can be directed to the Personal Data Protection Commission (PDPC).
Governed by the UK GDPR and the Data Protection Act 2018. You have the right to access, rectify, and erase your personal data, restrict or object to processing, and request data portability.
Complaints can be directed to the Information Commissioner's Office (ICO).
As an EU member state, governed by the General Data Protection Regulation (GDPR) — rights are the same as described for the Netherlands above.
Complaints can be directed to the Data Protection Commission (DPC).
Governed by the Privacy Act 2020. You have the right to access personal information we hold about you and request its correction, under the Act's Information Privacy Principles.
Complaints can be directed to the Office of the Privacy Commissioner.
Governed by the Protection of Personal Information Act (POPIA). You have the right to access, and request correction or deletion of, your personal information, and to object to processing.
Complaints can be directed to the Information Regulator of South Africa.
Powered by Incedym Universal