legal

Privacy Policy

Effective 2026-08-19 · expertovod.com

What we process, why, and where it goes — written to be read. The short version: minimal data, no tracking, no selling, AI processing disclosed plainly, and experts never see who you are.

1. Who we are

ExpertoVod, operating expertovod.com — an AI-assisted IT support service for business software projects. The service is operated by ITWILLROCK Sp. z o.o. (Poland), which is the data controller. Privacy contact: privacy@expertovod.com, or use the contact form.

2. Whose data we process, and what

  • Client users (portal accounts): name, email, authentication identifiers, role, and organization — collected at sign-up, used for account access and service delivery.
  • Expert users: name, email, grade and trust tier, skills, availability, and payout details — collected at sign-up and vetting, used for routing work, payment, and quality records.
  • Expert applicants: the application and vetting materials they submit — used for the vetting decision.
  • People appearing in client materials: roles and internal identifiers only. Raw personal data is blocked from AI prompts and expert packets by a deterministic redaction guard; role and identifier substitution is pseudonymization handled under the data processing agreement.
  • Website visitors: no analytics or tracking beyond our hosting provider's operational defaults. No advertising, no sale of personal data.
  • Signed-in product surfaces (client portal, operator console, admin): cookieless page-view analytics from our hosting provider — aggregate counts only, no cookies, no cross-site tracking, and no personal data stored. It is not applied to the public website.

3. AI processing, stated plainly

Support requests and project knowledge are processed by large-language models (currently Anthropic models, accessed via Vercel AI Gateway) under provider data processing agreements. We do not restate provider retention or training commitments as our own facts — they are governed by the providers' current terms.

A human operator approves every outbound response. On the client side there is no solely-automated decision with legal effect. On the expert side, standing (grade and tier) is computed from defined, disclosed structured signals; honest non-answers never penalize an expert, and grade or tier changes are operator decisions with recorded reasons.

Experts work zero-access: they receive sanitized packets that carry no client identity, credentials, or raw personal data by design.

4. Legal bases

  • Contract performance: accounts, service delivery, expert payouts.
  • Legitimate interests: security, the append-only audit trail, service improvement.
  • Legal obligation: tax and accounting records.
  • Consent: not currently relied on — we run no marketing communications.

5. Who receives data (our providers)

  • Vercel — hosting and delivery.
  • Neon — database.
  • Clerk — authentication.
  • Postmark (ActiveCampaign) — transactional email.
  • Anthropic, via Vercel AI Gateway — AI processing.
  • Wise — business banking: receives invoice payments by bank transfer, so it sees payment counterparty details (your company name and account), never service data.

No sale of personal data. No advertising use.

6. International transfers

Live hosting runs in AWS us-east-1 (United States), and our providers are primarily US-based, operating under their data processing agreements with standard contractual clauses where applicable. EU data residency is on our roadmap and is stated here as roadmap — not as a current fact.

7. Retention

  • Account data: life of the account plus statutory record-keeping periods.
  • Vetting data of rejected applicants: deleted within 6 months absent consent to keep it.
  • Client project materials: deleted or returned within 30 days of termination; pointer access is revoked immediately.
  • The append-only audit trail of service events: retained after account closure as an independent-controller record of what the service did — the integrity record that disputes, billing, and accountability depend on.

8. Your rights

Access, rectification, erasure (including the derived-data cascade — knowledge claims citing an erased source are invalidated), restriction, portability, and objection, plus complaint to your supervisory authority.

Procedure: email privacy@expertovod.com or use the contact form; we verify identity and fulfill within one month. At pilot scale fulfillment runs as a documented manual procedure inside that statutory window.

9. Security posture

Append-only audit records, deterministic outbound redaction, the zero-access expert boundary, role-based access, and encrypted transport and storage via the listed providers. We describe controls as they exist; certifications we do not hold are not claimed.