Privacy policy
Last updated: September 25, 2026
This policy explains what personal data Experto collects when you use experto.am, why we need it, who else receives it and how you control it. It follows Armenia's Law on Protection of Personal Data and, for visitors from the European Union, the GDPR.
1. Who is responsible for your data
Experto (experto.am) is an online directory where people find service providers in Armenia, compare them, message them and book appointments.
Experto is run from Armenia by its founding team. The company that will operate it has not been registered yet; once it is, this section will give its name and registered address. Until then the team decides how your data is used and is responsible for it - the "processor" in the terms of Armenian law, the "controller" in those of the GDPR.
For anything about your data, write to support@experto.am.
2. The short version
- We collect what the service needs to work: your phone number and name, what you publish, write and upload, and your bookings.
- We do not sell personal data, and the site has no ad networks or advertising and analytics trackers. Businesses marked "Sponsored" pay for their placement; they are not chosen using your data.
- Our servers are in Armenia. A few services abroad run specific features: Google (sign-in, calendar and the AI assistant), Twilio (sign-in codes by SMS), Telegram (notifications you switch on) and OpenStreetMap (maps).
- The AI assistant sends what you type to Google Gemini, and Google may use it to improve its products. Don't share sensitive details there.
- You can see, correct and delete your data - most of it in My account, the rest by writing to us.
3. What we collect
Most of it comes from you. The rest is produced as you use the service.
- Account: your phone number, which identifies the account; your name; your password, which we store only as a one-way hash and cannot read; your language; whether you signed up as a customer or a provider; a profile photo, if you add one.
- Sign-in with Google (optional): your Google account ID and email address, and your phone number if you allow Google to share it. We never see your Google password.
- Sign-in codes: when we text you a code, we keep only a hash of it, for five minutes or until it is used.
- Business pages: what a provider publishes - business name, description, categories, phone numbers, address and map pin, service areas, services and prices, opening hours and photos.
- Bookings: the service, date, time, status and any note. Providers can also add customers who booked by phone or in person to their calendar, with a name and phone number.
- Messages: your chats with businesses and with our support team, including photos you send. If you report a conversation, we also keep the reason you give.
- Reviews: your rating and what you write.
- Claims: if you claim a business page, your request and the explanation you add to it, which our administrators check.
- Invitations and points: who invited whom, and the points added to or taken from your balance.
- Notifications: the channels and topics you switch on, and your Telegram chat ID if you connect Telegram.
- Google Calendar (providers, optional): access tokens, which we store encrypted; the calendar we create for your bookings; and the busy times read from your calendars.
- The AI assistant: your questions, the photos you attach and the answers.
- Location: if you search by distance from where you are, your browser asks your permission and then shares your position with the page. It is used for that search and not stored.
- Technical data: your IP address, held in memory only, to limit repeated attempts such as too many sign-in codes; whether you have the site open, so that you are not notified twice about something you already saw; and a random ID in a cookie, stored only as a hash, which counts clicks on a business's call and message buttons. Each click is recorded with the page language and the address of the page it came from, but not with who clicked.
- Error logs: when something fails, the server writes a technical note about the error to its log, sometimes with the ID of an account, booking or notification. We use these logs only to find and fix faults.
What we do not collect: bank card details (paid plans are paid in cash or by bank transfer, and we record only the plan and until when it is paid), your contacts or address book, or your location in the background. We keep no log of the pages you visit.
4. Why we use it, and on what grounds
- To create your account and sign you in - to provide the service you signed up for.
- To publish business pages and let people find, compare, contact and book businesses - to provide the service; a provider publishes a page by choice.
- To pass bookings and messages between customers and businesses - to provide the service.
- To send the notifications you choose - with your consent, which you can withdraw in the notification settings at any time.
- To answer you in the AI assistant - with your consent, given by using it.
- To keep the service safe - limiting repeated attempts, preventing fraud and spam, and investigating reports - in our legitimate interest and yours.
- To show providers how many people contacted them - in our legitimate interest; the count identifies no one.
- To meet legal obligations and answer lawful requests from the authorities.
Under Armenian law the main ground is your consent: you give it when you create an account or use a feature that needs the data, and you can withdraw it at any time. Withdrawing does not affect what was done before, but we cannot keep an account without a phone number and a name.
We make no decisions about you by purely automated means that have legal or similarly significant effects. Search results are ranked automatically, but that decides nothing about you. We do not send marketing messages.
5. What other people can see
- Business pages are public, including to search engines, and can be shared.
- A review is published with the name on your account.
- When you book or message a business, its owner sees your name, your phone number and what you wrote.
- Everything else in your account - bookings, messages, balance and settings - is seen only by you, by the other side of a booking or conversation, and by our administrators when they need it to run the service or deal with a complaint.
6. Who else receives data
We share personal data only as far as each purpose needs:
- Businesses you book or message, as described above.
- Our hosting company in Armenia, whose servers hold the database and uploaded files on our behalf.
- Google LLC (USA): Sign-in with Google, Google Calendar sync for providers who connect it, and the Gemini models behind the AI assistant. Google's privacy policy.
- Twilio Inc. (USA): sends sign-in codes by SMS, so it receives your phone number and the code. Twilio's privacy notice.
- Telegram: delivers the notifications you switch on - the sender's name and the beginning of a message, or a booking's time, services and customer name. Telegram's privacy policy.
- OpenStreetMap Foundation (United Kingdom): your browser loads map images from its servers, which see your IP address; when a pin is placed on the map, our server asks its Nominatim service for the address. The foundation's privacy policy.
- komoot GmbH (Germany): runs Photon, the address search; our server sends it the address you type. komoot's privacy policy.
- Authorities, when Armenian law obliges us to disclose data.
We do not sell or rent personal data. If Experto is ever transferred to a new owner, your data will pass to it only under this policy, and we will tell you in advance.
7. Data outside Armenia
Our servers and database are in Armenia. The services listed above are based in the USA, the United Kingdom, Germany and other countries, so the data they handle leaves Armenia. Those countries may not protect personal data the way Armenian law does.
Data goes abroad only for the feature concerned - for example, your phone number reaches Twilio because the sign-in code has to be texted to it. By creating an account or using such a feature you consent to this transfer, as Armenian law allows. For visitors from the European Union, the transfer is necessary to provide the service they asked for.
8. The AI assistant
The assistant uses Google's Gemini models through the Gemini API. To answer you, we send Google your messages, the photos you attach, your language and the categories and businesses that match your question. We do not send your name or phone number.
Experto uses the free tier of the Gemini API. Under Google's terms for it, Google may use what is sent to improve its products and models, and human reviewers may read it after it has been separated from our account. So please don't share health, financial or other sensitive details with the assistant. If we move to the paid tier, where Google does not do this, we will update this section.
Your chats are saved so you can come back to them: in your account if you are signed in, otherwise under the random ID in the am_sid cookie. Deleting a chat removes it from your list; the stored copy is erased when your account is deleted, or earlier if you ask us.
Answers are generated automatically and may be wrong. Check prices, availability and other details with the provider.
10. How long we keep data
- Account data, bookings, messages, reviews and points: for as long as your account exists.
- Business pages: until the business is removed from Experto.
- Claims and reports: as long as the business page or the conversation they concern.
- Sign-in codes: five minutes, or until used.
- Sent notifications: 30 days.
- Contact-button counts: as long as the business page exists; they identify no one.
- IP addresses for limiting attempts: in memory only, for minutes to hours, and gone when the server restarts.
When you ask us to delete your account, we delete your personal data or make it anonymous. Records we must keep by law, or need for a dispute that is under way, are kept only as long as that requires.
11. Your rights
You have the right to:
- know whether and how we process your data, and get a copy of it;
- have inaccurate data corrected - most of it you can change yourself in My account;
- have your data blocked or deleted, and your account closed;
- withdraw your consent at any time;
- if you are in the European Union: object to processing based on legitimate interest, restrict processing, and receive your data in a machine-readable format;
- complain to the Personal Data Protection Agency of the Ministry of Justice of Armenia (pdpa.am) or, in the European Union, to your local data protection authority.
To use these rights, write to support@experto.am and give the phone number of your account. We may text a code to that number to confirm it is you. There is no button to delete an account yet, so deletion requests also go to this address.
We reply within five working days, and correct, block or delete data within three working days of confirming the request.
12. How we protect data
- All traffic to experto.am is encrypted (HTTPS).
- Passwords and sign-in codes are stored only as one-way hashes; the sign-in cookie is signed and cannot be read by scripts on the page.
- Google Calendar tokens are encrypted in the database.
- Photos sent in a conversation can be opened only by those who can read that conversation.
- Repeated attempts to sign in or request codes are limited.
No system is completely secure. If personal data leaks, we will announce it on the site, report it to the Police and the Personal Data Protection Agency as Armenian law requires, and tell the people affected.
13. Children
Experto is not meant for children. You must be at least 16 to create an account: under Armenian law, the data of a younger person may be processed only with the consent of a parent or guardian. Providers must be at least 18.
If you believe a child under 16 has given us personal data, write to support@experto.am and we will delete it.
14. Changes to this policy
When the way we handle data changes, we update this page and the date at the top. We announce significant changes on the site before they take effect.
15. Contact
Questions and requests about personal data: support@experto.am.
You can also contact the Personal Data Protection Agency of the Ministry of Justice of Armenia: pdpa.am.