Privacy policy

1. Who is responsible for your data

Experto (experto.am) is an online directory where people find service providers in Armenia, compare them, message them and book appointments.

Experto is run from Armenia by its founding team. There is no registered company behind it yet: the service is free for now, and we take no money from anyone who uses it. We will register a legal entity before we accept any payment. That entity will then operate Experto and be responsible for your data, and this section will give its name and registered address; we will announce the change on the site in advance. Until then the team decides how your data is used and is responsible for it - the "processor" in the terms of Armenia's Law on Protection of Personal Data, the "controller" in those of the GDPR.

For anything about your data, write to supportexperto@gmail.com.

2. The short version

• We collect what the service needs to work: your phone number and name, what you publish, write and upload, and your bookings.
• We do not sell personal data, and the site has no ad networks or advertising and analytics trackers. Businesses marked "Sponsored" pay for their placement; they are not chosen using your data.
• Our servers are in Armenia. A few services abroad run specific features: Google (sign-in, calendar, the AI assistant and translating business descriptions), Telegram (notifications you switch on, and confirming your number if you log in or sign up through it, and signing you in when you open Experto inside it), WhatsApp (confirming your number if you log in or sign up through it, and the notifications you switch on there) and OpenStreetMap (maps).
• The AI assistant sends what you type to Google Gemini, and Google may use it to improve its products. Don't share sensitive details there.
• You can see, correct and delete your data - most of it in My account, the rest by writing to us.
• Experto is free for now and has no registered company behind it yet: we will register a legal entity before we accept any payment (see section 1).

3. Whose data this policy covers

This policy covers everyone whose data Experto handles:

• Visitors who use the site without an account.
• Customers who look for, contact or book businesses.
• Providers who run a business page.
• People whose business page we created from information they gave us or published themselves. They can claim the page, correct it or ask us to remove it.
• People a provider adds to their calendar - customers who booked by phone or in person. The provider enters their name and phone number and is responsible for having the right to do so; we keep these details only in that provider's calendar. If the number belongs to a customer account on Experto, the provider can attach the booking to it, and it then appears in that account.
• Anyone who writes to us at our email address.

4. What we collect

Most of it comes from you. The rest is produced as you use the service.

• Account: your phone number, which identifies the account; your name; your password, if you set one, which we store only as a one-way hash and cannot read (an account made by booking without one has none until you set it); your language; whether you book services, run a business or help run the site as an administrator - and, for administrators, who gave or took away that right and when; a profile photo, if you add one; and when you last signed in and when you were last on the site signed in - one moment each, overwritten every time, not a list of the pages you opened.
• Sign-in with Google (optional): your Google account ID and email address, and your phone number if you allow Google to share it. We never see your Google password.
• Sign-in with Telegram (optional): your Telegram account ID, saved once you confirm your number through Telegram, so that opening Experto inside Telegram signs you in. There Telegram also tells us your name, username and language; we use the name only to suggest it in the sign-up form, and store none of them.
• Sign-in with WhatsApp (optional): the number your message to Experto's WhatsApp number came from, which WhatsApp confirms, and the code that message carried, kept only as a hash. WhatsApp also tells us the name on your WhatsApp profile; we do not store it.
• Sign-in codes: when we text you a code, we keep only a hash of it, for five minutes or until it is used. We also note when a code you entered, or your contact shared with our Telegram bot, last confirmed that your number is yours.
• Business pages: what a provider publishes - business name, description, categories, phone numbers, address and map pin, service areas, services and prices, opening hours and photos.
• Managers: if a business owner gives staff a manager login - the manager's name, username and password (stored only as a one-way hash), the businesses they work for and what the owner allows them there, when they last signed in, and which bookings and services they changed. The owner creates and removes these logins; a removed login is switched off and kept, so the business's history still shows who did what.
• Salon masters: if a salon invites you to be one of its masters - which salon, who invited you and when, and when you accepted or the place ended; your title and description; the services you do there, with your own prices and lengths; your working hours and days off, with the reason, if you note one; the address of your master page, and earlier ones, so that old links still lead to it; whether you agreed to show your phone number there; and what the salon allows you to do. When the QR code a salon printed for you is scanned, we record the scan with the hash of the am_sid ID, which is not linked to any account, and count a booking with you made soon after; neither says who it was.
• Bookings: the service, date, time, status and any note. Providers can also add customers who booked by phone or in person to their calendar, with a name and phone number.
• Menu orders: when you order from a venue's QR code - what you ordered, the room or table, the name and note you choose to add, when, and whether you were let in by the venue's Wi-Fi or by its code. An order made while signed in is kept with your account; otherwise with the am_sid ID. To check the Wi-Fi, the internet address your order comes from is compared with the address the venue saved, and is not stored. A venue's saved address is its own, not a person's.
• Messages: your chats with businesses and with our support team, including photos you send, and when each message reached the other side and was read. If you report a conversation, we also keep the reason you give.
• Reviews: your rating and what you write, and the booked visit it rates. If an administrator edits or removes a review, we keep what it said before.
• Claims: if you claim a business page, your request and the explanation you add to it, which our administrators check.
• Invitations, points and tips: who invited whom, the points added to or taken from your balance, and the tips you give or receive - who gave them, to whom and for which visit.
• Notifications: the channels and topics you switch on, and your Telegram chat ID if you connect Telegram or use it to log in or sign up. If you turn on notifications in a browser: the address that browser's push service gives it, the keys that encrypt notifications for it, and the browser and system it runs on (for example "Chrome, Android"). If you connect WhatsApp, or log in or sign up through it: that WhatsApp number, and when you last wrote to us there, since WhatsApp lets us message you freely only for 24 hours after that.
• Following businesses: which businesses you follow; whether you asked to get a business's offers by SMS, when, and for which number; and a record of every such choice - following, unfollowing, switching SMS on or off, declining the question after a booking - with the version of the wording you were shown. Everyone sees how many people follow a business, never who.
• Likes: which businesses you liked with the heart, and when, so that you can find them again on your Liked page. Everyone sees how many people like a business, never who.
• Google Calendar (providers, optional): access tokens, which we store encrypted; the calendar we create for your bookings; the busy times read from your calendars; and, where your grant allows it, the notification channels through which Google tells us that one of your calendars changed - Google sends us only that something changed, never what.
• The AI assistant: your questions, the photos you attach and the answers.
• Location: if you search by distance from where you are, your browser asks your permission and then shares your position with the page. It is used for that search and not stored.
• Technical data: your IP address, held in memory only, to limit repeated attempts such as too many sign-in codes; whether you have the site open, so that you are not notified twice about something you already saw and so that our administrators can see how many people are on the site at the moment (if you are not signed in, an open page tells us so about once a minute, and we keep a hash of your IP address and browser in memory only, for two minutes at most); and a random ID in a cookie, stored only as a hash, which counts clicks on a business's call and message buttons. Each click is recorded with the page language and the address of the page it came from, but not with who clicked. When you open the home page or a business page, we count the visit: which page, when, and your IP address, kept only as a hash made with a secret key - never the address itself. It shows our administrators how often the site and each business page are visited. Visits by our administrators, and by a business's own team to its page, are not counted. When a business's printed QR code is scanned, we record the scan with the hash of the am_sid ID, and count a booking made there in the next half hour; neither says who it was.
• Error logs: when something fails, the server writes a technical note about the error to its log, sometimes with the ID of an account, booking or notification. We use these logs only to find and fix faults.

What we do not collect: bank card details (we take no payments yet; once paid plans are paid for, it will be in cash or by bank transfer, and we will record only the plan and until when it is paid), your contacts or address book, or your location in the background. We keep no log of the pages you visit: we only count visits to the home page and to business pages, as described above, without linking them to your account.

Give accurate details and your own phone number. We may suspend an account that uses someone else's number or false details, as the Terms of use allow.

5. Why we use it, and on what grounds

• To create your account, confirm your phone number and sign you in - to provide the service you signed up for.
• To publish business pages and let people find, compare, contact and book businesses - to provide the service; a provider publishes a page by choice.
• To pass bookings and messages between customers and businesses - to provide the service.
• To send the notifications you choose - with your consent, which you can withdraw in the notification settings at any time. Signing up through Telegram switches them on in that chat, and so does logging in through it when your account has no Telegram chat yet.
• To bring you news and offers from the businesses you follow - with your consent, given by following a business, and for SMS by asking for it separately. You can withdraw it at any time on the Following page in My account, and from any SMS in one tap. Businesses cannot send them yet.
• To answer you in the AI assistant - with your consent, given by using it.
• To keep the service safe - limiting repeated attempts, preventing fraud and spam, and investigating reports - in our legitimate interest and yours.
• To show providers how many people contacted them - in our legitimate interest; the count identifies no one.
• To see how often the site and each business page are visited, and how many people are on the site at the moment - in our legitimate interest; the counts do not say who visited.
• To see which business owners still use the site, so that we can help those who stopped - in our legitimate interest. Only our administrators see it.
• To meet legal obligations and answer lawful requests from the authorities.

Under Armenia's Law on Protection of Personal Data the main ground is your consent: you give it when you create an account or use a feature that needs the data, and you can withdraw it at any time. Withdrawing does not affect what was done before, but we cannot keep an account without a phone number and a name.

We make no decisions about you by purely automated means that have legal or similarly significant effects. Search results are ranked automatically, but that decides nothing about you. We do not send marketing messages of our own. News and offers from a business reach you only if you follow it, and by SMS only if you asked for that.

6. What other people can see

• Business pages are public, including to search engines, and can be shared. A business can hide its phone numbers: then only its owner, its managers and our administrators see them.
• If you accept a salon's invitation to be one of its masters, your name and profile photo, the title and description written by you or the salon, and your services and prices are shown on the salon's page and on your own master page. That page is public, is found in search and can be shared, until you or the salon end your place there. Your phone number is shown there only if the salon lets customers call you directly and you agree to it on your own page. A message a customer writes to you is seen by you and by the salon's people who answer its chats.
• A review is published with the name on your account; a rating of a booked visit is marked "Verified visit". A business's owner sees your name on a tip you give them.
• When you book or message a business, its owner sees your name, your phone number and what you wrote.
• When you order from a venue's menu, its owner and the staff who take orders see what you ordered, where to bring it, and the name and note you wrote.
• In a chat, whoever writes to you sees ticks by each message: whether it has reached you, on the site or in Telegram, and whether you have opened the chat.
• Everything else in your account - bookings, messages, balance and settings - is seen only by you, by the other side of a booking or conversation, and by our administrators when they need it to run the service or deal with a complaint.

7. Who else receives data

We share personal data only as far as each purpose needs:

• Businesses you book or message, as described above.
• Our hosting company in Armenia, whose servers hold the database and uploaded files on our behalf.
• Google LLC (USA): Sign-in with Google, Google Calendar sync for providers who connect it, and the Gemini models behind the AI assistant and the translation of business descriptions. Google's privacy policy.
• Peleka (Armenia): sends sign-in codes by SMS, so it receives your phone number and the code.
• Telegram: delivers the notifications you switch on - the sender's name and the beginning of a message, a booking's time, services and customer name, a request to rate a visit, or a tip received. If you log in or sign up through our Telegram bot, Telegram gives us the phone number of your Telegram account and its identifier. If you open Experto inside Telegram, the page loads Telegram's Mini App script from telegram.org, and Telegram tells us who opened it. Telegram's privacy policy.
• WhatsApp (Meta Platforms, Inc., USA): receives the message you send to Experto's WhatsApp number to log in, sign up or connect notifications, and delivers the notifications you switch on there - the sender's name and the beginning of a message, a booking's time, services and customer name, a request to rate a visit, or a tip received. WhatsApp's privacy policy.
• Browser push services: notifications you turn on in a browser travel through the push service of that browser's maker: Google (Chrome and most other browsers), Mozilla (Firefox), Apple (Safari and every browser on iPhone and iPad) or Microsoft (Edge on Windows). Each notification is encrypted for your browser, so the service cannot read it; it sees that a notification was sent to that browser, and when.
• OpenStreetMap Foundation (United Kingdom): your browser loads map images from its servers, which see your IP address; when a pin is placed on the map, our server asks its Nominatim service for the address. The foundation's privacy policy.
• komoot GmbH (Germany): runs Photon, the address search; our server sends it the address you type. komoot's privacy policy.
• Authorities, when Armenian law obliges us to disclose data.

We do not sell or rent personal data, and we do not pass it to anyone for their advertising. If Experto is ever transferred to a new owner, your data will pass to it only under this policy, and we will tell you in advance.

8. Data outside Armenia

Our servers and database are in Armenia. The services listed above are based in the USA, the United Kingdom, Germany and other countries, so the data they handle leaves Armenia. Those countries may not protect personal data the way Armenian law does.

Data goes abroad only for the feature concerned - for example, what you write to the AI assistant reaches Google, because Google's Gemini models write its answers. By creating an account or using such a feature you consent to this transfer, as Armenian law allows. For visitors from the European Union, the transfer is necessary to provide the service they asked for.

9. The AI assistant

The assistant uses Google's Gemini models through the Gemini API. To answer you, we send Google your messages, the photos you attach, your language and the categories and businesses that match your question. We do not send your name or phone number.

Experto uses the free tier of the Gemini API. Under Google's terms for it, Google may use what is sent to improve its products and models, and human reviewers may read it after it has been separated from our account. So please don't share health, financial or other sensitive details with the assistant. If we move to the paid tier, where Google does not do this, we will update this section.

Your chats are saved so you can come back to them: in your account if you are signed in, otherwise under the random ID in the am_sid cookie. Deleting a chat removes it from your list; the stored copy is erased when your account is deleted, or earlier if you ask us.

The support chat on the home and category pages answers the same way, through Gemini, and the Experto team reads every chat and can answer it. Once you choose Talk to a person, or the team answers, nothing more goes to Gemini until the chat is handed back to the assistant. The chat is kept with your account or the am_sid ID, and moves into your account when you sign in on the same browser.

Business descriptions that a business leaves untranslated are translated by Gemini too: we send Google only the business's short and full description and the languages to translate them into. Admins see which texts were translated this way, and the business can replace them with its own at any time.

Answers are generated automatically and may be wrong. Check prices, availability and other details with the provider.

10. Cookies and local storage

We use only the cookies the site needs to work. There are no advertising, analytics or other third-party cookies.

• session - keeps you signed in. 30 days.
• active_context - remembers whether you are acting as yourself or as one of your businesses. 1 year.
• ref - remembers the invitation code from a link you followed, so the invitation counts when you sign up. 30 days.
• am_sid - a random ID, which we store only as a hash: it counts clicks on businesses' contact buttons and keeps the assistant and support chats and the menu orders of visitors who are not signed in. 1 year.
• menu_spot - remembers that this phone was let in at a venue's room or table, by its Wi-Fi or its code, so the code is typed once a visit. Until the room or table closes, 12 hours at most.
• master_qr - after you scan a salon master's printed QR code, remembers which master it was, so that a booking with them in the next half hour is counted for that code. 30 minutes.
• business_qr - after you scan a business's printed QR code, remembers which business it was, so that a booking there in the next half hour is counted for that code. 30 minutes.
• venue_device - on a venue's own device, remembers that it saved the venue's Wi-Fi, so it can offer to update it. 1 year.
• google_auth_nonce and google_signup - protect sign-in with Google and remember an unfinished sign-up. Up to 20 minutes.
• telegram_signup - remembers the number you are confirming in Telegram, until you are signed in or the account is created. Up to 45 minutes.
• whatsapp_signin - remembers the number you are confirming in WhatsApp, until you are signed in or the account is created. Up to 45 minutes.
• guest_booking_code - remembers the number a code was texted to while you book without an account, so the code is checked against that number. Up to 10 minutes.
• business_phone_code - remembers the new number a provider is confirming for a business page. Up to 10 minutes.
• password_nudge_hidden - remembers that you hid the reminder to set a password. 7 days.
• experto_push_device - remembers which browser notifications on this device are yours, so that logging out stops them. 400 days.
• experto:desktop-alerts-muted (local storage, not a cookie) - remembers that you turned off browser alerts on this device.
• experto:support-chat-greeted and experto:support-chat-started (local storage, not cookies) - remember that you have opened the support chat and that you have one, so the button shows only new answers.
• experto:push-offer and experto:push-offer-shown (local and session storage, not cookies) - remember when you answered "Not now" to the offer of notifications, so that it does not come back too soon.
• experto:telegram-mini-app and experto:telegram-mini-app-sign-in (session storage, not cookies) - remember, while Experto stays open in Telegram, that it runs there and that the automatic sign-in has already happened. Telegram's script keeps its launch data there too.

You can delete or block cookies in your browser settings. Without the session cookie you cannot stay signed in.

11. How long we keep data

We keep personal data only as long as the purposes in this policy need it, and then delete it or make it anonymous. In practice:

• Account data, bookings, messages, reviews and points: for as long as your account exists.
• Follows, and the record of what you agreed to: for as long as your account exists, so that we can show what you asked for. If your phone number changes, SMS from businesses stops until you ask for it again.
• Business pages: until the business is removed from Experto.
• Menu orders: as long as the venue's business page exists. An order made without an account keeps only the hash of the am_sid ID.
• A place as a salon's master: for as long as your account and the salon's page exist. A place that ends is switched off and kept, so that the salon's past bookings still show who did them. Earlier addresses of your master page are kept for as long as your account exists, so that old links keep working.
• QR code scans and the bookings from them: as long as your place at the salon is kept; they identify no one.
• Scans of a business's QR code and the bookings from them: as long as the business page exists; they identify no one.
• Claims and reports: as long as the business page or the conversation they concern.
• Sign-in codes: five minutes, or until used.
• Confirming a number in Telegram: the number and your Telegram identifier, until you are logged in or the account is created, and for two hours at most. The chat then stays connected for notifications until you disconnect it.
• Confirming a number in WhatsApp: the number and the code's hash, until you are logged in or the account is created, and for 45 minutes at most. The number then stays connected for notifications until you disconnect it or send STOP.
• Browser notifications: until you turn them off, log out in that browser, the browser ends them, or you turn them on in more than 10 browsers (then the one unused longest is dropped).
• Sent notifications: 30 days.
• Contact-button counts: as long as the business page exists; they identify no one.
• Visit counts: as long as we keep the site's statistics, and a business page's for as long as the page exists. The IP address in them is only ever a hash made with a secret key.
• IP addresses for limiting attempts: in memory only, for minutes to hours, and gone when the server restarts.

When you ask us to delete your account, we delete your personal data or make it anonymous. Records we must keep by law, or need for a dispute that is under way, are kept only as long as that requires.

12. Your rights

You have the right to:

• know whether and how we process your data, and get a copy of it;
• have inaccurate data corrected - most of it you can change yourself in My account;
• have your data blocked or deleted, and your account closed;
• withdraw your consent at any time - for news and offers from a business, by unfollowing it or switching SMS off on the Following page;
• if you are in the European Union: object to processing based on legitimate interest, restrict processing, and receive your data in a machine-readable format;
• complain to us if you think we have handled your data wrongly, and to the Personal Data Protection Agency of the Ministry of Justice of Armenia (pdpa.am) or, in the European Union, to your local data protection authority.

To use these rights, write to supportexperto@gmail.com and give the phone number of your account. We may text a code to that number to confirm it is you. There is no button to delete an account yet, so deletion requests also go to this address.

We reply within five working days, and correct, block or delete data within three working days of confirming the request.

13. How we protect data

• All traffic to experto.am is encrypted (HTTPS).
• Passwords and sign-in codes are stored only as one-way hashes; the sign-in cookie is signed and cannot be read by scripts on the page.
• Google Calendar tokens are encrypted in the database.
• Photos sent in a conversation can be opened only by those who can read that conversation.
• Repeated attempts to sign in or request codes are limited.
• We collect only what each feature needs, and use it only for the purposes in this policy.
• Only the team that runs Experto can reach its servers and database. Administrators open other people's data only when they need it to run the service or deal with a complaint.

No system is completely secure. If personal data leaks, we will announce it on the site, report it to the Police and the Personal Data Protection Agency as Armenian law requires, and tell the people affected.

14. Children

Experto is not meant for children. You must be at least 16 to create an account: under Armenian law, the data of a younger person may be processed only with the consent of a parent or guardian. Providers must be at least 18.

If you believe a child under 16 has given us personal data, write to supportexperto@gmail.com and we will delete it.

15. Changes to this policy

When the way we handle data changes, we update this page and the date at the top. We announce significant changes on the site before they take effect. Each version applies from the date at the top and replaces the one before it.

16. Contact

Questions and requests about personal data: supportexperto@gmail.com.

You can also contact the Personal Data Protection Agency of the Ministry of Justice of Armenia: pdpa.am.