Privacy Policy

1.1 Overview

This Privacy Policy describes how Instant Expert collects, uses, and shares information when you use our website and services, including through an AI assistant you connect to your account.

It also covers information we hold about professionals who may not have an Instant Expert account, such as people who appear in search results or receive a request through Instant Expert.

By using the service, you agree to the practices described in this policy.

1.2 Information We Collect

Account and profile information: your name, email address, sign-in details, settings, billing and payout details, and any profile or project information you submit.

Content you create: your searches, saved lists, contacts you add, request drafts, messages, and replies, and any email you send us or reply to.

Usage and device data: IP address, browser and device type, pages viewed, and interaction events, which we use for analytics, reliability, and abuse prevention. Our analytics tool also records session replays of how pages are used, such as clicks, scrolling, and what is shown on the screen. Password fields are masked, and card details are entered in our payment processor's own secure fields, which session replays do not capture.

Email activity: when we send an email, we record whether it was delivered and, when our email provider reports it, whether it was opened or a link in it was clicked.

Cookies and similar technologies: we use cookies and browser storage to keep you signed in and to run analytics.

1.3 Information About Professionals

To help users find people to talk to, we collect professional information about people who may not have an Instant Expert account. This can include name, job title, employer, work history, education, skills, professional headline or summary, location, profile photo, professional profile links such as LinkedIn, and work or personal email addresses.

We get this information from people-data and web-search providers, publicly available professional sources, the professionals themselves when they claim a profile or respond to a request, and contacts our users provide. We also derive information from it, such as a suggested rate for a person's time, notes on why a person matches a search, and an average of the ratings requesters give.

We use this information to show professionals in search results and saved lists, to find and verify an email address so we can deliver a request that a user chooses to send, and to keep our records accurate. Users see professional details such as name, title, company, profile links, and suggested rates. We do not show users the email addresses we find; Instant Expert delivers requests itself.

We also publish a public directory at https://instant.expert/experts that lists some professionals by name, title, company, LinkedIn profile, and a short note on relevant experience, based on public professional information. A listing does not mean the person has joined Instant Expert or agreed to talk.

If you are a professional, you can claim your profile at https://instant.expert/claim to review it and set your rates. Request emails we send to professionals who have not joined include an unsubscribe link, which stops request emails to every address we hold for you. To see, correct, or delete information about you, or to be removed from search results and the directory, email team@instant.expert, and we will respond within 30 days. Because our data providers may still list you, we keep your email address on a do-not-contact list after removal so requests are not sent to you again.

1.4 Contacts You Provide

You can add people by name, company, email address, LinkedIn profile URL, or contact file, on the website or through a connected assistant. We store them in your account to build your lists and, only if you send them a request, to deliver it. We do not contact the people you add on your behalf unless you send them a request.

To complete a contact's profile, we may look them up with our data providers. If a contact matches a professional in our records, details you provided, such as an email address, may be added to that person's profile and used to deliver requests to them. We do not show the email addresses you provide to other users.

You can also upload your LinkedIn connections export or add email addresses, domains, or names to a do-not-contact list. We use that list only to stop requests from going to those people on your behalf, and you can remove entries at any time.

You are responsible for having the right to share the contact information you give us.

1.5 Requests, Replies, and Calls

When you prepare or send a request, we store your message, the request type, call length, budget and offers, follow-up settings, and recipients. Recipients see your message, the request type, and the amount offered.

When a recipient responds, we store the reply and show it to the requester. A reply can be written text, a voice note, or a booked call time. Voice notes are stored privately and transcribed by an AI service provider so the requester can read them.

Calls take place in video rooms run by our video provider. Calls are recorded, starting when the requester joins, and we record when each participant joins and leaves to determine attendance, charges, and payouts as described in our Terms. We may review recordings and attendance records to resolve disputes, reported problems, or compliance concerns. In the call, the requester is labeled “Requester” rather than shown by name. Guests a requester adds to a call receive the requester's name and the call details.

When a recipient opens a request page, we record the visit with browser and device signals, such as IP address, browser type, and signs of automated access, so we can tell people apart from email security scanners. Our analytics tool may also record a session replay of that page. Requesters can see when a request page was first viewed.

2.1 How We Use Information

We use information to provide and improve the service: to run searches, build lists, deliver requests, schedule and host calls, process payments and payouts, communicate with you, provide support, enforce our Terms, detect fraud and abuse, and comply with legal obligations.

We use AI models to interpret search requests, find and rank professionals, read the columns of contact files you upload, suggest rates, and transcribe voice notes.

We may use aggregated or de-identified information for analytics and product development.

Where laws such as the GDPR require a legal basis, we rely on our contract with you to run your account, requests, and payments; on our legitimate interests to find professionals, deliver requests, keep the service secure, and improve it; on legal obligations for tax and accounting records; and on consent where the law requires it.

2.2 How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as needed for the purposes in this policy, with these categories of recipients.

Service providers that run Instant Expert for us, subject to contractual confidentiality requirements: hosting (Fly.io); database, sign-in, and file storage (Supabase); payments and payouts (Stripe, and Tremendous for gift-card payouts); video calls and call recordings (Daily); calendar and email services (Google); email delivery (Resend and Instantly); analytics and session replay (PostHog); error monitoring (Sentry); monitoring of AI requests; and internal team notifications (Slack).

Data providers that help us find professionals, find their email addresses, and verify those addresses, such as Crustdata, Apollo, Exa, ContactOut, LeadMagic (through Treg), OpenMart, and MailTester. We send them search criteria and identifying details, such as a person's name, employer, or LinkedIn URL.

AI service providers (Anthropic, OpenAI, and Google) that process search requests, professional information, contact files, messages, and voice notes to run the features described in this policy.

Other users, as part of the service: recipients see a requester's message, request type, and offer; requesters see the replies, voice notes, transcripts, and call details for their requests; and guests a requester adds to a call receive the requester's name and the call details.

AI assistants you connect, such as ChatGPT, which receive the results of the actions you ask them to take, as described in Connected AI Assistants, Including ChatGPT.

Authorities or other parties when required by law or to protect rights and safety, and a buyer or successor in connection with a merger, acquisition, financing, or sale of assets.

2.3 Payment Information

Card details are entered into secure fields provided by Stripe, our payment processor, and go directly to Stripe. We do not receive or store full card numbers or security codes. We store Stripe customer and payment-method identifiers and may show your card's brand and last four digits, which Stripe provides.

Professionals who receive payouts give their bank details to Stripe, choose a gift card delivered through Tremendous, or ask us to donate the payout to a charity they name. We store payout records, identifiers, and charity choices, not full bank account numbers.

Connected AI assistants never receive payment details.

3.1 Connecting an Assistant

To connect an assistant, you sign in to Instant Expert and approve the connection. Our authentication provider then issues access and refresh tokens to the assistant.

We keep a record of each connection: the assistant's name, when you approved it, when you disconnected it, and whether it may send paid requests.

3.2 What We Receive From an Assistant

We receive what the assistant sends when it uses Instant Expert for you, such as a description of the people you want to find; the names, companies, email addresses, or LinkedIn URLs of contacts to save; and the message, request type, call length, budget, and recipients of a draft request. We store these with your account, as if you had used Instant Expert directly.

We do not receive the rest of your conversation with the assistant.

3.3 What We Return to an Assistant

To complete what you asked, we return the relevant information to the assistant. Through ChatGPT, this can include the name, job title, and company of people in your searches and lists, and the details that matched your search, such as a former title or employer, or location; your drafts, including the message, request type, call length, total budget, follow-up setting, and recipient names; the status of your requests and the dates they were updated, answered, cancelled, or refunded; booked call times; written replies and voice-note transcripts from completed requests; progress and counts for searches that are running; and your account ID, name, and email address.

Through ChatGPT, we do not return professionals' email addresses or profile links, payment details, per-person prices or rates, links to request pages, or when a recipient viewed a request page. Assistants connected through our general MCP connection can also receive request links, rates, prices and offers, and when a recipient first opened a request page.

Once returned, this information is handled by the assistant's provider under its own terms and privacy policy; for ChatGPT, that provider is OpenAI.

3.4 What an Assistant Cannot Do

Through ChatGPT, an assistant can run searches, save lists, create unsent request drafts, and read your requests. It cannot send requests, make payments, or see your payment methods. You review, price, and send drafts yourself on Instant Expert.

Assistants connected through our general MCP connection cannot send requests either, unless you turn on paid sending for that connection at https://instant.expert/settings/connections. With that permission, the assistant can send paid requests charged to your saved payment method.

No assistant can change your account settings or see other users' data.

3.5 Disconnecting an Assistant

You can disconnect an assistant at any time at https://instant.expert/settings/connections. Disconnecting ends its access right away, including tokens that have not yet expired, cancels its queued work, and asks our authentication provider to revoke its refresh tokens. To be sure access is revoked on our side, disconnect it in Instant Expert, not only in the assistant's own settings.

We keep the disconnected connection record, and the searches, lists, and drafts the assistant created, as part of your account history until you delete them or your account.

4.1 Third-Party User Data Accessed

If you sign in with a third-party account, we may access basic account profile information, including your name, email address, profile image, and account identifier, so we can authenticate you and create or maintain your Instant Expert account.

If you connect a calendar account, we request access to your account email, calendar list metadata such as calendar identifiers, names, and primary-calendar status, and free/busy availability information for calendars you choose to use for scheduling conflict checks.

We store encrypted OAuth access and refresh tokens, token expiration timestamps, granted scopes, the connected account email, and the calendar selections needed to keep the connection working. We do not request or store calendar event titles, descriptions, locations, attachments, attendee lists, or event contents.

4.2 Third-Party User Data Usage

We use third-party sign-in data only to authenticate you, maintain your account session, personalize account-level UI, prevent abuse, and provide support for your account.

We use connected calendar data only to show your connected calendar account, let you choose which calendars should block scheduling conflicts, and calculate whether proposed Instant Expert meeting times conflict with your busy calendar periods.

We do not use connected account data for advertising, do not sell it, and do not use it to train generalized AI or machine-learning models.

4.3 Third-Party User Data Sharing

We do not sell connected account data or share it with third parties for advertising or independent third-party use.

We may disclose connected account data to service providers that process data on our behalf, such as hosting, database, security, monitoring, and customer-support providers, only as needed to operate and protect Instant Expert and subject to confidentiality and data-protection obligations.

We may also disclose connected account data if required by law, to protect the rights and safety of users or the service, or at your direction when you choose to use a feature that requires sharing. Our use and transfer of information received from third-party account APIs adheres to the applicable provider policies, including limited-use requirements.

4.4 Third-Party User Data Storage and Protection

OAuth tokens are encrypted before storage. Access to stored connected account data is limited to authorized systems and personnel who need it to operate, secure, debug, or support the service.

We use administrative, technical, and organizational safeguards such as access controls, encrypted transport, monitored infrastructure, and least-privilege operational practices designed to protect connected account data against unauthorized access, use, loss, alteration, or disclosure.

4.5 Third-Party User Data Retention and Deletion

We retain third-party sign-in profile data for as long as your account remains active or as otherwise needed to provide the service, comply with legal obligations, resolve disputes, or prevent abuse.

We retain calendar connection data only while your calendar remains connected or as otherwise needed for legal, security, or operational reasons. When you disconnect a calendar, we revoke the refresh token when possible and delete the stored calendar connection and calendar-selection records from our systems.

You can request deletion of connected account data or your account by contacting team@instant.expert. We may need to verify your identity before completing a deletion request, and limited records may be retained where required by law, security, fraud prevention, or legitimate business obligations.

5.1 Data Retention

We keep information for the periods below. When a period ends, or when we complete a verified deletion request, we delete the information or de-identify it, unless we must keep it longer for legal, tax, accounting, security, or dispute reasons.

Account information, such as your name, email address, sign-in details, and settings: while your account is open. We complete verified account deletion requests within 30 days.

Searches, saved lists, contacts you add, and request drafts: until you delete them or your account. Discarding a draft deletes it right away. Deleting a saved search or list removes it from your account, and we keep the underlying record until your account is deleted. Contact details that were added to a professional's profile follow the retention for information about professionals.

Sent requests, replies, voice notes, transcripts, booked call times, call recordings, and attendance records: while your account is open, and afterwards as long as needed for legal, tax, accounting, and dispute obligations, because they are records of paid transactions that involve another person.

Payment and payout records: as long as needed for tax, accounting, and legal obligations.

Information about professionals: while it helps users find and reach the right people, or until the professional asks us to remove it. After a removal request, we keep the person's email address on a do-not-contact list.

Your do-not-contact list: until you remove entries or delete your account. Unsubscribe records and the do-not-contact list we keep for professionals: for as long as we need them to honor those requests.

Connected calendar data: until you disconnect the calendar, when we delete it.

AI assistant connections: access ends as soon as you disconnect. The connection record stays in your account history until your account is deleted.

Analytics data, session replays, error reports, and server logs: for the limited periods set by our analytics, monitoring, and hosting providers' retention settings. You can ask us to delete analytics data tied to your account.

Emails we send or receive about requests: kept with the related request or account.

5.2 Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5.3 Your Controls

In your account, you can delete saved searches, discard unsent drafts, edit your do-not-contact list, remove saved payment cards, disconnect a calendar, and disconnect AI assistants or change their paid-sending permission at https://instant.expert/settings/connections.

We do not currently offer a setting to turn off analytics or session replay. You can ask us to delete analytics data tied to your account.

Professionals who do not have an account can use the options described in Information About Professionals.

5.4 Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of personal information.

You may also have rights to object to processing or request data portability where legally available.

To make a request, or to delete your account, email team@instant.expert from the email address on your account. We verify your identity before acting and respond within 30 days.

6.1 Children's Privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information, contact us so we can take appropriate action.

6.2 International Data Transfers

If you access the service from outside the United States, your information may be transferred to and processed in the United States or other jurisdictions with different data protection laws.

6.3 Changes to This Policy

We may update this Privacy Policy from time to time by posting a revised version on this page. When we make material changes, we update the effective date and summarize what changed at the top of this policy.

Your continued use of the service after changes become effective constitutes acceptance of the updated policy.