Privacy policy.

1. The information we collect and store

Information you provide. When you create an account we collect personal information such as your name and email address ("Personal Information"). If you apply as an expert, we additionally collect your professional profile: experience, specialties, rates, photograph, time zone, and availability. If you complete the client onboarding questionnaire, we collect the answers you choose to give us (for example, the problem you want to solve, your industry, and budget range).

Payments. Payments are processed through Stripe. We do not store card numbers or bank credentials; from Stripe we only receive transaction identifiers and the data needed to manage your bookings, receipts, and, for experts, their payouts. Stripe's processing of your payment data is governed by the Stripe privacy policy.

Log data. When you use the Service we may automatically record technical information from your device and activity, such as IP address, browser type, pages visited, language preferences, and timestamps associated with transactions.

Cookies. We use strictly necessary cookies to operate the Service: keeping you signed in, protecting forms against request forgery (CSRF), and remembering your language preference. We do not use third-party advertising cookies. If you configure your browser to reject cookies, you may not be able to use the parts of the Service that require a session.

2. Google user data

Our Service integrates with Google APIs in two ways: Google sign-in and the optional Google Calendar connection used for scheduling sessions.

Google sign-in. If you choose to create your account or sign in with Google, we receive your name, email address, and profile picture to create and identify your account. We never receive or store your Google password.

Google Calendar connection (optional). To enable session scheduling you can connect your Google calendar. This connection is voluntary, is requested separately from sign-in, and asks only for the minimum permissions needed for your role:

• Availability (calendar.freebusy) — all users: we read only your busy/free blocks to compute available time slots and avoid scheduling conflicts. With this permission we never access titles, descriptions, attendees, or any other details of your events.
• Events (calendar.events) — expert accounts only: we use it exclusively to create, update, or cancel the calendar events for sessions booked on the platform, including the Google Meet link. We do not read or modify the rest of your calendar.
• Basic identity (openid, email): to show you which Google account is connected.

Storage and protection. The tokens Google issues to us are stored encrypted at rest (AES-256-GCM) and are used exclusively server-side; they are never exposed to your browser or to other users.

Sharing. We do not sell Google user data. We do not share it with third parties, except with the infrastructure providers strictly necessary to operate the Service (see section 4), and we never use it for advertising or to train artificial-intelligence models, including generalized models.

Limited Use. Fractional Experts' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revocation and deletion. You can disconnect your calendar at any time from your account settings in the Service; when you do, we revoke the tokens with Google and delete them from our database. You can also revoke access directly from your Google account security settings. If you delete your Service account, we also delete the Google data associated with it.

3. How we use personal information

Personal Information is used to: (i) provide and improve the Service; (ii) administer your use of the Service, including bookings, payments, messages, and notifications; (iii) show expert profiles to potential clients; (iv) personalize your experience, for example with expert recommendations; (v) send you transactional emails related to your bookings and account; and (vi) protect the security and integrity of the platform. If you no longer wish to receive non-essential communications, you can follow the unsubscribe instructions included in those emails.

4. Information sharing and disclosure

Your use of the Service. Some of your information is shared by design with other marketplace users: an expert's public profile is visible to clients, and when a session is booked the expert and the client receive each other's name, email, and the details needed to hold it (including the calendar event and the Google Meet link). Under no circumstances will we sell your Personal Information to third parties.

Service providers. We use trusted third parties to operate the Service; they access your information only to perform tasks on our behalf and under obligations equivalent to this Policy: Stripe (payment processing and payouts), Google (authentication, calendar, and video calls), Resend (transactional email delivery), and Render (application and database hosting).

Legal compliance. We may disclose information when we have a good-faith belief that disclosure is reasonably necessary to (a) comply with a law, regulation, or compulsory legal request; (b) protect the safety of any person; (c) prevent fraud or abuse of the Service; or (d) protect Kiseki's property rights.

Business transfers. If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction; we will notify you (for example, via email and/or a prominent notice on the Site) of any change in control or use of your information.

Aggregated information. We may disclose aggregated or otherwise non-personal information, such as usage statistics of the Service.

5. Changing or deleting your information

You can access and modify the Personal Information associated with your account from your profile settings, or by writing to go@gokiseki.com. If you want us to delete your Personal Information and your account, contact us at the same address. We will take steps to delete your information as soon as practicable, though some of it may remain in backup or archived copies for our records or as required by law.

6. Data retention

We will retain your information for as long as your account is active or as needed to provide you the Service. We may retain and use your information as necessary to comply with legal obligations (for example, tax records of payments), resolve disputes, and enforce our agreements. Google Calendar tokens are deleted when you disconnect the calendar or delete your account, as described in section 2.

7. Security

The security of your information is important to us. All communication with the Service is encrypted in transit via TLS, sensitive credentials (such as calendar tokens) are encrypted at rest, and access to production data is restricted. No method of electronic transmission or storage is 100% secure, however, so we cannot guarantee absolute security. If you have questions about security, write to go@gokiseki.com.

8. Minors

The Service is aimed at professionals and companies. It is not intended for anyone under 18 years of age and we do not knowingly collect information from minors. If you believe a minor has provided us Personal Information, contact us so we can delete it.

9. Changes to this Privacy Policy

This Privacy Policy may change from time to time; the most current version will always be posted on this page. If a change is material, we will provide notice (for example, via email or a prominent notice on the Site). By continuing to use the Service after those changes become effective, you agree to be bound by the revised Policy.

10. Contact

If you have any questions about this Privacy Policy, contact us at go@gokiseki.com.