Privacy Policy

Smith (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our Platform at aismiths.cloud.

By using Smith, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

Information you provide directly:

• Account data — name, email address, password, profile photo
• Expert application data — work history, project stories, portfolio links, GitHub/GitLab URLs, hourly rate, AI tools used, and other application fields
• Payment data — billing details and payout information processed and stored by our payment processor (Stripe); we do not store raw card numbers
• Communications — messages sent through the Platform between Clients and Experts, support requests, and feedback
• Reviews and ratings — content you submit about other users

Information collected automatically:

• Usage data — pages visited, features used, clicks, session duration, search queries
• Device & browser data — IP address, browser type, operating system, device identifiers
• Cookies and similar technologies — see Section 6

Information from third parties:

• OAuth providers — if you sign in via Google or GitHub, we receive basic profile information (name, email, avatar) from that provider
• Payment processors — transaction confirmations and fraud signals from Stripe

We use collected information to:

• Create and manage your account, and verify your identity
• Facilitate connections between Clients and Experts
• Process payments, hold escrow, and disburse funds
• Review and score Expert applications (including AI-assisted scoring) to maintain platform quality
• Provide customer support and resolve disputes
• Send transactional emails (account confirmation, payment receipts, status updates)
• Send platform updates and marketing communications (you may opt out at any time)
• Detect and prevent fraud, abuse, and policy violations
• Improve the Platform through analytics and user research
• Comply with legal obligations

AI-assisted processing. We use automated systems, including AI models, to review Expert applications and help assess quality and fit. Automated decisions may affect whether an application is advanced for human review. You may contact us to request human review of any automated decision that significantly affects you.

We do not sell your personal information. We share information only as described below:

• Other users — Expert profiles (name, bio, skills, portfolio, ratings) are visible to Clients. Client names and project details are visible to Experts you engage with.
• Service providers — We share data with vendors who help us operate the Platform: Stripe (payments and payouts), Supabase (database and authentication), Vercel (web hosting), Fly.io (API infrastructure), and Resend (transactional email). These vendors process data only on our behalf and under confidentiality obligations.
• Legal compliance — We may disclose information when required by law, subpoena, or governmental authority, or to protect the rights, property, or safety of Smith, our users, or the public.
• Business transfers — In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• With your consent — We may share information for other purposes with your explicit consent.

We retain your personal information for as long as your account is active or as needed to provide services, resolve disputes, enforce agreements, and comply with legal obligations. When you delete your account, we remove or anonymize your personal data within 90 days, except where retention is required by law (e.g., financial records, which are retained for 7 years).

Unverified Expert applications (status: pending_verification) that are more than 90 days old may be automatically purged.

We use cookies and similar technologies for:

• Authentication — keeping you signed in securely
• Preferences — remembering your settings
• Analytics — understanding how the Platform is used (aggregated, not individually identified)

We do not use third-party advertising cookies. You can control cookies through your browser settings. Disabling authentication cookies will prevent you from staying signed in.

We implement industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS), encrypted storage of sensitive data, and access controls. However, no system is completely secure, and we cannot guarantee absolute security.

If you believe your account has been compromised, contact us immediately at security@aismiths.cloud.

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the data we hold about you
• Correction — request that inaccurate data be corrected
• Deletion — request deletion of your personal data (subject to legal retention requirements)
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Opt-out of marketing — unsubscribe via the link in any email or by contacting us

To exercise any of these rights, email privacy@aismiths.cloud with subject line matching your request (e.g. “Data Deletion Request” or “Data Access Request”). We will respond within 30 days. We may ask you to verify your identity before processing the request.

California Residents (CCPA). California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected and how it is used, the right to delete personal information, and the right to opt out of the sale of personal information (we do not sell personal information). Contact us at privacy@aismiths.cloud. We will respond within 45 days.

If you are located in the EU, EEA, or United Kingdom, this section applies to you in addition to Section 8.

Lawful basis for processing. We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — account creation and login, matching Clients with Experts, processing payments and disbursing payouts, dispute resolution, delivering transactional emails (receipts, status updates, alerts).
• Legitimate interests (Art. 6(1)(f)) — fraud detection and platform security, analytics to improve the Platform, AI-assisted application scoring to maintain quality standards, automated decisions on application advancement (you may request human review of any such decision by emailing privacy@aismiths.cloud).
• Legal obligation (Art. 6(1)(c)) — retaining financial transaction records for 7 years as required under applicable accounting and tax law.
• Consent (Art. 6(1)(a)) — sending marketing or promotional communications. You may withdraw consent at any time by clicking “Unsubscribe” in any marketing email or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Data deletion request process. To request deletion of your personal data:

1. Email privacy@aismiths.cloud with subject “Data Deletion Request” from your registered email address.
2. We will verify your identity and confirm receipt within 5 business days.
3. We will delete or anonymize your personal data within 30 days, and confirm completion by email.
4. Data we are required to retain by law (financial records, 7 years) will be noted in our confirmation. That data will be held securely and used solely to meet legal obligations.

Note: deleting your account via the Platform settings initiates the same process automatically.

Right to lodge a complaint. You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. For UK residents, the relevant authority is the Information Commissioner's Office (ico.org.uk).

Smith is operated from the United States. If you access the Platform from the EU, EEA, or UK, your personal data will be transferred to and processed in the United States.

We rely on the following safeguards for international transfers:

• Standard Contractual Clauses (SCCs) — our primary sub-processors (Supabase, Vercel, Fly.io, Stripe, Resend) have executed EU Standard Contractual Clauses with us or operate under their own GDPR-compliant transfer mechanisms, including SCCs and/or participation in approved certification frameworks.

You may request a copy of the relevant transfer safeguards by emailing privacy@aismiths.cloud.

The Platform is not directed to children under 18. We do not knowingly collect personal information from minors. If we learn we have collected information from a minor, we will promptly delete it. If you believe a minor has provided us information, contact us at privacy@aismiths.cloud.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal information.

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a prominent notice on the Platform. The updated policy will be effective on the date indicated. Your continued use after that date constitutes acceptance of the changes.

For privacy questions, requests, or concerns, contact our Privacy team at:

Email: privacy@aismiths.cloud
General support: support@aismiths.cloud