Privacy Policy
Last updated: 23 October 2026
Who we are
Xperters is a trading name of Mercle Ltd, a company registered in England and Wales (company number 12583440), registered office 20-22 Wenlock Road, London, N1 7GU. Mercle Ltd is the data controller for the personal information described in this policy. We are registered with the Information Commissioner's Office (ICO), registration number C2065669.
You can contact us about anything in this policy at hello@xperters.com.
What we collect, and why
When you register or sign in. You sign in through Microsoft Entra External ID, using either an email address and password or a Google account. We store your name, email address, which sign-in method you used, and the dates and times you first and last signed in. We use this to run your account, to show you your own requests, and to contact you about them. Lawful basis: performance of a contract (providing the service you asked for).
When you describe what you need. If you use the "Get started" journey, we store the description you type, your answers to any clarifying questions, and the proposal we send you. We use this to prepare your proposal and to run the introductory call. Lawful basis: performance of a contract.
When you book an introductory call. We store the date, time and time zone of the call, your name and email, and any notes you add. We send you a confirmation email and we add the call to our calendar. Lawful basis: performance of a contract.
When you email us. We keep the correspondence for as long as it is relevant to your enquiry or engagement. Lawful basis: legitimate interests (responding to you).
When you become a client. Any data we handle on your behalf during an engagement, such as records you ask us to enter or an inbox you ask us to manage, is covered by the separate data processing agreement you sign with us. In that work, you are the controller and Mercle Ltd is your processor. This policy covers only the information we hold about you as a user of this website and our services.
We do not collect special-category data (health, religion, and so on) and we ask you not to include it in a request description.
Artificial intelligence
When you describe what you need, we use Microsoft's Azure OpenAI Service to draft clarifying questions and a first proposal from your description. Your text is sent to Azure OpenAI for that purpose only. Microsoft does not use it to train its models, and it is processed within Microsoft's Azure platform under our agreement with Microsoft. A person at Xperters reviews every proposal before it is sent to you. No decision with a legal or similarly significant effect on you is made solely by automated means.
Who we share it with
We do not sell your information. We share it only with the service providers we need to run the website and the service, each under a contract that restricts what they can do with it:
- Microsoft (Azure hosting, Entra External ID sign-in, Azure OpenAI, Microsoft 365 email and calendar, Application Insights for error and performance monitoring). Hosted in Microsoft data centres in the United Kingdom (Azure UK South).
- Google, only if you sign in with a Google account (Google acts as your identity provider), and only after you accept non-essential cookies, for site analytics and advertising measurement (see Cookies below).
- The assistants or specialists who deliver your work, each under a written confidentiality and data-handling agreement with us. If any of them is outside the UK, we put in place the UK International Data Transfer Agreement before any access is given.
- Professional advisers and authorities where the law requires it, for example anti-money-laundering checks for bookkeeping clients.
Cookies
Essential cookies keep you signed in and remember your display preference (light or dark theme). They are set without asking because the site cannot work without them.
Non-essential cookies are set only if you choose "Accept" on the cookie banner. They are Google's:
- Google Analytics, which tells us how visitors find and use the site, for example which pages they view, whether they use a phone or a computer, and whether they reach "Get started". It is set up without Google's advertising features and does not identify you.
- The Google Ads tag, which lets us see whether an advert led to an enquiry, so we can stop paying for adverts that do not help anyone.
You can change your choice at any time from the link in the footer. If you decline, the site works exactly the same.
We do not use third-party cookies for any other purpose.
How long we keep it
| Information | Kept for |
|---|---|
| Account details | While your account is open, then 12 months, unless you ask us to delete it sooner |
| Request descriptions, AI questions and proposals | 24 months from the date of the request, so we can refer back to it if you return |
| Call bookings and confirmation emails | 24 months |
| Correspondence | 24 months after the last message |
| Client engagement records and invoices | 6 years after the engagement ends (UK tax and company law) |
| Google Analytics usage data | 14 months |
| Error and performance logs (Application Insights) | 90 days |
Your rights
Under UK GDPR you can ask us to: tell you what we hold about you; correct it; delete it; stop or restrict how we use it; give you a copy in a portable form; and you can object to processing based on legitimate interests. Email hello@xperters.com and we will respond within one month. You will not be charged.
If you are unhappy with how we have handled your information you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.
Security
Access to your information is limited to the people who need it to do their job, protected by multi-factor authentication, and removed when it is no longer needed. Client data is worked on inside the client's own systems wherever possible, so it is not copied or stored elsewhere. We never ask you to share passwords: you give access to systems by adding us as a user.
Changes
We will update this page when our practices change, and show the date at the top. Material changes to how we use your information will be emailed to registered users.