Legal
Privacy Policy
Last updated:
The policy
Seven sections.
Data we store.
Company name, strategic objective, generated analysis results, and a vector embedding of the objective — scoped to your organization via Row Level Security. We practice data minimization. The personal data we collect includes the name, work email and organization you give on the contact form, the email address you sign in with, and the analytics described below.
Third-party tokens.
Integration tokens (e.g., NetSuite OAuth) are AES-256-GCM encrypted before storage and used only to perform actions you authorize. You may disconnect at any time, which revokes stored tokens.
AI processing.
Objectives and context are sent to model providers (Groq, and optionally an embeddings provider) to generate outputs. Live web-search signals may be retrieved to ground analysis.
Analytics.
The public site uses PostHog for product analytics. PostHog records nothing on the signed-in application’s pages, including after you move to them from the public site. On the public site, PostHog stores a pseudonymous identifier in a first-party cookie and in local storage. It records the pages you view and leave, the elements you click, how far you scroll, the browser and device details sent with each event, and the IP address your request arrives from. It also records named product events: a click on a demo, pilot or plan link, a walkthrough step reached, and a demo request sent, received or failed. These events carry labels from a fixed list (the page, the step, the plan or link, and why a request failed), never what you type into the form. Session recording, heatmaps and surveys are turned off in our code. Events reach PostHog in the United States through a proxy on our own domain. Every page, signed-in pages included, also loads Vercel Web Analytics and Speed Insights, which report page views and page-load performance to Vercel, our host. The named product events and scroll depth go to Vercel from the public site only. Both providers appear on the sub-processor register.
Audit logging.
Security-relevant actions (connections, queries) are logged for accountability and are visible to members of your organization.
Retention.
Where your organization has signed the Data Processing Addendum, the export and deletion of its customer data on termination follow its terms.
Your rights.
You may request export or deletion of your data. Deleting your account cascades removal of your analyses and connections.
Data requests, DPA inquiries, or GDPR/CCPA questions: security@thenervos.com.
Next
See who processes customer data on our behalf.
Data requests go to the security address above. To discuss a pilot, talk to us.