Privacy Policy

1. Who we are

[Nerve legal entity name], [Registered address], is the controller of the personal data described here as “Nerve data” (account and site data). When we process personal data inside a customer’s workspace on that customer’s behalf, the customer is the controller and we are its processor under the Data Processing Addendum.

Contact: [privacy@your-domain].

2. What we collect

We collect only what we need:

• Account data: name, work email, organization, role, sign-in method and authentication records.
• Workspace activity we need to run and secure the service: audit events, usage and operational logs.
• Billing data, where you pay: handled by our payment provider; we do not store full card numbers.
• Messages you send us, such as support or contact requests.
• Technical data: IP address and device information in security and operational logs.

3. Customer Data

Documents, conversations, leads and similar content that customers put into Nerve, including personal data of their own customers, belong to the customer. We process it only on the customer’s instructions to provide the service. Visitors to a customer’s widget or site should read that customer’s privacy notice.

4. How we use it, and our legal bases

We use personal data to:

• provide, secure and support the service (contract, legitimate interests);
• bill and administer accounts (contract, legal obligation);
• communicate about the service, including security and changes to terms (contract, legitimate interests);
• prevent abuse and fraud, and meet legal duties (legitimate interests, legal obligation);
• send product news where you chose it, which you can stop at any time (consent).

5. AI providers

Agents send the content they need to the AI provider each customer configures. That provider processes it under its own terms and, where it acts for the customer, a data processing agreement. We do not use Customer Data to train AI models.

6. Who we share it with

Service providers that help us run Nerve (hosting, email, payments, support), listed on the Subprocessors page; professional advisers; authorities when the law requires; and a successor in a merger or sale of the business, with notice. We do not sell personal data and do not share it for advertising.

7. International transfers

Where personal data leaves your region, we rely on lawful transfer mechanisms such as standard contractual clauses and adequacy decisions, and describe them in the Data Processing Addendum.

8. How long we keep it

We keep account data while the account is active and for a limited period afterwards for legal, tax and security reasons. Customers control retention of Customer Data in their workspace and can delete it; deletion on termination follows the Terms of Service.

9. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict processing, withdraw consent, and complain to your data protection authority. Write to [privacy@your-domain]. If your data is in a customer’s workspace, we will pass your request to that customer.

10. Cookies

See the Cookie Policy. In short: essential cookies only, and no advertising or analytics trackers on this site.

11. Security

We protect personal data with encryption in transit, access controls, audit logging and isolation between workspaces. No system is perfectly secure; we will notify affected customers and authorities of breaches as the law requires.

12. Children

Nerve is not for children under 18, and we do not knowingly collect their data.

13. Changes

We will post updates here and give notice of material changes.