Data processing register
This is a public summary of our record of processing activities under GDPR Article 30: the categories of personal data the Nerlo platform processes, the lawful basis for each, how long we keep it, who we share it with, and how to exercise your rights. It reflects the platform as actually built — where a subsystem is named in our design but not yet live, we say so rather than describe it as if it were.
What we process, and why
Each row lists a category of personal data, the fields it covers, and the GDPR Article 6 lawful basis we rely on.
| Category | Fields | Lawful basis |
|---|---|---|
| Authentication | Email, auth provider, and provider subject id | Art. 6(1)(b) contract |
| Account identity (public) | Opaque user id, display name, avatar, bio | Art. 6(1)(b) contract |
| Localization preferences | Timezone, language | Art. 6(1)(b) contract |
| Email verification and sign-in | Email-verified state, and single-use SHA-256 token hashes for email-change and magic-link sign-in (short TTL) | Art. 6(1)(b) contract |
| Consent records | Analytics and marketing opt-in flags | Art. 6(1)(a) consent |
| Demographics (opt-in) | Country, role, company-size bucket, primary use case | Art. 6(1)(a) consent |
| Activity | Last-active timestamp, in-app notifications, dispatch logs | Art. 6(1)(b) contract + Art. 6(1)(f) legitimate interest |
| Projects and saved content | Project names/notes, favorites, watchlist subscriptions | Art. 6(1)(b) contract |
| Notification preferences | Per-event-type channel settings | Art. 6(1)(a) consent + Art. 6(1)(b) contract |
| Billing | Stripe customer id (column present but not yet populated — the billing subsystem is not live) | Art. 6(1)(b) contract + Art. 6(1)(c) legal obligation (once live) |
| Audit logs (autonomous AI decisions) | Decision records referencing servers you authored | Art. 6(1)(c) legal obligation + Art. 6(1)(f) legitimate interest |
| Pseudonymized usage signal | SHA-256 installer-token hash and country for install events | Art. 6(1)(f) legitimate interest |
| Author identity (from public manifests) | Author strings extracted from published package manifests | Art. 6(1)(f) legitimate interest |
What we never process
- No special-category data (race, health, biometrics, political or religious beliefs, and the like).
- No data about children — the service is for users 18 and over.
- No payment card numbers — Stripe is the controller for card data; we only ever see Stripe ids.
- No passwords — sign-in is OAuth (GitHub, Google) or email magic link.
- No content of private communications — there is no messaging or chat surface.
How long we keep it
| Data | Retention |
|---|---|
| Account profile and demographics | Until account deletion, plus a 14-day grace period |
| Magic-link and email-change tokens | Single-use, short TTL (email-change tokens expire in 24 hours) |
| In-app notifications | 90 days from creation |
| Audit records and AI decision logs | 24 months (audit-trail and evidence retention) |
| Pseudonymized install events | 24 months |
| Server-side HTTP access logs | 90 days |
When you delete your account, audit records that reference your user id are retained per the schedule above with your email replaced by a non-recoverable placeholder, as permitted under Article 17(3) for legal obligations and the defence of legal claims.
Who we share it with
We rely on the sub-processors and separate controllers below. A complete and current sub-processor list will be published once our geo-IP provider is selected.
- Google Cloud — Sub-processor — compute, storage, logging
- Stripe — Separate controller for payment data
- Postmark — Sub-processor — transactional and digest email
- OAuth providers (Google, GitHub) — Separate controllers for authentication
- Anthropic (Claude API) — Sub-processor — audit synthesis; no training on inputs
- Google (Gemini API) — Sub-processor — candidate classification; no training on inputs
International transfers
Our compute and storage run on Google Cloud in the United States. Cross- border transfers are covered by the EU-U.S. Data Privacy Framework where the recipient is certified, together with Standard Contractual Clauses. UK data is handled under UK GDPR.
Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Account settings let you edit your profile, change your email through a verified two-step flow, and request account deletion (with a 14-day grace period to cancel). For rights requests we cannot yet self-serve, contact us through the channel published in our privacy page.
This summary is maintained alongside our internal GDPR Article 30 register and updated as the platform changes. It describes current, verifiable practice; planned-but-unbuilt subsystems are labelled as such.