Privacy notice

Article 1. Who we are and how to reach us

For anything to do with your data — access, correction, erasure, or a question about this notice — email info@nermio.com. We have no data protection officer; one isn’t required for a company of this size handling this kind of data.

Article 2. Who and what this notice covers

This notice covers visitors to nermio.com, people who request a call or email us, businesses we approach about Nermio, and users of a Nermio account.

One distinction shapes the rest of this text, so it comes first. Nermio handles personal data in two different ways.

• Your own account and subscription. Your name, your email address, the organisation you created and what you take from us. Here Nermio decides what happens to that data, and this notice applies.
• What you put into Nermio. Your companies, contacts, deals, tasks and notes. That is your data about your business relations; you decide what you record and why, and Nermio processes it only to make the software work. For that, this notice does not apply — the data processing agreement does.

Article 3. Which data we process, why, and on what basis

What we don’t do: sell your data, pass it to third parties for advertising, or use it to train models.

Article 4. AI on your own key

AI is off until you do something about it yourself. An owner or manager can connect an API key of their own from OpenAI, Anthropic, Mistral or Google. Only then can someone on your team ask for one of three things on a company record: a summary, a suggested next step, or a draft email.

• Something goes to your provider only when someone presses one of those buttons. There is no job that walks through records on its own.
• What leaves is not the whole record but a fixed selection of fields that one function assembles. A new field in the database therefore doesn’t quietly travel with it.
• The answer appears on your screen and is not kept by us. The audit log records that there was an action and with which provider, not what was in it.
• Your key is stored encrypted (AES-GCM, with a secret that lives outside the database). A database dump without that secret yields nothing, and the screens cannot even request the encrypted value.

The processing by that AI provider falls under the arrangements you have with them, and you pay for the usage directly. They are therefore not a party we engage on your behalf.

Article 5. Sending email, and sending email to Nermio

Email out of Nermio goes from your own address and not from ours. For that you connect your mailbox: with server details, or with one button at Google or Microsoft. Those last two work with a permission you grant at your own provider and can withdraw at any moment.

• We only ask permission to send. At Google that is solely the gmail.send scope, at Microsoft Mail.Send. Reading, searching, labelling or deleting your mail is not possible — we don’t ask for those rights and without that permission the software couldn’t do it either.
• What we keep is the refresh token that lets us send, stored encrypted (AES-GCM, with a secret that lives outside the database), plus the email address itself so that you can see on your screen which address you send from. Nothing more.
• We don’t keep the content of what you send. A sent message goes straight to your provider; no copy stays behind with us. The audit log records that something was sent and to which address, not what was in it. If you send something from a company record, the subject and the first two sentences land on that company’s timeline — that is a CRM note you make yourself, and it sits in your own workspace.
• Something only goes out when someone presses a send button. There is no job that sends email on its own.
• You can withdraw it with us in one click under Settings → Email, or at your provider: at Google under Security → Your connections to third-party apps, at Microsoft under your account’s app permissions. After that Nermio can no longer send anything from that address.

Limited use of Google data. Our use and transfer of data received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We use that data solely to operate the email feature you switched on yourself. We don’t sell it, don’t use it for advertising, and don’t pass it to others — except where the law requires it. Nor do we let humans read it, except when you ask us to for support, where the law requires it, or to investigate a security incident.

Sending email to Nermio by BCC

Your organisation has a BCC address of its own. Put it in the BCC of an email to a customer and that message reaches us too, and we add a note to that company’s timeline. This is off by default in the sense that nothing happens as long as you don’t use the address: you choose it per message.

• We don’t read your mailbox. That is a deliberate design. The technical possibility exists — Google and Microsoft sell access to a whole mailbox — and we don’t ask for that permission. What we see is what you send us, message by message.
• What we keep of such a message: the subject, the first two sentences of the text, the email address of the sender and of the recipients, and the time. Not the full text, and no attachments. The whole email is in your own sent items; that is where it belongs.
• Your correspondent’s email address is someone else’s personal data. It lands in your CRM, where you are the controller — just as with a contact you enter by hand. We are the processor in that; what that means is in the data processing agreement.
• If we don’t recognise the recipient’s address, we don’t know which company it belongs to. Such a message then appears on your home screen with the question of where it belongs, and disappears after ninety days if you don’t answer. We don’t guess: a note filed against the wrong company can’t be taken back.
• It only works from an email address that belongs to your organisation, and only if the sender’s provider has confirmed with DKIM or DMARC that the address is genuine. If anyone else emails that address, nothing happens.
• A refused message leaves a trace, and no more than that. If a message arrives from an address that doesn’t belong to your organisation, we don’t accept it — but we do keep the fact that it happened: the sender’s address, how often, and when first and last. No subject, no text, no recipients. Otherwise you’d watch those messages vanish with no way of finding out why, and that is exactly what we don’t want. After ninety days without a new attempt that line goes.
• You stop by not using the address any more. There is nothing to withdraw and no permission left standing. What is already on a timeline, you remove by deleting the company or your organisation.

Technically that message travels through a group in our own Google Workspace to our email provider. That group keeps no conversation history: it passes the message on and retains nothing itself.

Article 6. How long we keep data

While your account exists we keep what you put into it, otherwise the software wouldn’t work. If you delete something in Nermio, it is gone from your workspace.

We keep nothing longer than necessary, and each kind of data has its own period. The clean-up is automated and runs every night; it is not an intention but something that happens.

Two ideas get confused, and the difference shapes this whole table. For invoices there is a retention obligation: we have to keep them for at least seven years. For personal data there is a retention limit: we may keep it for no longer than is necessary. Keeping it longer there isn’t diligence but a breach, and in a data breach simply more harm.

What happens if you stop — and what doesn’t happen yet

While your organisation is active or your trial is running, you can take your data with you as CSV yourself (Settings → Your data). If your trial ends, or you pause or cancel the subscription, the software closes access to make changes, but the export keeps working for thirty days — that window is enforced in the database itself and not only in the screens. If an organisation is blocked, it doesn’t apply and you get your data on request. Your data stays after that: there is no automatic clean-up that removes it after termination. Deleting for good is something we do by hand, at your request or when your subscription has ended, and it is recorded.

Article 7. Who we share data with

Nermio does not run on its own servers. These providers process data because the software doesn’t work without them. Beyond that we share nothing, except where the law obliges us to.

If an organisation connects an AI key of its own, something also goes to that provider on such an action. That is the customer’s provider, not ours; see article 4.

Article 8. Data outside the European Economic Area

If data goes to a country outside the EEA, that is only allowed on a valid basis: an adequacy decision, or standard contractual clauses with supplementary measures.

Article 9. How the data is secured

This is the part that is built today and that you can check. Who can reach it is the most important of it.

• Separation per organisation in the database itself. Not in the screens, but in Postgres: the database decides for every query which rows a signed-in account may see. A mistake in a page therefore cannot surface data from another organisation, and there is a test suite that demonstrates it.
• Within your organisation you see what your role allows. You invite people yourself and give them a role, from full access to read-only. That boundary too sits in the database and not in the screen.
• Two-factor authentication, for everyone. Not only for our admin portal but for every user of the CRM, without exception: without an authenticator you don’t get into your workspace.
• Automatic logout after eight hours without activity, for the laptop left open.
• An audit log that only grows. Changing or deleting a line has been made impossible, including for our highest admin role, with exactly one named exception for the clean-up.
• Support access with a reason and a time limit. Fifteen, thirty or sixty minutes, never longer, always with a stated reason, and readable afterwards by the owner of the organisation.
• A brake on login attempts that closes if it stops working itself, a password policy of at least twelve characters with a check against known breached passwords, and passwords we cannot read.
• Encrypted connections with HSTS, and a Content Security Policy with a nonce per request.

The fuller description is on the security page. What there isn’t is on there too: there is no ISO 27001 or SOC 2 report and no external penetration test report.

Article 10. Your rights

You may see which data we hold about you, have it corrected, have it erased, have the processing restricted, object, and request a copy in a common format.

Part of that you do yourself. What you put into Nermio you can change and delete there. You collect a copy under Settings → Your data: your companies, contacts, deals and tasks as CSV, a file that opens in Excel. Anyone on your team can do it, including with read-only rights, and it can be done at any time — not only when you leave.

What you can’t yet do yourself is make your whole account and your organisation disappear. We do that for you, on request via info@nermio.com; with us it is an action that requires a stated reason which stays in the security log, and it is irreversible. A button for it in the software is planned.

For everything else, email info@nermio.com. We will then ask for confirmation that you are who you say you are, otherwise someone else could request your data.

If you disagree with how we handle your data, you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority, or to the supervisory authority in the country where you live — in the UK that is the Information Commissioner’s Office. That route is always open, including if you try us first.

Article 11. No automated decisions

We don’t take decisions about you based solely on automated processing, and we don’t build profiles of you. There is no score predicting whether a deal will close and no ranking of people. The AI features in article 4 return text that a human reads and judges; they decide nothing.

Article 12. Changes

If something changes in what we record or why, this page changes with it, with the date of the change. If it is a change that matters for you, we tell you beforehand by email.