Privacy Policy
How Nerivo AI collects, uses, stores, and deletes personal information — including AI prompts, uploaded files, research requests, and the third-party providers involved.
In short
This policy explains what we actually store about you, where it is stored, which third parties process it to answer your requests, how long we keep it, and how to make a request about your data.
Some details in this document are still marked as pending confirmation and appear in square brackets. They are left deliberately visible rather than filled in with assumed values.
1. Scope and Who We Are
This Privacy Policy explains how Noveriks Team ("we", "us", "our") handles personal information in connection with Nerivo AI (the "Service"), available at https://www.nerivo.noveriks.com.
It describes how we handle personal information and the rights that may apply to you under applicable law.
For the purposes of laws that use these terms, we act as the controller of the personal information described here, and our service providers act as processors on our behalf unless stated otherwise. Where a third-party AI provider processes a request under its own terms, that provider may act as an independent controller of that processing.
- Legal entity: [LEGAL ENTITY NAME]
- Registered address: [REGISTERED ADDRESS]
- Contact: [CONTACT EMAIL]
- Data protection contact: [DATA PROTECTION CONTACT]
This policy does not cover third-party websites you reach through Deep Research, or third-party services you choose to connect. Their own privacy practices apply.
2. Information We Collect — Overview
We collect information in three ways:
- Information you give us directly, such as when you register or complete your profile.
- Information created when you use the Service, such as your conversations, research requests, and uploaded files.
- Information collected automatically, such as limited technical and usage data recorded by the Service, our hosting, and our analytics tools.
We do not ask for special-category data (such as health, biometric, or political data) and ask that you do not submit it. The Service is a general-purpose assistant, not a system designed for sensitive categories of information.
3. Information You Provide
Account and profile information. When you register or complete your profile, we collect:
- your email address
- a display name
- an avatar URL, if you supply one
- a short biography, if you complete it
- skills, location, website, and social links, if you complete them
- the authentication method you used (email and password, or a Google account)
Your password is handled by our authentication provider. We do not store your password in a readable form and we cannot read it.
Communications. If you contact us — for example through the contact form or live chat — we collect the content of that message, your contact details, and any information you choose to include.
Content you submit for processing. This includes prompts, instructions, messages, images, and documents you provide in order to use a feature.
Content you publish. If you comment on or react to community and blog content, we store the comment text, your display name, and your account identifier.
4. Information Created When You Use the Service
Conversation history. When you chat with the Service, we store the conversation so you can return to it. A stored conversation contains a conversation identifier, a title, the messages exchanged, and timestamps.
Memory and personalisation data. If you are signed in and the personalisation feature is enabled, the Service builds a memory object from your interactions. This can include inferred preferences, recurring topics, patterns drawn from your conversations, and short factual notes the Service has chosen to remember about your context.
Research records. Deep Research requests and the resulting report are stored as part of the conversation in which they were created.
Support records. Live chat support sessions store a session identifier, the name and email you provide, session status, message content, timestamps, and unread counters.
Preferences. Settings such as your selected model, theme, temperature, voice and sidebar preferences, and whether a feature is enabled are stored so the Service behaves consistently between visits. Most of these are stored only in your browser.
Local analytics on your device. The Service records some product-usage events in your browser. These are used to understand feature use within your own session and are not transmitted to us as a separate analytics feed.
5. Automatically Collected Information
Our hosting, authentication, database, and analytics providers automatically record limited technical information when the Service is used. This may include the page or feature requested, timestamps, approximate location derived from IP address, browser and device type, referring page, and error and diagnostic information.
This information is used to operate and secure the Service, to diagnose faults, and to understand aggregate usage.
We do not use this information to build advertising profiles, and we do not sell it.
6. AI Prompts and Responses
When you send a message, your prompt — together with the conversation context the Service sends to the model, which may include earlier messages in the same conversation, your selected model, and any system instructions or personalisation context — is transmitted to a third-party AI provider so that a response can be generated.
The response is returned to the Service and stored as part of your conversation, where it forms the conversation history described above.
Prompts and responses are not written to our own request logs. Our AI relay is designed to record operational metadata (such as which model was used, whether the request succeeded, and how long it took) rather than the content of your prompts or the model’s answers.
How a third-party AI provider handles a request once it receives it — including whether it is temporarily retained, reviewed, or used to improve that provider’s models — is governed by that provider’s terms and privacy policy, not by this document.
7. Uploaded Files and Images
You can attach images for the Service to analyse. When you do, the image is read in your browser, prepared for transmission, and sent to the AI provider handling that request.
- We do not operate a file-hosting or object-storage service, and we do not keep a separate library of your uploaded files.
- Attached images are not stored as a file library; they are transmitted to answer your request.
- An image can remain within the conversation record if it becomes part of the conversation history.
- Some legacy image-analysis endpoints exist in the codebase but are not used by the current chat experience.
Do not upload documents or images containing information you are not permitted to share, including other people’s personal data.
8. Research Requests and Deep Research
When you run Deep Research, the Service processes your request as follows:
- Your request is interpreted and turned into a research plan.
- Search queries are generated and issued through a search service to discover candidate sources.
- Publicly reachable pages are retrieved and read.
- Relevant content is extracted and compared against your requirements.
- A report is assembled and returned to you, then stored as part of the conversation.
Your research query is transmitted to the search and AI providers used to carry out the research. Page content retrieved from external websites is processed by the Service to extract findings; external page content is not forwarded to AI providers as raw page text.
Our research backend records operational metadata about a run — such as its identifier, status, counts, and duration — and deliberately records the size of a query rather than its text.
Our systems do not store a separate, long-lived research archive beyond the conversation the report is saved into.
Websites you reach through Deep Research receive the request from our systems, not from your browser, and they may record it under their own privacy practices.
10. How We Use Information
We use personal information to:
- provide the Service and generate responses to your requests
- maintain your account and authenticate you
- store and display your conversation history and preferences
- operate Deep Research and return results
- provide support and respond to enquiries
- operate, secure, and troubleshoot the Service
- detect, investigate, and prevent abuse, fraud, and security incidents
- enforce our Terms and Acceptable Use Policy
- comply with legal obligations and respond to lawful requests
- understand aggregate usage so we can improve the Service
We do not use your content to serve advertising, and we do not sell personal information.
11. Legal Bases for Processing
Where a legal framework such as the GDPR or UK GDPR applies, we rely on the following bases:
- Contract — to provide the Service you have asked for, including generating responses, storing your conversations, and operating Deep Research.
- Legitimate interests — to secure the Service, prevent abuse, fix faults, and improve features, balanced against your rights; and to keep records of support requests.
- Consent — where we ask for it, for example for optional cookies or optional personalisation features. You may withdraw consent at any time.
- Legal obligation — where we must retain or disclose information to comply with the law.
Where processing relies on consent, refusing or withdrawing it does not affect the lawfulness of processing carried out before withdrawal.
12. AI Processing
The Service uses third-party AI models. Requests are relayed through a server-side proxy so that credentials are never exposed to your browser.
Depending on the feature you use, the following categories of provider may be involved:
- A model-routing provider that delivers chat, reasoning, and image-analysis requests to the selected AI model.
- A first-party cloud AI provider used for research reasoning and for the web-search grounding step of Deep Research.
- An additional speech-to-text or model provider used by specific features, where enabled.
- A third-party code-execution sandbox used only when you choose to run code.
Some providers may process data outside your country. See International Data Transfers below.
13. Model Training and Improvement
We do not ourselves train foundation models, and we do not operate a model-training pipeline on your content.
The Service does contain optional personalisation features that learn from your own interactions in order to make your experience consistent between sessions. That personalisation is stored within your account, is used to shape your own future responses, and is not used to train a shared model for other users.
14. Service Providers
We use third-party providers to operate the Service. The categories currently in use are:
- Cloud AI model providers — to generate chat, reasoning, and image-analysis output, and to perform the grounded search step of Deep Research.
- Server-side relay — to forward AI requests without exposing credentials to the browser.
- Authentication provider — to register and authenticate accounts, and to send account emails such as password resets.
- Cloud database provider — to store account data, conversations, and profile information.
- Email delivery provider — to deliver contact-form messages and support notifications.
- Code-execution sandbox — to run code you explicitly choose to execute.
- Public search providers — to discover web sources for Deep Research.
- Analytics and tag-management services — to measure aggregate usage.
- Font and content-delivery services — to render the interface.
These providers process information on our behalf or, in the case of AI providers acting under their own terms, under their own responsibility. We expect providers to protect information consistently with this policy and applicable law.
A list of the specific providers and their roles is maintained in the accompanying gap analysis, which records the corresponding implementation evidence.
16. International Data Transfers
Our providers operate globally. Information may therefore be stored and processed in countries other than your own, including countries whose data-protection laws differ from yours.
Where we transfer personal information internationally, we rely on the safeguards made available by the relevant framework and providers, such as standard contractual clauses or an equivalent approved mechanism.
17. Data Retention
We keep personal information for as long as it is needed to provide the Service and for the purposes described in this policy.
- Account and profile information — retained while your account is active.
- Conversations, including research reports — retained while your account is active, or until you delete them.
- Personalisation memory — retained while it is enabled and while your account is active.
- Support sessions and messages — retained so that support history remains available.
- Blog comments and reactions — retained while the content remains published, or until removed.
- Operational logs — retained for a limited period for security and troubleshooting.
18. Data Deletion and Your Choices
You can delete individual conversations from within the Service. Deleting a conversation removes that conversation from your history.
Deleting a conversation also removes the source material for personalisation derived from it, but automatic memory that has already been generated may persist separately until it is cleared or the account is deleted.
Individual message deletion is not currently supported, and conversation records are not editable at the message level.
You can also clear the preferences and settings stored in your own browser at any time through your browser’s storage controls, and you can turn off optional features such as personalisation.
- To request a copy of your data, send an email to the contact address below.
- To request correction of inaccurate account information, update it in your profile or contact us.
- To request deletion beyond what the interface supports, contact us.
- To object to processing based on legitimate interests, contact us.
19. Account Deletion
Self-service deletion of a whole account is not currently available in the product. This is an implementation gap, and it is recorded as such in the accompanying analysis.
If you ask us to delete your account, we will remove the personal information associated with it, including your profile, conversations, personalisation memory, and support records, except where we are required or permitted to retain specific records — for example to comply with a legal obligation, to resolve a dispute, or to prevent abuse.
Because deletion is handled as a request rather than through the interface, please allow a reasonable period for it to be completed, and contact us if you do not receive confirmation.
20. Security
We take reasonable technical and organisational measures to protect personal information. These include:
- Authenticated access to account data, with access rules that restrict each user’s records to that user.
- AI provider credentials held server-side and never exposed to the browser, with requests relayed through a proxy.
- Administrative access restricted to authorised accounts with defined roles.
- Server-side validation of outbound requests made by Deep Research, including protections against requests to internal or private network addresses.
- Limits on the size and type of content retrieved during research, and time limits on outbound requests.
- Transport encryption between your browser and the Service.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.
21. Children's Privacy
The Service is not directed to children and is not intended for use by anyone below the minimum age described in our Terms.
We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to remove it.
Where local law requires parental consent for a young person to use a service of this kind, that consent must be obtained before use.
22. Your Privacy Rights
Depending on where you live, you may have some or all of the following rights in relation to your personal information:
- to be informed about how your information is used
- to access a copy of your information
- to correct inaccurate information
- to request deletion
- to restrict or object to certain processing
- to data portability, where technically feasible
- to withdraw consent where processing is based on consent
- to lodge a complaint with a supervisory authority
To exercise a right, contact us at the address in the contact section. We may need to verify your identity before acting. We will respond within the period required by applicable law.
You will not be discriminated against for exercising your rights.
23. Regional Privacy Rights
European Economic Area, UK, and Switzerland
Where the GDPR or UK GDPR applies, you have the rights listed above and you may lodge a complaint with your local supervisory authority. Where we rely on legitimate interests, you may object to that processing. Where we rely on consent, you may withdraw it at any time.
California and other United States privacy laws
Where the CCPA/CPRA or a comparable state law applies, you may have the right to know what personal information is collected, used, or disclosed; to request deletion; to correct inaccurate information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. We do not sell personal information.
The analytics services described in our Cookie Policy may involve the disclosure of identifiers to a third party for measurement purposes, which certain laws treat as "sharing" even where no money changes hands. We are reviewing how that is configured and how opt-out signals are handled.
Other jurisdictions
If you live elsewhere, you may have comparable rights under your local law. We will honour requests that applicable law requires us to honour.
24. Do Not Sell or Share
We do not sell personal information for money.
As noted above, identifiers may be disclosed to analytics providers. Where a law treats that as "sharing", we will honour a valid opt-out preference signal or request submitted to the contact address below.
25. International Users
The Service is operated from the location of the operator identified in section 1 of these documents and delivered through providers in multiple countries. If you use the Service from outside that location, your information will be transferred to and processed in jurisdictions that may not provide the same level of protection as your own.
By using the Service, you understand that your information may be processed as described in this policy.
26. Changes to This Privacy Policy
We may update this policy to reflect changes in the Service, in our providers, or in the law. When we make material changes, we will take reasonable steps to inform you, and we will update the date at the top of this document.
Continuing to use the Service after an update takes effect means you accept the revised policy.
27. Contact
For privacy questions, data requests, or complaints, contact us at:
- Email: help.mahinulislam@gmail.com
- Legal entity: [LEGAL ENTITY NAME]
- Registered address: [REGISTERED ADDRESS]
- Data protection contact: [DATA PROTECTION CONTACT]
If your request concerns a third-party provider and we are not able to resolve it, we will tell you so and, where relevant, identify the provider so you can contact it directly.
28. Definitions
- "Personal information" means information relating to an identified or identifiable person.
- "Processing" means any operation performed on personal information, such as collection, storage, use, or disclosure.
- "Controller" means the party that decides why and how personal information is processed.
- "Processor" means a party that processes personal information on a controller’s instructions.
- "Your Content" means material you submit to or create within the Service.
- "Provider" means a third-party service used to deliver any part of the Service.
