Privacy Policy

Last updated: February 18, 2026

1. Who We Are

Nerq ("we", "us") operates the nerq.ai platform. We are based in Sweden. For privacy inquiries, contact [email protected].

2. What Data We Collect

2.1 Data you provide

Data	Purpose	Legal Basis (GDPR)
AI system name & description	Compliance assessment	Legitimate interest (Art. 6(1)(f))
Email address (if provided)	Communication, account	Consent (Art. 6(1)(a))
Organization name (if provided)	Assessment context	Legitimate interest

2.2 Data we collect automatically

Data	Purpose	Legal Basis
IP address	Security, abuse prevention	Legitimate interest
Browser type & OS	Service optimization	Legitimate interest
Pages visited & timestamps	Analytics, service improvement	Legitimate interest
API usage patterns	Rate limiting, optimization	Legitimate interest

2.3 Data from public sources

We crawl publicly available data from GitHub, npm, PyPI, HuggingFace, and MCP server registries to index AI agents. This data is already publicly available and is processed under legitimate interest.

3. How We Use Your Data

We use your data to:

• Provide compliance assessments and risk classifications
• Generate trust scores for AI agents
• Improve and optimize the Service
• Prevent abuse and ensure security
• Communicate with you about the Service (if you provide contact details)

4. Data Sharing

We do not sell your personal data. We may share data with:

• Infrastructure providers (Cloudflare) for content delivery and security
• Law enforcement if required by law

We do not use third-party analytics services or advertising trackers.

5. Data Retention

• Compliance assessments: retained for service improvement unless you request deletion
• Server logs: retained for 90 days
• Public agent data: retained and updated as long as the source remains public

6. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing based on legitimate interest
• Lodge a complaint with a supervisory authority (in Sweden: IMY, integritetsskyddsmyndigheten.se)

To exercise your rights, contact [email protected]. We will respond within 30 days.

7. Cookies

We use only essential cookies required for the Service to function (session management, security). We do not use tracking cookies, advertising cookies, or third-party cookies.

8. Data Security

We implement appropriate technical measures to protect your data, including encrypted connections (TLS), access controls, and regular security reviews. However, no system is 100% secure.

9. International Transfers

Your data may be processed through Cloudflare's global network. Cloudflare maintains appropriate data protection safeguards including Standard Contractual Clauses for EU data transfers.

10. AI Processing

Our compliance assessments use AI models running on local infrastructure. Your submitted data is processed locally and is not sent to third-party AI providers. No submitted data is used to train AI models.

11. Children

The Service is not directed at individuals under 16. We do not knowingly collect data from children.

12. Changes

We may update this policy. Material changes will be posted on this page with an updated date.

13. Contact

For privacy questions or to exercise your rights:
Email: [email protected]
Supervisory Authority: Integritetsskyddsmyndigheten (IMY), Sweden — imy.se