Privacy
Privacy Policy
Effective date: October 22, 2026 · nervecorehq.com
NERVECOREHQ (PTY) LTD (registration number 2026/623407/07), trading as NerveCore HQ (“we”, “us”, or “our”), operates the platform available at nervecorehq.com (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data. By accessing or using the Service you agree to this Policy. If you do not agree, please stop using the Service.
Information We Collect
1.1 Information you provide directly
- Account data. Full name, email address, and password (or OAuth credentials) when you create an account.
- Workspace data. Business name, description, goals, tone of voice, ideal customer profile, and any configuration you enter when setting up your workspace.
- Content. Messages, prompts, task inputs, agent configurations, system prompts, and any files or images you upload to the Service.
- Payment data. Billing name, address, and card details processed by Paystack. We never store raw card numbers on our own servers.
- Communications. Any emails or support requests you send to us.
1.2 Information collected automatically
- Usage data. Features used and actions taken within the Service, and page views on shop pages we host for you, with the site each visitor came from.
- Log data. IP address, browser type and version, device identifiers, referring URLs, and timestamps.
- Cookies. Session cookies required for authentication, and a cookie that remembers which workspace you are in. We do not use analytics cookies.
- Agent activity logs. Records of tasks dispatched, agent outputs, approval decisions, and memory entries generated by your agents.
1.3 Information from third-party integrations
When you connect a third-party service (e.g. Gmail, Facebook Pages), we receive an OAuth access token and the minimum data required to operate that integration on your behalf. Tokens we hold are stored in AES-256-GCM encrypted form; apps you connect through Composio are held by Composio (see section 3). We do not read or store third-party data beyond what is necessary to complete the tasks you request.
How We Use Your Information
- Provide, operate, and improve the Service.
- Authenticate your identity and maintain your session.
- Execute agent tasks you initiate, including calling connected third-party APIs on your behalf.
- Store agent memory and task history so your agents accumulate context over time.
- Send transactional notifications — task completions, approval alerts, and account communications.
- Process billing and enforce subscription limits.
- Monitor system health, debug errors, and prevent abuse.
- Analyse aggregate, anonymised usage patterns to guide product decisions.
- Comply with legal obligations and enforce our Terms of Service.
We do not use your content to train AI models. We do not sell your personal data.
Third-Party Services
The Service integrates with the following third-party providers. Each processes data under its own privacy policy, which we encourage you to review before connecting an integration.
Powers AI responses in the Service, on our API key or one you provide. Prompts and task outputs are transmitted to Anthropic's API, which Anthropic does not use to train models by default. If you run NerveCore on your own Claude plan, those requests go to Anthropic under your own account.
Used for image generation (gpt-image-1), for the embeddings behind memory search, and for AI responses where you connect your own OpenAI key. If you run NerveCore on your own ChatGPT plan, those requests go to OpenAI under your own account.
When you connect a Facebook Page or Instagram account, we store an access token (encrypted) and use it, through the Meta Graph API, to read posts, comments, messages and lead-form entries, publish content you approve, and run ads you approve. If you switch on results measurement in Ads Studio, paid orders on your NerveCore shop are reported to Meta's Conversions API, with the customer's email and phone number hashed.
When you connect your WhatsApp Business number through Meta's signup window, we store an access token (encrypted) and receive the messages your customers send to that number, so you can see each conversation in one place. If you keep using the WhatsApp Business app on the same number, we also receive the messages you send from the app and, only if you choose to share them when connecting, up to six months of your one-to-one chats and your WhatsApp contacts. Group chats are never shared with us. We send messages from your number only when you, or an assistant you have switched on, send them, and we create message templates only when you ask. Disconnecting stops all of this; you can ask us to delete the stored messages at any time.
When you connect Gmail, we store OAuth tokens (encrypted) and use them to read, draft, and send emails on your behalf. We access only the scopes you explicitly grant. Google Calendar connects through Composio. Google Places is used to look up public business listings.
Connects the other apps you choose, such as LinkedIn, Google Calendar and Calendly. Composio holds those connections' access tokens and carries out the actions you ask for or approve.
If you link your own Telegram bot, your front desk sends you its messages, approval cards and briefings there, and reads your replies. The bot's token is stored encrypted.
Used for AI text-to-speech synthesis. Text content may be transmitted to ElevenLabs to generate audio responses within the Service.
Runs some long drafting tasks, such as outreach drafts, on an open model. The prompt, which can include a lead's details, is transmitted to Together AI's API.
Video and image generation, when you make a video. The script and any pictures you give it are sent to them, on your own account where you have added your own key (fal.ai's policy: fal.ai/legal/privacy-policy).
Research tools the assistant uses when you ask it to: Serper searches the web, Firecrawl reads a public web page, and Hunter finds a business's published email addresses. Your search terms, the page address or the business's domain are sent to them (firecrawl.dev/privacy-policy, hunter.io/privacy-policy).
Handles user authentication and session management. Stores your email address and hashed credentials.
Our primary database and file storage provider. Data is stored in encrypted, SOC 2-compliant infrastructure.
Holds the search index for your workspace's memory: the text of each memory entry and its embedding, kept apart per workspace.
Fast storage for queues, caching and rate limits. It holds IP addresses for rate limiting, and messages waiting for your desktop app to pick them up.
Processes card payments to NerveCore HQ, such as subscriptions and website plans. We share only the minimum data required to create and manage your billing account.
If your shop takes card payments, your customers pay through your own Yoco account on Yoco's own page. We record the order and receive Yoco's payment confirmation; we never see card numbers.
Hosts the Service frontend. Vercel may process request metadata (IP address, headers) in the course of serving web traffic.
Data Storage and Security
We implement the following safeguards:
- AES-256-GCM encryption at rest of the access tokens and keys we store. Connections made through Composio are held by Composio.
- TLS 1.2+ for all data in transit between your browser, our servers, and third-party APIs.
- Every data request in our server code is scoped to your workspace.
- Principle of least privilege applied to all internal service accounts and API keys.
- A 24-hour incident response target for security events.
Your workspace database is hosted in the European Union (Frankfurt, Germany). Some of the subprocessors listed in section 3 process data in the United States. Where personal information leaves South Africa we rely on the conditions in section 72 of POPIA, including recipients bound by binding agreements that uphold principles of lawful processing substantially similar to POPIA. See section 8.
No system is completely secure. If you believe your account has been compromised, contact us immediately at legal@nervecorehq.com.
Data Retention
- Account and workspace data is retained for as long as your account is active. Upon account deletion we remove or anonymise personal data within 30 days, subject to legal hold obligations.
- Agent memory and task logs are retained for the lifetime of your workspace. To have memory entries or all workspace data deleted, ask us (see section 7).
- Memory with an end date. Memory entries are kept for good unless you ask for an end date (24 hours or 30 days). An ended entry stops being used and is kept until you ask us to delete it.
- WhatsApp messages are kept until you delete them, or for 90 days or 12 months if you choose that under Front Desk → Privacy, where you can also disconnect and delete your WhatsApp data yourself.
- Billing records are retained for 7 years to satisfy financial reporting obligations, even after account deletion.
Cookies
- Strictly necessary. Session and authentication cookies set by Clerk. Required to use the Service and cannot be disabled.
We do not use analytics or advertising cookies, retargeting pixels, or sell data to ad networks.
Your Rights
We are a South African business, and the Protection of Personal Information Act 4 of 2013 (“POPIA”) applies to how we handle your personal information. Under POPIA, and under other data protection laws that may apply to you, you have the following rights:
- Access. Request a copy of the personal data we hold about you.
- Correction. Request that we correct inaccurate or incomplete data.
- Deletion. Request deletion of your personal data. Ask us on WhatsApp at 066 579 4855 or by email; there is no self-service account deletion yet. See also our Data Deletion page.
- Portability. Request an export of your data in a structured, machine-readable format.
- Restriction. Request that we restrict processing of your data in certain circumstances.
- Objection. Object to processing based on our legitimate interests.
- Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email legal@nervecorehq.com. We will respond within 30 days. We may need to verify your identity before processing a request.
POPIA — South African Data Protection
8.1 Who is responsible for your data
NerveCore HQ is a South African business. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). For the personal information of our own users — your name, email, billing details and account activity — we are the responsible party.
8.2 Your customers' data: you are responsible, we are the operator
This distinction matters, so we state it plainly. When you use the Service to process information about your customers, suppliers and contacts — messages, contact details, documents — you are the responsible party for that information and we act as your operator, processing it only on your documented instructions.
That means the obligations under POPIA to have a lawful basis, to notify the people concerned, and to obtain any consent required, rest with you. Section 21 of POPIA requires a written agreement between a responsible party and its operator. If you require one, email legal@nervecorehq.com and we will conclude one with you at no charge.
We do not use your customers' information for our own purposes. We do not sell it, we do not use it to market to them, and we do not use it to train AI models. See section 3 for what our AI providers are contractually prohibited from doing with it.
8.3 Information Officer
As required by POPIA, our Information Officer is the head of the business, contactable at legal@nervecorehq.com. Requests for access to information, and any query about how we handle personal information, should be sent there.
8.4 Sending information outside South Africa
Our infrastructure is hosted outside South Africa, as set out in section 4. Section 72 of POPIA permits this where the recipient is subject to binding rules or an agreement that upholds principles of lawful processing substantially similar to POPIA. Our hosting and AI providers are engaged under written terms that impose those protections, and our primary databases are located in the European Union rather than a jurisdiction without comparable law.
8.5 Direct marketing
Section 69 of POPIA restricts unsolicited electronic direct marketing. We will only send you marketing about our own products where you are an existing customer or you have consented, and every message includes a way to opt out. If you use the Service to send marketing to your own contacts, obtaining the consent that section 69 requires is your responsibility, not ours.
8.6 Requests from police and government
We do not hand over your data, or your customers' data, just because someone asks. When a public authority asks for personal information we hold:
- We check that it is lawful. The request must be in writing and backed by a valid legal process, such as a court order or subpoena, before we act on it.
- We challenge it if it is not. A request that is unlawful, too broad or unclear is refused or challenged.
- We hand over only the minimum. If we must comply, we disclose only what the order specifically requires.
- We keep a record. Every request is documented: who asked, what for, the legal basis and how we responded.
8.7 Complaints
If you believe we have handled your personal information unlawfully, please raise it with us first at legal@nervecorehq.com so we can put it right. You are also entitled to complain directly to the Information Regulator:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Tel: 010 023 5200 · Toll free: 0800 017 160
enquiries@inforegulator.org.zaChildren's Privacy
The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date at the top of this page and, where appropriate, by sending an email to the address on your account. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
Contact
For privacy-related questions or to exercise your rights: