Privacy Policy

GetNerdo is an agentic AI learning platform — a LumaByte project — operated by LumaByte as an online service from within the European Union. For the personal data described in this policy, LumaByte is the data controller.

Where GetNerdo is provided to you through your employer, university, professional training provider or another organisation (an “Organisation”), that Organisation is the controller of the learning data it directs us to process, and we act as its processor under a data processing agreement. In that case, the Organisation’s own privacy notice governs how it uses your data, and you should also refer to it.

For any privacy question, or to exercise your rights, contact us at privacy@getnerdo.com.

This policy covers the GetNerdo website at https://getnerdo.com, the in-product tutor, agents, Lab, research and arena features, and our demo and waitlist forms. GetNerdo is currently offered as a public beta, primarily to businesses, universities and professional training providers, for adults aged 18 or over, and following a demo request. Beta features may change, and we will keep this policy current as the product evolves.

We collect only the data we need to run the service. In practice that is:

Data you give us

• Account data — your email address and authentication credentials (managed by our identity provider; passwords are never stored in plaintext), and, if you sign in with single sign-on, the subject identifier your provider returns.
• Profile data — optional details you choose to add: display name, full name, avatar, bio, pronouns, country, timezone and social links. Some of these appear on your public profile page if you complete one.
• Learning content & inputs — the messages, questions, code, files, voice recordings and other content you submit to the tutor, agents, Lab, quizzes and research tools.
• Demo & waitlist data — the email address and any details you submit when requesting a demo or joining the waitlist.
• Organisation data — if you create or join an Organisation: membership, roles, teams, cohorts and invitations.

Data we generate as you use GetNerdo

• Learning records — quiz attempts, competency and mastery estimates, spaced- repetition state, roadmap progress, artifacts you build, certificates and similar progress data.
• Usage & metering data — feature usage and request counts we record to operate limits and (where applicable) billing.
• Consent & compliance records — a record of the terms and privacy versions you accepted, with the time, IP address and user agent, kept as proof of consent.
• Audit logs — for Organisation and security events, including IP address and user agent.

Conversation history (signed-in accounts)

When you chat with the tutor while signed in, we keep a record of that conversation attached to your account: the messages you send, the tutor’s replies, the tools it ran or asked your permission to run and their results, the outcome of our answer checks, any switch between AI models made mid-answer, and the session settings in force (language, dialect, persona and chosen agent). We keep it so a session can be continued or replayed, so we can check answer quality, and so we can find and fix the tutor’s failures. Anonymous demo conversations are not written to our database; they exist only in your browser for that tab.

Data we receive automatically

• Technical data — IP address, device and browser information, and request logs, collected by our hosting and error-monitoring providers to deliver and secure the service.
• Essential cookies — a session cookie that keeps you signed in. See our Cookie Notice.

Payment data

When a paid plan applies, payments are handled by Stripe. We do not receive or store your full card number; we keep only billing metadata such as your plan, currency, subscription status and the Stripe customer reference.

Sensitive data

We do not seek special-category data (such as health, biometric or ethnicity data), and we never ask for your date of birth. Please do not submit special-category data into chats or the Lab unless it is necessary and you have a lawful basis to do so.

Under the GDPR we must have a lawful basis for each use of your data. Ours are:

• To provide the service — create your account, run the tutor and agents, track your learning, and deliver features you request. Basis: performance of our contract with you (or our processing on an Organisation’s instructions).
• To bill and prevent fraud — manage subscriptions, seats and payments. Basis: contract, and our legitimate interest in being paid and preventing abuse.
• To secure and improve the service — monitor for abuse, debug errors, and improve reliability and quality. Basis: legitimate interests, balanced against your rights.
• Marketing and demo follow-up — to respond to a demo request and send product updates you ask for. Basis: consent, or legitimate interest for business contacts, which you can withdraw at any time.
• To meet legal obligations — tax, accounting, and responding to lawful requests. Basis: legal obligation.

We do not sell your personal data, and we do not use the private content you submit to train third-party foundation models. See the next section for exactly how AI providers handle your content.

GetNerdo is an AI system. You are interacting with artificial intelligence — not a human tutor — and we tell you so plainly throughout the product, in line with the transparency duties of the EU AI Act.

• When you use the tutor, agents, Lab, voice or research features, the content you submit is sent to the AI providers listed in Who we share data with so they can generate a response, transcribe speech, or create embeddings for retrieval.
• AI output can be wrong, incomplete or outdated. It is educational assistance, not professional, legal, medical or financial advice, and you should verify anything you rely on. Where the tutor draws on live web search or our learning library, we try to show citations so you can check the source.
• We instruct our AI providers, by contract, to process your content only to provide the service to us and not to train their general models on it. Provider terms can change; we keep the sub-processor register below current.
• Voice recordings are sent for transcription and are not retained by us beyond what is needed to return the transcript and run the feature you asked for.
• For every AI model call — whether or not you are signed in — we record technical telemetry: which model answered, what the call was for, how long it took, token counts and whether it succeeded or failed. This telemetry contains no message text. Signed-in conversations are additionally kept as described in Data we collect; anonymous demo conversations are not stored.
• We do not use your conversations, uploaded code, or documents to train or fine-tune AI models — ours or anyone else's. If we ever want to, we will ask for your explicit opt-in first, and nothing changes until you say yes.

GetNerdo estimates your skills and adapts what it teaches — for example, mastery scores, spaced-repetition scheduling and roadmap recommendations. This is profiling in the GDPR sense, used to personalise your learning.

We do not use it to make decisions that produce legal or similarly significant effects about you without human involvement. Certificates and competency records are informational and learner-controlled. Where an Organisation uses GetNerdo data as an input to a decision about you (for instance grading or course access), that decision is the Organisation’s and is subject to its own policies and human review. You can ask us, or the Organisation, for an explanation of how a result was produced.

We share data with the service providers below so GetNerdo can function. Each is bound by a data processing agreement and may only act on our instructions. Optional providers run only when the related feature is enabled.

We may also disclose data to professional advisers, to a buyer in connection with a merger or acquisition (with notice), or where required by law. Stripe acts as an independent controller for payment data under its own privacy policy.

Your achievements and the Arena boards — always your choice

Your learning achievements (points, streaks, badge levels, ranks) are private by default and appear on no board until you opt in. The Arena boards are member-only: they are not shown to signed-out visitors and are not indexed for the open web. When you choose to appear on a board, we show your name as initials (for example “Y. D.”), your region, your points and streak, and your badge levels — nothing else, and no contact details ever. Showing your full name is a separate switch you control. You can leave the board at any time and opt back in later; everything you earned stays yours either way.

We are established in the EU and prefer EU/EEA processing where practical. Some providers listed above process data in the United States or other countries. For those transfers we rely on the European Commission’s Standard Contractual Clauses, an applicable adequacy decision, or equivalent safeguards. You can request a copy of the relevant safeguard by emailing privacy@getnerdo.com.

• Account, profile and learning data — kept while your account is active. When you delete your account, we delete or anonymise this data, except where we must keep limited records (see below).
• Conversation history — kept for as long as your account is active; nothing deletes it automatically before then. It is deleted together with your account, and you can delete it sooner yourself from your profile page, or ask us by emailing privacy@getnerdo.com. AI-call telemetry (which contains no message text) is kept for 90 days and then deleted automatically.
• Consent and audit records — kept for the period needed to evidence consent and for security; Organisation audit logs are kept according to the Organisation’s retention setting and then automatically swept.
• Billing records — retained as long as required by tax and accounting law (typically several years).
• Data-subject request records — kept to demonstrate that we handled requests properly, even after an account is erased.

If the GDPR applies to you, you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these, email privacy@getnerdo.com. We respond within one month, as required by Article 12(3) GDPR. If GetNerdo was provided to you by an Organisation, please direct requests to that Organisation, which we will assist as its processor.

Your conversation history is personal data, so these rights cover it too. Only your signed-in account can read it; our team can reach it only through restricted service credentials, under the safeguards described in Security. You can download a copy of it, or delete it yourself, from your profile page at any time — or ask us through the same address.

You also have the right to lodge a complaint with a data protection supervisory authority — in particular your local data protection authority in the EU/EEA country where you live or work. You can find the full list of authorities on the European Data Protection Board’s website.

We keep cookies to a minimum. GetNerdo uses a small number of strictly necessary cookies and similar storage to keep you signed in, remember your language and dialect preference, and protect requests. These do not require consent because the service cannot work without them.

We do not currently run third-party advertising cookies or cross-site tracking. If we later add optional analytics, we will ask for your consent first. Full details are in our Cookie Notice.

GetNerdo accounts are for adults aged 18 or over — including accounts provided by a university or an employer. Questions about an account? Contact privacy@getnerdo.com.

Universities, professional training providers and employers may provide GetNerdo to their adult learners and staff (aged 18 or over) under an institutional agreement. The institution confirms that every account it creates or invites belongs to someone aged 18 or over, administers those accounts, and acts as the controller for its members’ data.

GetNerdo serves learners and Organisations across the GCC. Where the Saudi Personal Data Protection Law (PDPL) or the UAE Federal Personal Data Protection Law applies, the descriptions in this policy of the data we process, our purposes, sharing, retention and your rights are intended to satisfy those laws as well. Residents of those countries have rights of access, correction and deletion equivalent to those above and can exercise them through the same contact address. Cross-border transfers are made using the safeguards described in International transfers.

We protect data with encryption in transit, row-level access controls in our database, hashed secrets and tokens, scoped service credentials, and audit logging. No system is perfectly secure, but we work to limit what we collect, who can access it, and how long we keep it. If a personal-data breach affects you, we will notify you and the relevant authority as required by law.

We will update this policy as GetNerdo evolves. When changes are material, we will notify you in-product or by email and, where the law requires, ask you to accept the new version. The current version is privacy-2026-10-13, effective 13 October 2026.

Privacy questions and data-subject requests: privacy@getnerdo.com. General enquiries: hello@getnerdo.com. GetNerdo is operated online from within the European Union by LumaByte; the quickest way to reach us is by email.