Privacy Policy

Nerro provides AI employees that answer and return phone calls for businesses. Questions about this policy, or requests about your information, go to support@nerro.si.

For calls, Nerro works on behalf of the business you called or that called you: that business decides how your information is used, and Nerro processes it for them as their service provider. For business accounts and our own website, Nerro decides how information is used.

Business accounts: name, email, password (stored only as a one-way hash), business details you enter (services, hours, policies, knowledge), team members, settings, and the plan you're on. Payment card details are handled by our payment processor and never stored by Nerro.

People who call a business: the calling number, what was said on the call as a text transcript, and details the caller gives, such as name, phone number, address, appointment times and messages. Nerro does not record call audio. Each AI employee says it is an AI assistant when it answers.

People a business calls back (leads): what the business sends us about you from its forms, lists or tools such as a CRM (for example name, phone number, email and what you asked about), the record of how you agreed to be contacted (the wording, the page and the time), and what happened on each call. Our AI employees say they are an AI and that the call is transcribed.

Do-not-call requests: if you ask a business not to be called or texted again, we keep your number on that business's do-not-call list, so the request keeps being honored.

People who contact us: the name, email, business and message you send through the Contact form or a waitlist.

Technical information: IP address, browser and device details and sign-in times, used to keep accounts secure and the service working.

To answer and return calls, book and change appointments, take messages, hand calls to a person, send confirmations, show the business what happened, keep the service secure and working, and meet our legal obligations (for example telephone and anti-fraud rules).

We don't sell personal information, we don't share it for advertising, and Nerro doesn't use call transcripts to train AI models.

Service providers that help us run Nerro:

• Cloud hosting and database run the Nerro app, website and database, in the United States.
• Telephone carriers and call audio provide phone numbers, connect calls and carry call audio and texts.
• Speech services (Deepgram) turn a caller's speech into text and your AI employee's replies into speech.
• AI model providers (xAI and Telnyx) read the conversation so far and suggest your AI employee's next reply, and help set up and train AI employees from what a business enters.
• Email delivery send account, verification and alert emails.
• Security tell people from bots on sign-up, sign-in and password-reset pages (Cloudflare Turnstile; see Cookies).
• Website analytics count visits to our public website (Google Analytics; see Cookies). Not used for advertising.

For the current list of the companies we use, email support@nerro.si.

AI processing needs your OK. Before Nerro sends what you enter (business details, knowledge, test calls, callback requests) to the AI and speech companies above, the app asks each person to allow it. You can turn it off any time in Settings, Privacy & data.

Tools a business connects, such as its calendar, CRM, job or property management software, or automation tools, receive the call or lead details that business chose to send them. A business can disconnect any of them at any time.

When the law requires it: phone carriers, the industry traceback group or authorities, for example to investigate unlawful calls, and anyone else when we must by law or to protect people from harm.

If Nerro is ever sold or merged, information would move to the new owner under this policy.

Nerro sends texts (such as appointment confirmations) only to people who called the business or agreed to be contacted. Reply STOP to stop texts from a business, or HELP for help. Message and data rates may apply. Mobile numbers and text-message consent are never shared with third parties or affiliates for marketing or promotional purposes.

Before a business's AI employees can call anyone, we ask an owner or admin for the minimum that phone carriers and US calling rules require to identify who places the calls: the legal business name, business address, website, a contact phone or email, and the business's EIN (federal tax ID), or, for a sole proprietor without one, the owner's legal name. We never ask for a Social Security number, date of birth or ID documents.

To verify the business, we check that it controls its website's domain, read a few public pages of its website for the business name, compare the business name with the US Treasury's public sanctions lists, and may check the address with the US Postal Service. If a check doesn't pass, a person at Nerro reviews the details. We record each result and decision.

We use these details only to verify the business for calling and texting, and share them only with our telephone carrier when registration requires it, and the address with the US Postal Service for the check above. The EIN is encrypted when stored and shown back only as its last four digits. Only the business's owners and admins can see or change these details.

The Nerro app uses only essential cookies: one to keep you signed in, one to remember your light or dark theme, and a short-lived one that protects connecting a calendar or other tool. The sign-in, sign-up and password-reset pages also run Cloudflare Turnstile, which may store a small value in your browser to tell people from bots. The new-employee setup keeps an unsaved draft in your browser tab until you finish or close it. There are no advertising cookies.

Our public website (not the app you sign in to) uses Google Analytics cookies to count visits and see which pages are useful. Google signals and ad personalization are off. Analytics runs only after you accept it, and never when your browser sends a Global Privacy Control signal. You can change your choice at any time with “Cookie choices” at the bottom of every page. Analytics data is deleted after 14 months.

Call transcripts and their step-by-step logs are deleted after the period the business chooses, from 30 days to 2 years (1 year by default). The call record itself (date, length, outcome, summary) stays in the business's history while its account is open. Lead details and consent records are kept while the business's account is open, so it can show how each person agreed to be contacted. Do-not-call entries are kept for as long as the business uses Nerro. Account data is kept while the account is open and deleted when it's closed, except what the law requires us to keep, such as billing records.

To see, correct, export or delete information about you, or to ask any question about it, email support@nerro.si. We reply within 45 days and may need to confirm it's you first. If you called a business that uses Nerro, or a business called you, you can also ask that business directly, since it decides how your call information is used; we'll help it respond.

Depending on where you live (for example California and other US states, or the EU and UK), you may have the right to know what we hold about you, to correct or delete it, to get a copy, to object to or limit how it's used, and to appeal our answer by replying to it. You can use an authorized agent. We won't treat you differently for using these rights.

Nerro is based in the United States, and information is processed there. If you're outside the US, your information is transferred to the US with the safeguards the law requires.

Information is encrypted in transit, connection keys and the most sensitive details are encrypted at rest, and every business's data is kept separate by database rules, not just application code. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires. More on the Security page.

Nerro is a service for businesses and isn't meant for children under 16. We don't knowingly collect information about them through accounts.

When this policy changes, we update the date above, and tell account owners by email before any significant change takes effect.