Privacy policy

1. What ernd collects

• Account details. The email address of each person on a company’s account, their role, and when they were added and last signed in. For a Google sign-in, the email Google confirms.
• Company details. The company’s name, website and the date it joined.
• Receipts. Files a member uploads, and receipt PDFs from a connected inbox. ernd keeps each file and the details read from it: vendor, invoice number, date, amount, whether it is paid, and the billed-to name and email.
• Connected inbox. The inbox’s address and whether it is still connected. From the inbox itself, ernd takes only PDF receipts sent from openai.com and anthropic.com.
• Partner accounts. The email on the company’s account at a partner, given so the partner can confirm the company. Partners also send ernd the spend on that account: amounts, dates, their customer ID and the billing email.
• Redemptions and payouts. What was redeemed and when. For a cash rebate, the bank’s name and the last four digits of the account. The full bank details are entered in a form hosted by ernd’s payment processor. While payouts are sent by hand, ernd emails the company’s admin to collect bank details for the first payout, and uses them only to send that company’s payouts.
• Usage logs. Sign-ins, and the actions people and their coding agents take in the app, with the time, network address and browser.

2. What ernd never reads

• Prompts and model traffic. ernd never sees prompts, model inputs or model outputs, and never asks for API keys.
• Other email. Gmail and Outlook grant read access to the whole inbox when one is connected. ernd uses that access only to search for messages from openai.com and anthropic.com with PDF attachments, and keeps only those PDFs. Other mail is not opened or stored.

3. How inbox access is stored

• Inbox access tokens are kept in an encrypted secret store. ernd’s database holds only a reference to each one.
• Disconnecting an inbox in the app deletes ernd’s copy of its token, and ernd asks Google or Microsoft to cancel its access.
• ernd also deletes its copy and stops reading when the provider refuses the token, or when the person who connected it leaves the company on ernd.
• Sign-in links and agent tokens are stored only as one-way hashes. Data is encrypted in transit.

4. How ernd uses data

• To run the program: count spend, award points, check receipts, confirm partner accounts, pay redemptions and prevent fraud.
• To send service email, such as sign-in links, receipt results, reconnect notices and rate changes.
• ernd does not sell personal data and does not use it for advertising.
• The ernd app uses cookies only to keep people signed in and to protect against forged requests.
• This website, ernd.io, uses its host, Ploy, for analytics. Ploy sets one first-party cookie on ernd.io, ploy_anon_id, which holds a random visitor ID and lasts one year, and keeps a copy of that ID in the browser’s local storage. Local storage also holds ploy_session, which groups page views into one visit and ends after 30 minutes without activity, and ploy_pending_events, which holds recent events until they are sent. For each visit, Ploy records the pages viewed and their titles, the referring site, campaign tags in the link (UTM tags), how far each page is scrolled, clicks on buttons and on links to other sites, form starts and submissions, how long the visit lasts, screen and window size, browser language, the browser and device type, and an approximate location (country, region and city) derived from the IP address. Ploy also tries to match visits to the business, and sometimes the person, behind them using a third-party business identity service, so ernd can see which companies visit. This data is not used for advertising and is not sold or shared for advertising. A visitor can stop Ploy storing an ID by blocking or deleting cookies and site data for ernd.io in their browser settings. Page views are then still counted, but they cannot be linked to each other or to earlier visits. The site’s fonts are stored with its other files on Google Cloud Storage (storage.googleapis.com) and do not load from Google Fonts.

5. Who ernd shares data with

• Partners. To confirm a company is its customer, a partner sees the company’s name and the account email the company gave. A partner also sees the companies linked to it, the points it funds for them, and redemptions made with it.
• Service providers that run ernd. Amazon Web Services for hosting, the database, file storage and the secret store, and Amazon SES for email. Anthropic’s API reads uploaded and inbox receipts to pull out the invoice details. Stripe handles payouts and partner billing. Google and Microsoft handle Google sign-in and connected inboxes.
• Authorities, where the law requires it.

6. How long ernd keeps data

• Account, company, points, redemption and payout records, receipts and partner spend: while the account is open, and afterwards for as long as tax, accounting and fraud-prevention rules require.
• Inbox tokens: until the inbox is disconnected, refused by the provider, or the person who connected them leaves.
• Sign-in links: 15 minutes. Sessions: 14 days. Agent tokens: until revoked, or 90 days after their last use.
• Usage logs: 30 days.

7. Rights and requests

Anyone can ask ernd for a copy of their personal data, to correct it, or to delete it, by writing to hello@ernd.io. ernd may keep records it must hold by law or needs to settle points and payouts already made. Depending on where a person lives, local law may give further rights.

An inbox can be disconnected at any time in the app.

8. Changes to this policy

ernd may update this policy. For a material change, company admins get an email before it takes effect, and the date at the top of this page changes.

9. Contact

Questions or requests: hello@ernd.io. Provenance Research Inc..