What this site collects, and what it does not

Who is asking

Axis Global MMAC SRL, a company registered in Romania, decides what happens to the little that is collected here. In the language of the law that makes us the controller.

Write to privacy@nemerislabs.com. That address reaches a person, and it is the one to use for anything on this page: a question, a request, a complaint, or a demand that we delete something.

Whether there is a data protection officer

There is not. One is required of public authorities, of organisations whose core activity is monitoring people on a large scale, and of those handling sensitive categories at scale. This site counts visits and our licence server counts the computers on a licence; neither is that. The address above is the whole contact route.

What is collected, and on what grounds

• You open a page

  The server that sends it to you receives your IP address, the page you asked for, and what your browser says about itself. Every web server receives this; it is how a reply knows where to go. It sits in our host’s logs and we build nothing from it.

  Legitimate interest: serving the site and keeping it standing

• You press the light or dark switch

  Your choice is written on your own device so the next page does not arrive in the wrong colour. It is not sent anywhere and we never see it.

  Strictly necessary: you asked for the thing it does

• You answer the bar at the bottom

  Your answer, yes or no, is written on your device, so that we do not ask again and so that a no keeps meaning no. Recording the answer is the one thing we may store without asking, because losing it would mean asking you every single time.

  Strictly necessary: the record of your own answer

• You press “Go ahead”

  Only then does Google Analytics load. It counts pages viewed, how far down you scrolled, links followed off the site and files downloaded, and it notes your browser, operating system, language, screen size, roughly which city you are in, and how you arrived. It puts a random number on your device to tell one visit from two, in two cookies: _ga, and one whose name begins _ga_. Your IP address is used to work out the city and is not stored by us.

  Those two are the only cookies on this site, and they arrive only after this press. Your light or dark choice and your answer to the bar are kept in your browser’s own storage, not in cookies, and the server sets none.

  None of it is used for advertising. The advertising settings are switched off and stay off; if that ever changes, it changes by asking you again, not quietly.

  Consent: nothing loads before you give it

• You write to us through the contact form

  Your name, your email address, what the message is about and the message itself come to our mailbox, so that we can read it and answer you there. Your address also gets 1 automatic email saying the message arrived, and no more than 1 in 24 hours however many messages you send. That email repeats nothing you wrote, so nobody can use the form to send words of their own to someone else.

  To keep out automated spam, the form checks 3 things: how long it was open before you pressed send, a field that people never see and programs fill in, and whether a person is at the keyboard, which Cloudflare judges for us from the moment you start typing. The first 2 keep nothing about you. For the third, Cloudflare receives your IP address, what your browser says about itself and the address of this page, and it may ask you to tick a box. To count the 1 email in 24 hours, the server keeps a scrambled form of your address for 24 hours, made with a key that changes whenever the server restarts; the address cannot be read back from it. Anything you write to privacy@nemerislabs.com arrives in the same mailbox, with none of these checks.

  Legitimate interest: answering the person who wrote. A question about buying a licence is also a step you asked for before a contract

• You use a code

  A code gets Nemeris without paying. To check it, the window sends the code to our licence server. If it is a free code, the window then asks for what an invoice needs, at 0: your name, your email address, your billing address and telephone number, and for a business its name and tax ID. It also asks you to tick 1 box, or 2 for a business, and sends the version of their words with them. Our licence server keeps all of it with the time you ticked, and sends your installation kit to your email address. Your IP address tells it which country the request came from, because Nemeris is not sold in every country; it is not kept.

  Contract: you asked for the licence. Legal obligation: the invoice and its records

• You activate Nemeris

  Nemeris asks for this once, when you install it. It sends our licence server your email address, a name for your computer (its own name by default, at most 64 characters; you can choose another) and a fingerprint of your computer: a 16-character code made from the computer’s name and its system identifier, not the identifier itself. A 6-digit code arrives at that address, valid for 10 minutes, and with it you get your licence key. The server keeps your address and the fingerprint only in a scrambled form made with a secret key, and the computer’s name in clear text.

  Contract: you asked to use your licence

• Nemeris checks for updates and for your licence

  When Claude Code looks for a new version, and about once a day when a session starts or resumes, Nemeris sends the licence key and the fingerprint. For updates, the server records the date it last saw that computer, to count the computers on your licence. The daily check records nothing in our database. Your IP address is used only to limit requests and is not written to our database; Cloudflare’s technical logs may hold it for 7 days at most. Nothing about your code, your requests or your projects is sent to us. The audit can ask npm or PyPI, from your computer, about the packages in your project; that goes to them, not to us.

  Contract: updates and the licence you asked for

• You use the recovery page

  You enter your email address and a 6-digit code arrives there. With it you can see your computers, free one or get the kit email again. The server keeps your address only in the same scrambled form.

  Contract: you asked for it

• An email we send you does not arrive

  If an email we send you is not delivered or is marked as spam, our email provider tells us. We keep a scrambled form of your address, the subject of the email, which can include your order number, and the reason, so that we stop writing to an address that does not work and learn of a problem.

  Legitimate interest: not writing to an address that does not work

• You withdraw from the contract

  If you use the withdrawal window, our licence server keeps your name, your order number if you give one, your email address and the date and time. It sends you a confirmation and tells us.

  Legal obligation: handling your withdrawal and being able to prove it

The interest we are claiming, where we claim one

3 entries above rest on legitimate interest rather than on your permission. The first is the record a web server keeps of the requests it answers. The interest is keeping the site available and able to survive abuse. It is hard to run a server without it, and it holds nothing we go looking through.

The second is a message you send us. The interest is answering it. You chose to write and you would expect a reply, and we use what you send for that and for nothing else: no mailing list, no marketing.

The third is the record of an email that did not arrive or was marked as spam. The interest is not writing again to an address that does not work. You can object to any of the 3. See below.

Who else sees any of it

Our host, which runs the machine that serves these pages, and Google, but only after you have agreed and only for the counting described above.

When you write to us, two more, each working for us and only on our instructions. Hetzner Online GmbH, in Germany, keeps our mailbox, so it holds your message. Scaleway SAS, in France, delivers the form’s two emails: yours to us, and the receipt to you.

Cloudflare, Inc., in the United States, checks that whoever fills in the contact form is a person and not a program. For that, and only while you use the form, it receives your IP address, what your browser says about itself and the address of this page. It works for us and on our instructions.

Cloudflare, Inc. and Resend (Plus Five Five, Inc.) also see your data when you use a code, activate Nemeris, use the recovery page or withdraw. Both work for us and only on our instructions. Cloudflare runs our licence server, which keeps the data described above. Resend, in the United States, sends our emails: your installation kit, your activation and recovery codes, and the confirmation of a withdrawal. It sees your address and what the email says, including the computer’s name at activation.

Nobody else. Nothing here is sold, traded or handed to advertisers, and there are no third-party trackers on this site besides the one you can turn on and off yourself.

Whether anything leaves Europe

Google, our host and Cloudflare are American, so yes. Google LLC and Cloudflare, Inc. are certified under the EU–US Data Privacy Framework, the arrangement the European Commission decided in July 2023 offers protection equivalent to European law. Our host is covered by the standard contractual clauses the Commission publishes for exactly this. Ask at the address above and we will send you the paperwork.

Resend is American as well; the transfer rests on the same Data Privacy Framework and on the Commission’s standard contractual clauses.

Hetzner and Scaleway are European and keep what they hold inside the EU. A message from the contact form passes through our host on its way to them, so the transfer above applies to it as well.

How long any of it lasts

• Server logs last as long as our host keeps them, which is a period they set and we do not control.
• What is written on your device stays there until you clear it. Your answer to the bar is kept deliberately, so that a no goes on being a no.
• Analytics records are deleted by Google after 14 months. The two cookies it leaves on your device to tell visits apart expire two years after your last visit.
• A message you send us is kept as our correspondence for three years from the last message between us: that is how long Romanian law leaves for a claim about it, in the general case. If you ask, we delete yours sooner, unless the law requires us to keep it.
• Scaleway keeps a record of the emails it delivered for us for a period it sets and we do not control, as our host does with its logs.
• The scrambled form of your address that counts the contact form’s receipts is kept for 24 hours, then dropped.
• What a free code sends is kept for 10 years from 31 December of the year the code was used, with the invoice, then deleted.
• The record of the boxes you ticked is kept for as long as your licence is active; if the licence is cancelled, until the same 10 years are up.
• What an activation or a recovery request leaves is deleted automatically after 31 days.
• A computer’s record is deleted automatically after 30 days in which it has not asked for updates. Updates are then refused until you activate it again; Nemeris does not stop.
• The record of an email that did not arrive or was marked as spam is kept for 180 days.
• Backups of the licence server’s database are encrypted and kept in the EU: daily copies for 35 days, weekly copies for 90. What is deleted from the database is gone from them within 90 days at most.
• A withdrawal is kept for 10 years from 31 December of the year of the sale, with the sale data, then deleted. One that does not match an order is kept for 10 years from 31 December of the year it arrived.

What you can demand

A copy of what we hold about you. A correction. Deletion. A pause on our using it. An objection to anything resting on legitimate interest. And a copy in a form you can take elsewhere.

Write to privacy@nemerislabs.com. The law gives us one month to answer and we would rather take a day. None of it costs you anything.

These rights are for everyone, wherever you live. If you complain to us, we acknowledge it within 30 days, look into it without undue delay and tell you the outcome. If we refuse a request, we tell you why, and you can ask us to look at it again.

Taking your permission back

At the bottom of every page there is a line that reads Analytics: on or Analytics: off, with a switch beside it. One press and the counting stops, both for the rest of that visit and for every visit after.

Saying yes and saying no are one click each, on purpose. What was counted before you changed your mind stays counted; that is what the law allows, and it is also simply true.

Complaining about us

If we handle any of this badly, you can take it to the Romanian supervisory authority, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal, at dataprotection.ro. If you live in another EU country, your own authority will take the complaint just the same. If you live outside the EU, your own data protection authority may also be able to help.

You are welcome to write to us first, and you are under no obligation to.

Whether you have to give us anything

No. There is no account to make. There are 4 things to fill in, each only if you want to: the contact form, the code window, the recovery page and the withdrawal window. Without an email address we cannot answer you, send your kit, send you a recovery code or confirm a withdrawal, which is why all 4 ask for one. Activating Nemeris needs your email address too, because the code goes there; without it you cannot get the licence key. A free code also asks for what an invoice needs, because the law requires an invoice: without it, the code cannot be used. A field you may leave empty says so. Saying no to the counting costs you nothing at all: the site behaves identically either way, which is the test of whether a choice was real.

Whether a machine decides anything about you

Almost never. Nothing here profiles you or scores you. The counting is counting.

The contact form’s 3 spam checks are one automatic step, and they look at the form, not at you. A form sent faster than anyone types is asked to be sent again. A form with the hidden field filled in is not sent, and the screen says so rather than pretending it went. Cloudflare’s check decides only whether the form can be sent; when it cannot tell, the form says so and sends nothing.

A code is also refused automatically when the country in your billing address or the country of your IP address is one we do not sell to. If you think that is a mistake, write to privacy@nemerislabs.com: a person reviews it.