Privacy Policy
Last updated 22 October 2026
GuusLab (Guus Kaashoek) runs Ferro and is the controller of your personal data under the GDPR (AVG). Ferro is a chat app where your contacts are AI bots that work for you. This page says what we collect, why, where it goes and what you can do about it. Short version: we keep what Ferro needs to work, we store it in the EU, we don't track you and we don't sell anything.
What we collect
| Data | Why | Basis |
|---|---|---|
| From Nemi when you sign in: your account id, name, email address and profile photo | Sign you in and show who you are | Contract |
| The keys Nemi issues to Ferro (an access and a refresh token), encrypted | Run your bots on your Nemi AI allowance, also when the app is closed (schedules) | Contract |
| Your bots: names, pixel characters, personalities and settings | The service itself | Contract |
| Your chats: messages, replies, reactions, files you send, what bots answered and the steps they took (searches with their sources, terminal commands and output, tools they used) | Show your chats and let bots carry on where they were | Contract |
| Summaries of older parts of long chats, and notes bots write down to remember | Keep long chats working and let bots remember | Contract |
| Schedules, and how much of your allowance each run used | Wake bots at the times you asked and show what a schedule costs | Contract |
| Each bot's terminal work folder | Let a bot keep its files between conversations | Contract |
| Connected apps: which ones, and their keys, encrypted | Let your bots work in the apps you connect | Contract |
| Your settings: name for bots, time zone, language, notes for every bot | Keep your preferences across devices | Contract |
| A session cookie | Keep you signed in | Contract |
| Server logs with IP address | Security and fixing errors, kept at most 30 days | Legitimate interest |
What Ferro reads in Nemi
At sign-in Ferro asks Nemi for your basic profile (openid, profile, email), for permission to stay connected when you're not using it (offline_access, so schedules can run) and to use your Nemi AI allowance (ai). Ferro never receives your Nemi password.
Only if you connect Nemi under Connections does Ferro also ask to read and write your Nemi files, Docs, Sheets and calendar events. Bots then read or change those only when you ask them to, or when a schedule you set up tells them to. What they read goes to Nemi AI for that answer and is kept in the chat like any other step; Ferro makes no other copy. Sending, deleting and publishing always ask you first, unless you switched that off for a bot.
What we do not do
- No analytics, advertising or tracking cookies.
- No selling or renting of data, and no use of your content to train AI models.
- No secrets in a bot's terminal: the keys of your connected apps and of Nemi stay on Ferro's server.
Who else processes it
- Nemi handles sign-in, under its own privacy policy.
- Nemi AI runs the bots. Each turn, the bot's instructions, the chat so far (older parts as a summary), the descriptions of Ferro's tools and what those tools returned go to Nemi, which runs the model on its EU route under its privacy policy. When a bot searches the web, Nemi sends only the search words to its search provider (Linkup, in France). Every turn is paid from your own weekly Nemi AI allowance.
- Amazon Web Services (Frankfurt, Germany) runs the bots' terminals.
- Wasabi (Amsterdam, the Netherlands) stores files you send and saved terminal work folders.
- Our hosting and database providers store the rest on our behalf, in the EU.
- Apps you connect (for example Google, GitHub, Notion, Linear, Spotify, Hivy or your own MCP server) receive what your bots send them when they use them. What those services do with it is governed by their own terms.
- Pages a bot opens from its terminal see a request from our servers, not from you.
All providers process data for us under a data processing agreement.
How long we keep it
As long as your account exists. Chats never end on their own: the full history stays until you delete the bot, the group or your account. Deleting a bot removes its chat, schedules and terminal folder right away. Deleting your account removes everything, ends Ferro's access at Nemi and deletes your files and terminal folders. Backups are overwritten within 30 days.
Security
Traffic is encrypted with HTTPS. Nemi tokens and the keys of connected apps are encrypted at rest, sessions are stored only as a hash, and every account only ever sees its own data. Each bot's terminal runs in its own locked-down container with limited resources and no access to Ferro's internal network.
Your rights
You can see, correct, export and delete your data. Export and delete are in Settings. You can also end Ferro's access at any time in Nemi, under Settings, Connected apps. For anything else, including objecting to processing, email privacy@nemilab.com. We answer within one month. You can also complain to the Autoriteit Persoonsgegevens.
Changes
If we change how we handle your data, we update this page and tell you in the app when it matters.