Privacy Policy

Three things, and that's the whole list.

What you type

• Your name, email address, company, role, company size, and industry. We ask for these on the screen before your results so we can email you a copy of your scorecard. Your results appear on screen either way. The email is a copy, not the delivery mechanism. The last two let us group answers by segment if we ever publish what the survey finds in aggregate.
• Your sixteen answers, and the estimate they produce. The questions are about architecture (models, caching, batching, agent guardrails, observability), not about your customers or your data.

What your browser sends

• The page that referred you here, if there was one, so we know whether a link or a talk is what brought people in.
• A salted hash of your IP address. We do not store your IP address. We take it, mix it with a secret value, run it through SHA-256, and keep only the resulting fingerprint, enough to notice that the same person submitted five times in an hour, and not enough to recover the address it came from. It is used for rate limiting and nothing else, and it's erased after seven days.

What our analytics counts

• Aggregate page views, via Vercel Web Analytics, which uses no cookies and builds no profile of you across sites.
• Three events: that a scorecard was viewed, that the booking button was clicked, and that a share button was used. The scorecard event includes the top of the savings range as a whole number, so we can see whether the assessment produces a spread of results or the same answer for everyone, and whether the scorecard was your own or one shared with you. The share event records which button, and not what was shared or who with. None of them carry your name, email, or anything that links back to you.

Worth stating explicitly, because these are the things sites like this usually do collect:

• No cookies. Not analytics cookies, not “strictly necessary” cookies, none. There is no consent banner on this site because there is nothing to consent to.
• No third-party advertising or marketing trackers. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag, no session recording, no heatmaps.
• No accounts, no passwords, no logins. There is nothing here to break into.
• No fonts fetched from Google. The typefaces are downloaded when the site is built and served from our own domain, so loading a page sends no request to Google on your behalf.
• No hidden fields that collect anything. The one invisible input on the form exists to catch bots, and a submission that fills it is discarded. Beyond that, the form collects exactly what it shows you.

We use it for these four things and nothing else.

• To score your assessment and show you the result.
• To email you a copy of your scorecard, once.
• To let our team know you took it. Being straight with you: Nerd/Noir does AI cost work, and this assessment is how we meet people who might want help with it. Your submission is emailed to our team, and a person may read it and reply to you once. What we commit to in exchange: no automated drip sequence, no newsletter you didn't ask for, and no second follow-up if you don't answer the first. Reply “no thanks” and that's the end of it.
• To improve the assessment itself. We look at answers in aggregate to see which questions are confusing, which estimates look wrong, and where the model needs work.

We will not use your information for anything materially different from the above without asking you first.

Your answers, your contact details, and your scorecard are never used to train, fine-tune, or evaluate any AI model, ours or anyone else's.

The scoring is arithmetic, not a model. Your answers are run through a fixed set of rules on our server; no language model is involved in producing your result, and nothing you enter is sent to an AI provider.

Your results have their own web address, and the share buttons under them exist so you can send it to a colleague. It matters what that link does and does not carry, so here it is in full.

• The address contains a random identifier with about as much randomness as a lottery nobody wins. It is not guessable, not sequential, and not derived from anything about you. Nobody finds your scorecard by trying.
• Anyone holding the link can open it, and they see the estimate, the dollar range, and the levers behind it. If that range is more than you want to share, don't send the link: your results are on your screen either way.
• It never shows your name, company, email, role, or your individual answers. Those live in the same record, and the page is written to read only the columns listed above.
• We don't publish it, and search engines are asked not to index it. The only way it circulates is if you circulate it.
• It dies with the record. Deletion at twelve months, or sooner if you ask, takes the link with it — after that it opens a “not found” page for everyone, including you.

We don't sell, rent, or trade your information, and we don't share it for anyone's advertising. The only companies that touch it are the four we need to run the site:

Vercel

Hosting and the analytics described above.

Supabase

The database your submission is stored in. Access is server-side only and restricted to us.

Resend

Sends the two emails: your copy and our notification.

Calendly

Only if you click the booking link on your results, which takes you to Calendly's own site under their privacy policy. Nothing is sent to Calendly unless you choose to go there.

Each of these processes data on our instructions and is not permitted to use it for their own purposes. Beyond them, we'd disclose your information only if the law actually required it, and if we ever receive such a demand, we will tell you unless we're legally barred from doing so.

Specific windows, enforced by a scheduled job in the database rather than by anyone remembering to run a cleanup:

• The hashed IP: seven days. The rate limit it supports only looks back one hour, so the rest is a wide margin. After seven days the field is erased.
• Your submission: twelve months. Then the whole row (name, email, company, role, answers, score) is deleted automatically.
• Email: as long as the mailbox keeps it. The two emails sit in your inbox and ours like any other email. Ask us and we'll delete our copy of the thread.

Twelve months is a deliberate choice, not an oversight. A cost assessment goes stale quickly, and there's no honest reason to keep one for years.

These apply to everyone, wherever you live. We're not going to ask where you're from, make you prove residency, or give a Californian more than a Coloradan. You can:

• Get a copy of everything we hold about you.
• Correct anything that's wrong.
• Delete it, all of it, no reason required, no questions asked.
• Tell us not to contact you while keeping your scorecard, if you want the result but not the conversation.
• Complain to your local data protection authority. We'd rather you came to us first, but you don't have to.

Email team@nerdnoir.com and say what you want. Replying to either email you received works too. We aim to have it done within five business days and will not take more than thirty. There is no fee, no form, and no account to log into. We won't treat a deletion request as a reason to stop being useful to you, and we won't degrade anything in retaliation for one.

Your submission is handled entirely on the server. The scoring model and the database credentials never reach your browser, and there is no public read access to the submissions table. Every read and write goes through server-side code we control.

No system is perfect. If we ever discover a breach affecting your information, we'll email you and describe what happened, what was affected, and what we're doing about it, promptly, and without waiting to see whether we're legally obliged to.

Nerd/Noir is based in the United States and our service providers process data there. If you're in the UK, EU, or elsewhere, your information will be transferred to and stored in the US.

Where the GDPR applies, our lawful basis is your consent (you chose to fill in the form) together with our legitimate interest in operating the assessment. You can withdraw that consent at any time by asking us to delete your submission, and we'll honour it as described above.

This is a tool for people responsible for engineering budgets. It isn't directed at children, and we don't knowingly collect information from anyone under 16. If you believe a child has submitted the assessment, email team@nerdnoir.com and we'll delete it.

If we change this policy, we'll update the effective date at the top and note what changed. For any change that materially reduces the protections above, we won't apply it retroactively to data we've already collected from you. If we want to do something new with a submission we already hold, we'll contact you and ask first.

Questions, requests, or objections all go to the same place: team@nerdnoir.com. A person reads it.