Skip to content
Request your card

Privacy policy

Last updated 2 November 2026.

This policy covers what Provenance Research Inc. (“ernd”) collects to run the ernd rewards program, and what it does with that data. It applies to the ernd app at app.ernd.io and to this site.

1. What ernd collects

  • Account details. The email address of each person on a company’s account, their role, and when they were added and last signed in. For a Google sign-in, the email Google confirms.
  • Website requests. If someone enters a work email in the calculator on ernd.io and presses Request your card, ernd keeps that email and the monthly AI bill they chose, so it can follow up about the request. Ploy, ernd’s website host, stores them.
  • Company details. The company’s name, website and the date it joined.
  • Receipts. Files a member uploads, and receipt PDFs from a connected inbox. ernd keeps each file and the details read from it: vendor, invoice number, date, amount, whether it is paid, and the billed-to name and email.
  • Connected inbox. The inbox’s address and whether it is still connected. From the inbox itself, ernd takes only PDF receipts sent from openai.com and anthropic.com.
  • Partner accounts. The email on the company’s account at a partner, given so the partner can confirm the company. Partners also send ernd the spend on that account: amounts, dates, their customer ID and the billing email.
  • Redemptions and payouts. What was redeemed and when. For a cash rebate, the bank’s name and the last four digits of the account. The full bank details are entered in a form hosted by ernd’s payment processor. While payouts are sent by hand, ernd emails the company’s admin to collect bank details for the first payout, and uses them only to send that company’s payouts.
  • Usage logs. Sign-ins, and the actions people and their coding agents take in the app, with the time, network address and browser.

2. What ernd never reads

  • Prompts and model traffic. ernd never sees prompts, model inputs or model outputs, and never asks for API keys.
  • Other email. Gmail and Outlook grant read access to the whole inbox when one is connected. ernd uses that access only to search for messages from openai.com and anthropic.com with PDF attachments, and keeps only those PDFs. Other mail is not opened or stored.

3. How inbox access is stored

  • Inbox access tokens are kept in an encrypted secret store. ernd’s database holds only a reference to each one.
  • Disconnecting an inbox in the app deletes ernd’s copy of its token, and ernd asks Google or Microsoft to cancel its access.
  • ernd also deletes its copy and stops reading when the provider refuses the token, or when the person who connected it leaves the company on ernd.
  • Sign-in links and agent tokens are stored only as one-way hashes. Data is encrypted in transit.

4. How ernd uses data

  • To run the program: count spend, award points, check receipts, confirm partner accounts, pay redemptions and prevent fraud.
  • To send service email, such as sign-in links, receipt results, reconnect notices and rate changes.
  • ernd does not sell personal data. Its only advertising use of personal data is the LinkedIn advertising described below.
  • The ernd app uses cookies only to keep people signed in and to protect against forged requests.
  • This website, ernd.io, uses its host, Ploy, for analytics. Ploy sets one first-party cookie on ernd.io, ploy_anon_id, which holds a random visitor ID and lasts one year, and keeps a copy of that ID in the browser’s local storage. Local storage also holds ploy_session, which groups page views into one visit and ends after 30 minutes without activity, and ploy_pending_events, which holds recent events until they are sent. For each visit, Ploy records the pages viewed and their titles, the referring site, campaign tags in the link (UTM tags), how far each page is scrolled, clicks on buttons and on links to other sites, form starts and submissions, how long the visit lasts, screen and window size, browser language, the browser and device type, and an approximate location (country, region and city) derived from the IP address. Ploy also tries to match visits to the business, and sometimes the person, behind them using a third-party business identity service, so ernd can see which companies visit. This data is not used for advertising and is not sold or shared for advertising. A visitor can stop Ploy storing an ID by blocking or deleting cookies and site data for ernd.io in their browser settings. Page views are then still counted, but they cannot be linked to each other or to earlier visits. The site’s fonts are served by Ploy from cdn.ploy.ai and do not load from Google Fonts.
  • ernd.io also loads LinkedIn’s Insight Tag (from snap.licdn.com), so ernd can show its LinkedIn ads to people who visited the site and count the visits and card requests that came from those ads. LinkedIn sets its own cookies for this, among them bcookie, li_sugr, lidc, UserMatchHistory, AnalyticsSyncHistory and li_fat_id, which last from one day to one year, and LinkedIn receives the page address, the referring page, the time of the visit, the IP address and the browser and device details. LinkedIn shows ernd only totals and audiences of at least 300 LinkedIn members, never who visited. LinkedIn handles this data under its own privacy policy (linkedin.com/legal/privacy-policy). ernd.io does not load the tag in browsers that send a Global Privacy Control signal. A visitor can also turn off ads based on other websites in LinkedIn’s settings (Settings, then Advertising data) or block cookies from linkedin.com and licdn.com in their browser.
  • ernd.io also tracks site visits with its own record of how each page is used, such as views, scroll depth, time on page, clicks on links and buttons, use of the calculator, times picked and calls booked on Calendly, the city of the visit, and the campaign tag or site that linked to it. It uses a random ID that lasts for the browser tab, with no cookie, and stores no IP address or email. A page made for one company or person is recorded by that page’s name, which can hold a company’s name and a person’s first name, so the record shows that page was visited. This record is not used for advertising. Visits to public pages from a browser that sends Global Privacy Control are left out.
  • When a link to ernd.io has campaign or invite tags, or another site sent the visitor here, ernd.io keeps that source in the browser’s local storage for 30 days as ernd_touch, with no cookie, and adds it to the links used to sign in or book a call, so ernd can tell which link brought them. A browser that sends Global Privacy Control is left out of this.

5. Who ernd shares data with

  • LinkedIn. For ernd’s LinkedIn ads only, as described in section 4: the Insight Tag on ernd.io. LinkedIn does not sell this data to ernd or tell ernd who saw or clicked an ad.
  • Partners. To confirm a company is its customer, a partner sees the company’s name and the account email the company gave. A partner also sees the companies linked to it, the points it funds for them, and redemptions made with it.
  • Service providers that run ernd. Amazon Web Services for hosting, the database, file storage and the secret store, and Amazon SES for email. Anthropic’s API reads uploaded and inbox receipts to pull out the invoice details. Stripe handles payouts and partner billing. Google and Microsoft handle Google sign-in and connected inboxes.
  • Authorities, where the law requires it.

6. Google user data

ernd’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. ernd uses Gmail data only to find and read OpenAI and Anthropic receipts and show the points they earn. It does not sell Gmail data, use it for advertising or credit decisions, let people read it except for security, legal reasons or with the user’s consent, or use it to train AI models.

7. How long ernd keeps data

  • Account, company, points, redemption and payout records, receipts and partner spend: while the account is open, and afterwards for as long as tax, accounting and fraud-prevention rules require.
  • Inbox tokens: until the inbox is disconnected, refused by the provider, or the person who connected them leaves.
  • Sign-in links: 15 minutes. Sessions: 14 days. Agent tokens: until revoked, or 90 days after their last use.
  • Usage logs: 30 days.
  • The record of site visits: 12 months.

8. Rights and requests

Anyone can ask ernd for a copy of their personal data, to correct it, or to delete it, by writing to nikhil@ernd.io. ernd may keep records it must hold by law or needs to settle points and payouts already made. Depending on where a person lives, local law may give further rights.

An inbox can be disconnected at any time in the app.

9. Changes to this policy

ernd may update this policy. For a material change, company admins get an email before it takes effect, and the date at the top of this page changes.

10. Contact

Questions or requests: nikhil@ernd.io. Provenance Research Inc.