Privacy

Who this covers

Nerdrums operates Portolan (the analyst product) and Bearings Network (the verified-organization graph) at portolan.nerdrums.com. This notice covers both.

What we collect

• Account data: email address, display name, and the password hash held by our identity provider (Keycloak). We do not store your password in plaintext.
• Organization data (Bearings Network): the public record for organizations you claim, including fields you author (capabilities, facilities, evidence links, mission associations, offerings, contact functions, visibility settings) and fields we import from public sources (SAM.gov, USAspending, USPTO, SBIR.gov, org websites) with per-field provenance.
• Operational data: request timestamps, IP address hashes for anti-spam rate limits, audit-trail markers for the security surfaces the CMMC control set requires (AU-2). We do not store raw IP addresses.

What we do NOT handle

• No CUI (Controlled Unclassified Information). Nerdrums is UNCLASSIFIED-only until FedRAMP certification is granted. Do not upload or paste CUI into any Nerdrums surface.
• No classified data of any kind.
• No third-party ad tracking. We do not embed Google Analytics, Facebook Pixel, or similar trackers.

How we share

Organization data you publish to Bearings Network is network-visible under your configured Visibility settings (Public · Network · Anonymous Matching). Personal data is never sold and never shared with counterparties without an explicit disclosure-request approval on your part.

Retention

Account data persists until you request deletion. Audit-trail markers persist per the security control set our commercial launch commits to. A GDPR-style delete-my-record flow is a pre-launch follow-up (see security page).

Contact

Privacy questions or a data-access / delete request: justin@nerdrums.com.