Privacy policy
Who this covers
This policy describes how JERP Team handles information when you use jerp.ai (or the origin you are on), the REST API, and the MCP connector. It applies to the free public tier. Last updated .
What we collect
API keys. Try Free on this origin, in a browser, issues a public jerp_ key valid for one hour. The issue route checks the request Origin against this site and requires browser Sec-Fetch-* headers, so curl and other websites cannot mint a key. OAuth Sign in takes that same key (you paste it) and returns it to the MCP host. The key is shown in your browser or held by the host. We store what we need to validate the key, its expiry, and rate limits (including hashed or derived material — not a password you chose; there is no account).
Issue limits. New keys are limited per IP (about ten per hour, with a short gap between issues) so the free tier stays usable.
Usage logs. We log route, timing, status, and error codes to enforce one call per second and 100 calls per key, and to keep the service up. Logs are operational, not a marketing profile.
Request bodies. Judgment calls include the cards you send (typically domain, title, summary, optional categories). Index search uses your query or seed. We process that payload to return scores. Do not put secrets, passwords, or personal data in summaries.
Website. The marketing site is a static app. We do not require cookies to issue a key. Third-party fonts (for example Google Fonts) may see your IP when the page loads. If you open MCP or API URLs through a host (Claude, Cursor), that host’s privacy policy also applies to the traffic it sends us.
What we do not collect
No signup, no profile, no payment card. We do not sell lists of visitors. We do not use your judgment payloads to train a public marketing dataset about you as a person. We do not require an email to Try Free.
Processors and subprocessors
Scoring may call infrastructure we operate and model providers we use to produce judgments. Those providers see the card text needed for the call, under their terms. Hosting, DNS, and CDN (for example Cloudflare in front of the origin) see connection metadata such as IP and TLS metadata, as any website does.
Retention
Keys expire after one hour; rate-limit state follows that window. Operational logs are kept only as long as we need them to run and secure the service, then discarded or aggregated. We may retain security-related records longer if we are investigating abuse.
Your choices
Stop using the key and it expires on its own. Do not send personal data in tool arguments. For a deletion or access request about logs we may still hold, email [email protected]. We will need enough detail to find the records; we cannot reverse an expired key into an identity we never stored.
Children
The service is for professional marketing and research use, not for children. Do not use JERP if you are under 16.
Changes
We will update this page when collection or processing changes in a material way. The “Updated” date in the header is the current version. Related: terms of use.