Privacy policy

Last update: September 2026 · DRAFT – to be reviewed by a lawyer before go-live

We know, privacy policies are as exciting as a spreadsheet of withholding tax rates. Here’s the short version: this website sets no cookies, runs no analytics and loads nothing from third parties while you browse. We only process personal data when you send us something – and then only to answer you.

1. Who is responsible

BeNerdy Consultancy FZE
Sheikh Rashid Tower
Dubai World Trade Centre
Dubai, United Arab Emirates
Trade licence no. L-4906

For privacy questions, write to us via the contact page.

2. Hosting and server logs

This website is a static site hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) on Cloudflare Pages. When you visit a page, Cloudflare processes technical data such as your IP address, the requested URL, date and time, browser type and referrer in order to deliver the page and protect it against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU–US Data Privacy Framework; we have concluded a data processing agreement with Cloudflare.

3. No cookies, no tracking – just anonymous statistics

We do not use cookies, third-party analytics, advertising pixels, social media plugins, embedded videos or external fonts. Fonts, images and videos are served from our own domain. Some tools on this site (the 183-day tracker, checklists, your theme choice) save your entries only in your own browser (localStorage). They never leave your device and you can delete them at any time by clearing your browser data.

To see which pages help and where the site confuses people, we count visits and a few steps (for example "Finder finished" or "form sent") with our own, anonymous statistics. The page sends a tiny message to our own server with the page address, the website you came from (only its domain, e.g. google.com) and the step. Our server adds your country (from Cloudflare) and whether you use a phone or a computer. We store no IP address, no browser details, no cookies and nothing in your browser. To count daily visitors, the server builds a one-way code from the date, your IP address and browser; it can't be turned back into either and changes every day, so we can't recognise you on another day. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is counted at all. The numbers are kept for up to 13 months on Cloudflare (our hosting provider) and only we can see them. Legal basis: Art. 6(1)(f) GDPR (improving our website).

4. Contact, match requests and waitlists

When you use one of our forms (contact, “get matched”, waitlists for guides, membership or podcast), we process the data you enter – typically name, e-mail address and the details you choose to share about your plans – to answer your request. Legal basis: pre-contractual measures and your request (Art. 6(1)(b) GDPR) and, where you tick the consent box, your consent (Art. 6(1)(a) GDPR).

Partners: when you order a service, we pass the details needed for it to the licensed partner who performs it for us in the relevant jurisdiction (for example a corporate service provider, law firm or tax advisor). If you contract a partner directly, we only share your details after asking you and naming the partner. Partners are independent controllers for their own services and are subject to their own anti-money-laundering (KYC) obligations.

Form submissions are delivered to our mailbox by e-mail via Resend (Resend, Inc., USA) and our e-mail provider Google Workspace (Google Ireland Ltd.). Resend also sends you a short confirmation of your request. To keep bots out we use a hidden honeypot field and, where enabled, Cloudflare Turnstile, which is only loaded when you start filling in a form.

Inbox: after the spam checks, contact, match, strategy-session and partner requests are also copied to an inbox in the client portal of VEONIO OÜ (Tallinn, Estonia), which runs this website for us as our processor (Art. 28 GDPR). It keeps what you sent (name, e-mail address, phone number if given, your message and the details you chose in the form), the language and the time in a Cloudflare D1 database in the EU, reminds us when an enquiry is still unanswered and deletes it 12 months after it came in. If we ask for a reply draft, your message is sent to Anthropic (USA) to write it; we check and send every reply ourselves. Taps on our phone, WhatsApp and e-mail links are counted there per day, without cookies and without any data about you.

We delete enquiries when they are no longer needed to answer you, unless statutory retention periods apply.

If you subscribe to our newsletter, we first send you a confirmation e-mail (double opt-in). Only when you click the link do we store your e-mail address, first name (if given), the source of the sign-up and the time of your confirmation with our e-mail provider Resend (Resend, Inc., USA), which sends the newsletter and a short welcome series on our behalf. Legal basis: your consent (Art. 6(1)(a) GDPR). Open and click tracking is switched off. You can unsubscribe at any time via the link in every e-mail.

Waitlists: if you ask us to notify you about something (for example the client portal, a guide or the podcast), we store your e-mail address and the topic with Resend and send you e-mails about that topic only. Unsubscribe any time via the link in every e-mail.

6. Strategy session: payment and scheduling

If you apply for a strategy session, we process your questionnaire answers to check whether we can help (Art. 6(1)(b) GDPR). Payments are handled by Stripe (Stripe Payments Europe Ltd., Ireland) on a Stripe-hosted checkout page – we never see your full card details; Stripe processes payment data as its own controller for fraud prevention and legal obligations. After payment you book your slot with our scheduling tool Motion (Motion, Inc., USA), which stores your name, e-mail address and the chosen time and sends the calendar invitation. We keep invoices and payment records as long as tax law requires.

7. Chat assistant ("Ask a nerd")

The chat button at the bottom of every page is optional; nothing loads until you click it. Shortcuts such as the mini Finder, the Strategy Session facts and the site search run entirely in your browser. Your conversation is kept only in this browser tab (sessionStorage) and is gone when you close it.

If you type a free-text question, it is sent – together with the previous messages of this chat – to our own server function and from there to Anthropic (Anthropic PBC, USA), whose Claude model writes the answer. Before the first AI answer, Cloudflare Turnstile (Cloudflare, Inc.) checks that you're human; to do so it processes technical data about your browser and loads a script from challenges.cloudflare.com. We then give your browser a signed session token for 30 minutes, linked to a shortened, irreversible hash of your IP address. To keep costs and abuse in check we store counters (number of questions per session and per hashed IP per day, overall spend) and, for 7 days, the answer to a first question without any link to you, so the next person asking the same thing gets it straight away. We don't store your conversations and don't use them for anything else; Anthropic processes them as our processor and, under its commercial terms, does not use them to train its models. Legal basis: Art. 6(1)(f) GDPR (answering your question and protecting the service), and Art. 6(1)(b) GDPR where you ask about our services. Please don't enter names, e-mail addresses, account or passport numbers. AI answers can be wrong and are general information, not tax or legal advice.

8. Client portal

The planned client portal at clients.nerdy.money is a separate application with its own privacy notice. This policy only covers the website nerdy.money.

9. Transfers outside the EU

BeNerdy Consultancy FZE is based in the United Arab Emirates. If you contact us from the EU, your data is therefore processed outside the EU, for the purpose of answering your request and performing the contract you asked for (Art. 49(1)(b) GDPR). Some of our service providers (Cloudflare, Resend, Anthropic) are based in the USA and are certified under the EU–US Data Privacy Framework.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

11. Changes

We update this policy when our website or the law changes. The current version is always available on this page.

Privacy policy.