Last reviewed 2026-06-06Free public siteServer-side AI Gateway use

Privacy and AI processing policy.

NACE.codes keeps reference browsing public and limits data handling to reference data, API/search logs, and AI-assisted page content checks.

Source library Privacy JSON

Public data scope

NACE.codes does not save your classification work. NACE.codes only uses lookup, export, and API activity needed to operate the reference site.

AI processing policy

AI is used only to check page content and quality signals against source material.

Default gateway: Vercel AI Gateway

Default model: openai/gpt-5.4-nano

AI-assisted support text is checked against source material before it appears publicly.

Retention scope

How public lookup, export, and API activity is handled.

Current retention covers reference cache, source metadata, API logs, and generated content records. NACE.codes does not save your classification work.

CSV and XLSX imports are used only to read code lists for conversion. Uploaded files are not saved.

Current deletion scope

What users can expect from the simplified public site.

- NACE.codes does not save your classification work.

- Uploaded conversion files are not saved.

- Browser users can clear local browser history, cookies, and cached pages.

Data handling map

Public records, AI content context, and API logs are handled separately.

Public reference data

Official NACE codes, source documents, public mappings, source metadata

Public, cached, and versioned with source attribution.

AI Gateway content context

source excerpts, code labels, candidate explainer text, QA findings

Processed server-side through approved model providers with source IDs, prompt version, model ID, and validation status.

API and search logs

request IDs, API key environment, rate-limit events, requested endpoint

Used for reliability, abuse prevention, and rate-limit enforcement.

Security controls

Current controls are focused on public browsing, scoped API access, and safe server-side AI use.

Authentication

Required only for scoped API access where stricter limits or protected endpoints are needed.

Role-based access control

Public readers and scoped API callers stay separated.

Public surface boundary

Public readers and scoped API callers use the same reference-data boundary.

API rate limiting

Per-key and anonymous endpoint-level limits protect public APIs.

Encryption

Traffic uses encryption in transit.

AI processing rules

How AI-assisted support text is checked before it appears on the site.

Only server-side code, route handlers, background jobs, or controlled scripts call the gateway.

Prompts must include source IDs and data versions when generating public explainer content.

Generated text is checked against source material before publication.

Model, prompt version, generation timestamp, source IDs, and validation status are stored with generated content.

AI-generated explanations are not legal, tax, filing, or regulatory advice.

Loading NACE reference