Contents
1.Who we are and what this policy covers
1.1NeuroAI Inc. ("NeuroAI", "we", "us") is a Delaware corporation (USA) with its address at 254 Chapman Rd, Ste 208 #24811, Newark, DE 19702, United States. We operate the NeuroAI and NeuroAI Studio brands.
1.2This policy explains how we handle personal data when you:
- a)visit neuroaistudio.com or our other pages (the "Website");
- b)use the application at app.neuroaistudio.com (the "App") and its features: CRM, website, scheduling, WhatsApp, SMS and email messaging, calls, payments, reviews and reports;
- c)talk to NEO, our AI virtual assistant, on the Website, on WhatsApp, by phone or inside the App;
- d)write to us or call us, ask for support, take a demo, subscribe to our messages or buy a plan.
Together, these are the "Services".
1.3What it does not cover:
- a)third-party websites and services, even if we link to them;
- b)how each business customer handles the data of its own customers. That is governed by that business's privacy policy (see section 3).
1.4Language. We publish this policy in Spanish and English. If the two versions differ, the English version controls.
1.5Related documents: Terms of Service (https://neuroaistudio.com/legal/terms); Billing, Renewal, Cancellation and No-Refund Policy (https://neuroaistudio.com/legal/billing); Acceptable Use, Messaging and AI Policy (https://neuroaistudio.com/legal/acceptable-use); AI Notice (https://neuroaistudio.com/legal/ai-notice); Data Processing Agreement (DPA) (https://neuroaistudio.com/legal/dpa); and list of subprocessor categories (https://neuroaistudio.com/legal/subprocessors). This policy is at https://neuroaistudio.com/legal/privacy. The terms of NeuroAI's SMS program are in section 8 of this policy and in section 20 of the Terms.
2.Quick summary
- We do not sell your personal information or your contacts' information.
- We do not share mobile numbers or SMS consent with third parties or affiliates for marketing or promotional purposes (section 8).
- We do not use our customers' data, or their contacts' data, to train AI models.
- NEO always introduces itself as an AI virtual assistant and can hand you over to a person.
- If you are a customer of a business that uses NeuroAI, that business decides about your data; we process it on its behalf (section 3).
- Analytics and advertising cookies are only turned on if you accept them (section 13).
- You can ask to access, correct or delete your data at legal@neuroaistudio.com (section 16).
3.Our two roles: controller and processor
3.1NeuroAI as controller. We decide why and how we use the data of:
- a)our customers: the businesses that buy a plan ("Customers") and the members of their team who use the App ("Users");
- b)people who visit the Website, take a demo, ask for information or subscribe to our messages;
- c)people who contact NeuroAI, or NEO when it acts on behalf of NeuroAI.
California law calls us a "business" in this role; the GDPR calls us a "controller".
3.2NeuroAI as processor. Customers use the App to serve their own customers, prospects and other people they communicate with ("Contacts"). In that case, the Customer decides what data it collects, why and for how long. NeuroAI processes that data only to provide the Services, following the Customer's instructions, the Terms of Service and the DPA. California law calls us a "service provider" in this role; the GDPR calls us a "processor".
3.3If you are a Contact of a business that uses NeuroAI:
- Read that business's privacy policy and send your requests to it.
- If you write to us, we will pass your request to the business when we can identify it, and help it respond.
- To stop messages from a business: reply STOP to its texts, use the unsubscribe link in its emails, or opt out or block it on WhatsApp.
3.4What each Customer agrees to do. This is a summary; the details are in the Terms of Service and the DPA.
- a)Publish its own privacy policy and tell its Contacts that it uses technology providers and an AI assistant.
- b)Have the legal basis and the consent the law requires for each channel, and keep proof. For example: the Telephone Consumer Protection Act (TCPA), the A2P 10DLC rules and the CTIA Messaging Principles for SMS; the CAN-SPAM Act for email; the WhatsApp Business Messaging Policy; call recording laws; and the privacy laws of its country or state.
- c)Honor opt-outs (STOP, unsubscribe links, blocks) inside and outside each channel.
- d)Not upload sensitive data that the App is not designed to protect (section 4.4).
- e)Answer its Contacts' privacy requests, with our reasonable help.
The Customer is responsible for the content it sends and for the consent of ITS Contacts.
3.5Limited exception. We also handle some Contact data as a controller, only to:
- keep the Services secure and prevent fraud, spam and abuse;
- comply with carrier and Meta rules;
- keep opt-out records so that opt-outs are honored;
- meet legal obligations.
We never use it for our own marketing.
4.Data we collect as controller
4.1Data you give us:
- a)Account and profile: name, email, phone, job title, login credentials, language and time zone.
- b)Business: legal and trade name, type of business, country, address, website, social media, logos and photos. Also your tax ID (EIN or other) when it is needed to register your messaging channels.
- c)Billing: plan, billing period, billing address, payment history and wallet top-ups. We only accept card payments through Stripe, our payment processor (including Apple Pay, Google Pay and Link). Full card details are received and stored by Stripe. We only see limited data, such as the card brand, the last 4 digits and the expiry date.
- d)Channel registration: the data that carriers and Meta require to register your brand and SMS campaigns (A2P 10DLC), verify toll-free numbers or connect WhatsApp Business. For example: legal name, EIN, address, website, contact person, sample messages and how you collect consent.
- e)Questionnaire and setup: your answers to the onboarding questionnaire (type of business, country, languages, hours, services and prices), NEO's instructions, the knowledge base, FAQs and templates.
- f)Support and communications: tickets, emails, chats, WhatsApp messages and calls with NeuroAI or NEO, and their recordings or transcripts when we tell you (section 10).
- g)Demo: what you type or say in the NEO demo, such as your business name and type, your name and your contact details.
- h)Marketing and events: subscriptions, preferences and survey answers.
- i)Testimonials: your opinion, name, image or video, only with your written permission.
4.2Data created when you use the Services:
- a)App usage: features used; consumption of messages, minutes, AI and Meta fees; wallet balance; spending limits and alerts; activity logs.
- b)Technical data: IP address, browser, device, operating system, pages viewed, date and time, cookie identifiers and approximate location inferred from the IP (country or city). We do not ask for your precise location.
- c)Proof of acceptance: when you buy, we keep which box you checked, the text and version of the Terms and of this policy, the date, time, IP address, plan and price. We do the same for wallet auto-recharge, renewal notices and cancellation.
- d)Consent and opt-out records: when and how you accepted or declined SMS, WhatsApp, calls or emails, and when you opted out.
4.3Data we receive from third parties:
- a)Our payment processor (Stripe): payment results, fraud signals and chargebacks.
- b)Sanctions lists: the result of screening a Customer's name against official lists (section 22).
- c)Integrations you connect, such as Google, Meta (Facebook, Instagram, WhatsApp) or your calendar: the data you authorize in that connection. That service's authorization screen may show the name of one of our infrastructure providers, which receives that data on our behalf (section 7). You can also remove access in that service's settings.
- d)Carriers, messaging registries and Meta: the status of your registrations, the quality of your numbers and compliance notices.
- e)Advertising and analytics platforms: campaign statistics, if you accept cookies (section 13).
4.4Sensitive data. We do not ask for sensitive data. Please do not upload to the App, or ask your Contacts for, Social Security or ID numbers, full card or bank account numbers, biometric data or data about children, unless the law allows it and you have the required safeguards. You must not upload health data either: NeuroAI does not provide the Services to healthcare businesses of any kind, the App is not designed for health information protected by HIPAA, and NeuroAI does not sign business associate agreements (BAAs) (see the Acceptable Use, Messaging and AI Policy). Your account login credentials are sensitive information under California law: we only use them to give you access and protect your account.
5.Data about our customers' contacts (as processor)
5.1What data. Whatever each Customer chooses to store or receive in the App: name, phone, email, address, notes, tags, appointments, orders, payments to the business, conversations (WhatsApp, SMS, email, website chat and social media), calls with their recordings or transcripts, forms, reviews, loyalty points and consent and opt-out records.
5.2Why. Only to provide the Services to the Customer: store and organize its contacts, send and receive messages, let NEO reply on behalf of the business, schedule, take payments, request reviews, produce reports, provide technical support, keep things secure and comply with the law.
5.3What we do NOT do with that data:
- we do not sell it;
- we do not use it for our own marketing or contact Contacts on our own behalf;
- we do not combine it with other Customers' data;
- we do not use it to train AI models;
- we do not share mobile numbers or SMS consent with third parties or affiliates for marketing or promotional purposes (section 8.2).
5.4Subprocessors. We use providers from the categories in section 7, which process data on our behalf under confidentiality and security obligations. We publish the subprocessor list by category at https://neuroaistudio.com/legal/subprocessors. We only give the subprocessors' names, as confidential information, to a Customer who asks for them because a legal obligation requires it. We notify the Customer at least 30 days before adding or replacing a subprocessor, and the Customer can object as explained in the DPA.
5.5When the subscription ends. Until the end date, the Customer can export its data from the App. For the following 30 days the account is locked, but the Customer can reactivate it or ask soporte@neuroaistudio.com for an export of all the data the App allows it to export, free of charge once. After that, we delete or anonymize the data no later than 90 days after the end date; backups are deleted in their normal cycle. We keep what the law requires us to keep (section 14).
6.Why we use data and our legal basis
The "legal basis" is required by the GDPR and similar laws. Everywhere else, this list explains why we use data.
- a)Create and manage your account and provide the Services. Basis: contract.
- b)Charge for the plan, setup and usage by card through Stripe; manage the wallet and the auto-recharge (minimum $25) that you accept at checkout; alert you at 70%, 80%, 90% and 100% of your AI spending limit; and send you renewal notices for an annual plan 30, 15, 7 and 3 days before it renews. Basis: contract and legal obligation.
- c)Keep proof of what you accepted (acceptance checkbox, auto-recharge, no-refund terms, renewal and cancellation) and of each renewal notice sent, and defend against chargebacks and claims. Basis: legitimate interest and legal obligation.
- d)Register and maintain your channels (A2P 10DLC, numbers and WhatsApp Business). Basis: contract, legal obligation and industry rules.
- e)Run NEO (section 11). Basis: contract.
- f)Support, setup and training, including NeuroAcademy videos. Basis: contract.
- g)Apply AI fair use and plan limits. For this we look at usage volumes, not the content of your conversations, unless needed to fix a problem or stop abuse. Basis: contract and legitimate interest.
- h)Security; preventing fraud, spam and abuse; and complying with carrier and Meta rules. Basis: legitimate interest and legal obligation.
- i)Screen against U.S. sanctions lists and export controls (section 22). Basis: legal obligation.
- j)Improve the Services with aggregated or de-identified statistics. We do not try to re-identify anyone from them. Basis: legitimate interest.
- k)Send you news and offers by email, SMS or WhatsApp, only if you allow it and with an opt-out in every message. Basis: consent, or legitimate interest for emails to Customers about similar services where the law allows it.
- l)Website analytics and advertising with non-essential cookies, only with your consent (section 13). Basis: consent.
- m)Publish testimonials only with your written permission, and truthfully, as the FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising require. Basis: consent.
- n)Comply with the law, respond to authorities and enforce our Terms. Basis: legal obligation and legitimate interest.
Where the basis is legitimate interest, you can object (section 16). Where it is consent, you can withdraw it at any time; this does not affect what was done before.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
7.Who we share data with (by category)
We only share what each purpose needs:
- a)Cloud infrastructure and software providers: hosting for the Website and App, database and CRM, storage, content delivery network, email delivery and support tools.
- b)Our payment processor, Stripe: card payments (including Apple Pay, Google Pay and Link), top-ups, fraud prevention and chargebacks. For some purposes, such as fraud prevention, Stripe acts on its own behalf under its own privacy policy. If you pay with Apple Pay or Google Pay, Apple or Google also process payment data under their own policies.
- c)Messaging and telephony providers: carriers, SMS, voice and phone number providers, the U.S. messaging campaign registry (for A2P 10DLC) and Meta (for WhatsApp).
- d)AI model providers: they process the text, audio or transcripts needed for NEO and the AI features to respond (section 11).
- e)Our support team and our implementation team: the people or companies NeuroAI hires to install, configure or support the Services. They have limited access to your account and a duty of confidentiality.
- f)Analytics and advertising tools: only if you accept cookies (section 13). They never receive mobile numbers or SMS opt-in data (section 8.2).
- g)Professional advisers: lawyers, accountants, auditors and insurers, under a duty of confidentiality.
- h)Authorities and third parties for legal reasons: when the law requires it, in response to a valid order, or to protect rights, people's safety or prevent fraud.
- i)Corporate transactions: if NeuroAI merges, is sold or reorganizes, data may pass to the new owner, which must honor this policy or tell you about changes.
- j)Integrations you choose: when you connect a third-party service, we send it what you authorize. That third party follows its own policy.
- k)Inside your account: Users authorized by the Customer see that account's data according to their permissions.
We do not sell personal information or hand it over for money. For what California law calls "sharing" for advertising, see section 17.
8.Text messages (SMS) and A2P 10DLC clause
8.1NeuroAI SMS program. NeuroAI Inc. sends text messages to people who agree to receive them. For example: account notices, demo or appointment confirmations and reminders, support, billing, wallet balance, spending limits, renewal notices and, only if you agree separately, news and offers. Automated SMS are sent from NeuroAI's numbers registered for SMS.
- We ask for consent to marketing messages and to non-marketing messages separately, with unchecked boxes.
- Consent is not a condition of purchase.
- Message frequency varies.
- Message and data rates may apply.
- Marketing SMS are only sent between 9:00 a.m. and 8:00 p.m. in the recipient's local time, and every one of them reminds you how to opt out.
- To opt out, reply STOP. We also honor STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPT OUT, BAJA, ALTO, PARAR, CANCELAR, DETENER and FIN, in upper or lower case, and any other reply that reasonably asks to stop messages. We will send a confirmation message and you will no longer receive SMS from that program. To rejoin, sign up again as you did the first time.
- For help, reply HELP or AYUDA, email soporte@neuroaistudio.com or call +1 646 235 1719.
- Carriers are not liable for delayed or undelivered messages.
8.2We do not share mobile data. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
"Mobile information" includes your mobile number, your opt-in consent and the records of that consent. We never upload mobile numbers or SMS opt-in data to advertising platforms (for example, custom audiences or pixel advanced matching). This clause overrides any other part of this policy.
8.3SMS sent by our Customers. When a business sends SMS from the App, the sender is that business. It must have its own consent, identify itself in its messages, include STOP and HELP instructions and honor opt-outs, as required by the TCPA, the A2P 10DLC rules, the CTIA Messaging Principles and state laws. The App keeps opt-out records so the business does not text people who replied STOP again. NeuroAI does not use those numbers or that consent for anything else.
8.4Registration data. To register a Customer's SMS brand and campaigns, we send its company data (not its Contacts' data) to carriers and to the industry campaign registry. This is required to send SMS in the U.S.
9.WhatsApp
9.1NeuroAI and our Customers use Meta's WhatsApp Business Platform. Meta handles messages under the WhatsApp Business terms and its own privacy policy.
9.2We only message people on WhatsApp who agreed to that type of message. Business-initiated messages use templates approved by Meta. You can block us, report us or opt out at any time, inside or outside WhatsApp, and we will honor it.
9.3On WhatsApp, NEO acts as the customer service assistant of the business (or of NeuroAI). It is not a general-purpose AI assistant. On NeuroAI's WhatsApp, NEO only answers about NeuroAI; the demo that simulates your business is only available on the Website.
9.4We do not use WhatsApp data, not even in anonymous or aggregated form, to create, train or improve AI models. We only use it to exchange messages with you and provide the service.
9.5If a business owner keeps using the WhatsApp Business app on their phone together with the platform (coexistence), messages are synced between the two.
9.6Each Customer is responsible for its consent, its privacy policy and compliance with the WhatsApp Business Messaging Policy.
10.Calls, recordings and transcripts
10.1Calls with NeuroAI. Calls with NeuroAI (for example, to +1 646 235 1719) may be answered by NEO. They may be recorded and transcribed to respond to you, for quality and security, and as proof of what was agreed. We tell you at the start of the call. If you do not want to be recorded, say so and we will offer another channel, such as email. We keep those recordings and transcripts for 12 months (section 14).
10.2Our Customers' calls. Customers can turn on recording, transcription and AI voice agents. The Customer must give notice and obtain the consent the law requires. Some U.S. states, such as California, Florida, Pennsylvania or Washington, require the consent of all parties, and other countries have their own rules.
10.3AI voices. Under FCC Declaratory Ruling 24-17 (2024), AI-generated voices are an "artificial voice" under the TCPA. NeuroAI only makes outbound calls with an AI or prerecorded voice to people who gave prior express consent, and prior express written consent if the call is for marketing. We require the same from our Customers.
10.4We do not use recordings to create voiceprints or other biometric identifiers.
11.Artificial intelligence and NEO
11.1What NEO is. NEO is NeuroAI's AI virtual assistant. It acts on behalf of NeuroAI (sales and support) and, inside the App, on behalf of each Customer with its Contacts. NEO always introduces itself as an AI virtual assistant, also to comply with California's bot disclosure law (Bolstering Online Transparency Act). If a Customer gives it another name (for example, "Sofía"), the assistant still always introduces itself as an AI virtual assistant. It does not pretend to be a person, and it offers to hand over to a person at the business when asked or when needed.
11.2What data NEO uses: the message or call it receives, the history of that conversation, the business's knowledge base and instructions, and the CRM data it needs to respond (for example, open slots in the calendar). The NEO demo is only available on the Website: there, NEO uses the data you type to simulate how it would serve your business's customers, and it says that it is an AI simulation.
11.3AI model providers. To generate replies, that data is sent to AI model providers that process it on our behalf or on the Customer's behalf. We work with providers whose terms do not allow them to use this data to train their models.
11.4We do not train AI models, our own or third parties', with Customer or Contact data. A Customer's knowledge base is only used by that Customer's NEO.
11.5Limits. AI replies can contain errors. NEO does not give diagnoses or legal, financial or medical advice. Customers can review and correct replies and settings. NEO does not, on its own, make decisions with legal or similarly significant effects on people.
11.6Internal tools. The NeuroAI team may use AI tools to work (for example, to draft support replies or analyze aggregated metrics), with as little personal data as possible. Those tools do not read Contacts' personal data, except when necessary (for example, to handle a Customer's support request or to fix a problem or stop abuse).
11.7AI usage. We measure AI usage (number of replies, minutes and cost) to apply fair use, spending limits and your plan's alerts, including on plans with no-meter AI (subject to fair use; not unlimited).
12.Email
12.1We send you service emails: account, security, billing, top-ups, renewals, cancellation and legal changes. You cannot opt out of them while you have an account, because they are needed for the service.
12.2Our marketing emails include our postal address and a working unsubscribe link. We honor opt-outs within 10 business days, as the CAN-SPAM Act requires, and we use truthful subject lines and sender names.
12.3In our marketing emails, we measure whether you open them or click on them (with tracking pixels or links) to improve our emails. We do not do this in service emails.
12.4Emails that Customers send from the App are each Customer's responsibility; the Customer must comply with CAN-SPAM and other applicable laws.
13.Cookies and similar technologies
13.1We use cookies and similar technologies (local storage, pixels and tags) on the Website and in the App.
13.2Types:
- a)Necessary: login, security, load balancing, remembering your cookie choice and making chat and forms work. Always on.
- b)Preferences: language and display options.
- c)Analytics: to understand how the Website is used (for example, Google Analytics). Only with your consent.
- d)Advertising: to measure ads and show you NeuroAI ads on other platforms (for example, the Meta pixel or Google Ads tags). Only with your consent. We never upload mobile numbers or SMS opt-in data to advertising platforms (for example, custom audiences or pixel advanced matching).
13.3Analytics and advertising cookies stay off until you accept them. You can change your choice at any time under "Cookie preferences" in the footer of every page.
13.4We honor the Global Privacy Control (GPC) signal as a request not to "sell or share" your data for advertising. Browser "Do Not Track" signals have no common standard, so we do not change anything when we receive them; with GPC, we do.
14.How long we keep data
We keep data only as long as each purpose needs. Periods:
- Customer account and profile: while the account is active and up to 90 days after the subscription ends.
- Contact data and account content: for the length of the subscription; after the end date, 30 days with the account locked (section 5.5) and deletion or anonymization no later than 90 days after the end date; backups are deleted in their normal cycle.
- Billing, payment and tax records: as long as tax and accounting laws require, usually up to 7 years.
- Proof of acceptance (checkbox, Terms, auto-recharge, renewal notices and cancellation): for the length of the relationship and 5 more years, because of chargebacks and claims.
- Consent and opt-out records (SMS, WhatsApp, calls and email): at least 5 years from the last message, because TCPA claims can be filed years later.
- Recordings and transcripts of calls with NeuroAI: 12 months, unless needed for a claim.
- Customers' recordings and transcripts: as each Customer configures and, at most, until the deletion described in section 5.5.
- Support tickets and conversations: 3 years.
- Demo data: 12 months if you do not become a Customer.
- Marketing (prospects and subscribers): until you opt out or after 24 months without interaction. We keep the opt-out so we can honor it.
- Technical and security logs: up to 12 months.
- Website analytics: up to 14 months.
- Sanctions screening: as long as OFAC rules require (currently up to 10 years).
When the period ends, we delete or anonymize the data.
15.Security
- Encrypted connections (HTTPS/TLS) on the Website and in the App.
- Infrastructure providers with industry-recognized security controls. Those certifications belong to them, not to NeuroAI.
- Individual access with least privilege, two-step verification and activity logs.
- Confidentiality agreements with staff and contractors.
- Backups and an incident response plan.
No system is 100% secure. If a breach affects your data, we will notify you without undue delay and notify authorities when the law requires it (for example, U.S. state breach notification laws or the GDPR). If the breach affects Contact data, we will notify the Customer within 72 hours after we confirm it, as explained in the DPA. You must protect your password, turn on two-step verification and tell us at seguridad@neuroaistudio.com if you suspect unauthorized access.
16.Your rights and how to use them
16.1Depending on where you live, you can ask to:
- know what data we hold and get a copy (access and portability);
- correct it;
- delete it;
- restrict certain uses or object to them;
- withdraw your consent;
- stop receiving marketing.
We offer these rights to everyone, even where the law does not require it, subject to legal exceptions.
16.2How to ask: email legal@neuroaistudio.com with the subject "Privacy", or call +1 646 235 1719. You can also see and correct much of your data in your account.
16.3Verification. To protect your data, we will confirm your identity, for example with a code sent to your account email or phone. You can use an authorized agent with signed permission; in that case we may ask you to confirm your identity directly with us.
16.4Timing. We respond within the period your law sets: for example, 45 days in California (extendable by another 45) or one month under the GDPR (extendable by two more months). If we need the extension, we will tell you. We apply requests not to sell or share within 15 business days at most.
16.5Exceptions. We may refuse to delete data that the law requires us to keep (for example, invoices, proof of acceptance or opt-out records) or that we need for a claim. We will explain why.
16.6Appeals. If we deny your request, you can appeal by replying to our email with the subject "Appeal". We will respond within the period your law sets. If you still disagree, you can contact your data protection authority or your state Attorney General.
16.7If you are a Customer's Contact, see section 3.3.
16.8We will not treat you worse for exercising your rights.
17.California (CCPA/CPRA) and other U.S. states
17.1This section is for California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and for residents of other states with privacy laws (for example, Virginia, Colorado, Connecticut, Utah, Texas or Oregon). Some of those laws may not yet apply to NeuroAI because of its size; we honor these rights anyway. This policy is also our notice at collection.
17.2Personal information collected in the last 12 months as a controller. For each category: where it comes from and which recipients in section 7 receive it for business purposes.
- Identifiers (name, email, phone, IP address, account ID). Source: you and your device. Recipients: a, b, c, d, e, g.
- Customer records (address, limited billing data, proof of acceptance). Source: you and the payment processor. Recipients: a, b, g.
- Commercial information (plans, purchases, usage and wallet). Source: you and your use. Recipients: a, b, e, g.
- Internet activity (Website and App usage, cookies). Source: your device. Recipients: a and, only with your consent, f.
- Approximate location (from the IP address; never precise). Source: your device. Recipients: a.
- Audio and electronic information (call recordings and transcripts, voice notes). Source: you. Recipients: a, c, d, e.
- Professional information (business and job title). Source: you. Recipients: a, c, e.
- Inferences (for example, which plan may suit you). Source: the data above. Recipients: a, d.
- Sensitive information: account login credentials and card data (card data is handled by the payment processor). Recipients: a, b. We only use it to give you access, protect your account and take payment, never to infer characteristics about you.
We do not knowingly collect biometric data, health data or protected characteristics.
17.3Purposes and retention: purposes are in section 6 and retention periods in section 14.
17.4Selling and "sharing". We do not sell personal information. If you accept advertising cookies, California law may treat this as "sharing" data for cross-context behavioral advertising. You can opt out at any time under "Do Not Sell or Share My Personal Information / Cookie preferences", or with the GPC signal. This never includes mobile numbers or SMS consent (section 8.2). We do not knowingly sell or share the data of anyone under 16.
17.5Your California rights: to know and access, delete, correct, opt out of selling or sharing, limit the use of sensitive information and not be discriminated against. Because we only use sensitive information for permitted purposes, a separate "limit" link is not needed. You exercise these rights as explained in section 16.
17.6California "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing.
17.7Nevada: we do not sell covered information under Nevada law.
17.8If you are a Customer's Contact, we act as a service provider: send your request to the business (section 3.3).
18.European Economic Area, United Kingdom and Switzerland (GDPR)
18.1NeuroAI is based in the U.S. and does not offer the Services to businesses established in the European Economic Area, the United Kingdom or Switzerland. If the General Data Protection Regulation (GDPR), the UK GDPR or Swiss law applies to your data (for example, because NeuroAI exceptionally accepted a Customer there in writing), this section explains your rights.
18.2Controller: NeuroAI Inc. (details in section 24). Legal bases: section 6.
18.3Your rights: access, rectification, erasure, restriction, objection (always available for direct marketing), portability, withdrawing consent and lodging a complaint with your data protection authority.
18.4Transfers: section 21.
19.Latin America, Lebanon and other countries
19.1We serve Customers in many countries. We apply this policy together with the local laws that apply. For example:
- Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (ARCO rights).
- Colombia: Law 1581 of 2012.
- Argentina: Law 25,326.
- Chile: Law 19,628 and, once in force, Law 21,719.
- Peru: Law 29733.
- Brazil: General Data Protection Law (LGPD).
- Venezuela: the habeas data right recognized in its Constitution.
- Lebanon: Law No. 81 of 2018 on Electronic Transactions and Personal Data.
19.2When you use the Services, your data is transferred to and processed in the U.S. and other countries where our providers operate (section 21). If your law requires your consent for that transfer or for a type of processing, we will ask for it expressly before providing the Services in your country, as set out in that country's annex.
19.3In Argentina, the Agency for Access to Public Information (AAIP), the supervisory authority under Law 25,326, handles complaints and claims about data protection.
19.4You exercise your rights as explained in section 16. If your law sets a shorter deadline, we meet it.
20.Children
20.1The Services are only for businesses and for people 18 and older. They are not directed to children under 13 (or under 16 where that is the applicable age). We do not knowingly collect data from children under 13 (Children's Online Privacy Protection Act, COPPA), or from anyone under 16 without the consent the law requires.
20.2If we learn that we collected a minor's data without that consent, we will delete it. Tell us at legal@neuroaistudio.com.
20.3Customers must not use the App to collect data from children under 13 or to send them marketing, unless they comply with COPPA and local laws.
21.International transfers
21.1NeuroAI is based in the U.S., and our providers may process data in the U.S. and other countries. The laws of those countries may protect data differently from the law of your country.
21.2Where the law requires it, we use safeguards such as:
- the standard contractual clauses approved by the European Commission, and their UK and Swiss versions, only if NeuroAI exceptionally accepts a Customer from those countries in writing (section 18);
- the EU-U.S. Data Privacy Framework, where the provider is certified;
- your express consent, where your local law requires it.
21.3You can ask for more information about these safeguards at legal@neuroaistudio.com.
22.Sanctions and export controls
22.1To comply with U.S. sanctions and export controls, after sign-up we screen Customers' names (and, if needed, those of their owners or representatives) against official lists, such as the Specially Designated Nationals (SDN) List of the U.S. Treasury Department's Office of Foreign Assets Control (OFAC).
22.2The Customer represents that neither it, its business nor its owners are on those lists; that they are not located in a country or region subject to a comprehensive U.S. embargo; that they are not, and are not acting on behalf of, a government or entity blocked by the U.S. (for example, the Venezuelan State or its agencies and companies); and that they are not linked to sanctioned organizations (see section 23 of the Terms).
22.3Where the law requires, we may refuse or suspend the Services, and we keep the screening result. If we receive a payment from a sanctioned person or entity, we block it and report it to the U.S. authorities, as the law requires, with the necessary data about the payment and the payer.
23.Changes to this policy
23.1We may update this policy. We will publish each new version with its date.
23.2If a change is material, we will notify Customers by email or in the App at least 30 days in advance, unless the law requires us to apply it sooner (the same as Section 28 of the Terms).
23.3If a change requires your consent, we will ask for it. We keep previous versions, and you can ask for them.