Privacy Policy

1. Who We Are

Neurophic Limited is the data controller responsible for your personal data. We are a company registered in England and Wales.

One exception: where a developer uses a project and its API keys to submit their own users' data, that developer is the data controller for that data, and we process it on their behalf under our Data Processing Terms (Schedule 1 of our Terms of Use). If you use an application built on Neurophic, please direct privacy questions and requests to that application's operator.

For any privacy-related queries, you can contact us at [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

Account Data

• Name (first name and surname)
• Email address
• Profile preferences (such as colour theme)

Billing and Payment Data

• Billing address and payment history when you top up project credit
• Payment card details are collected and held by our payment provider, Stripe; we never hold full card numbers
• Transaction and credit history for your projects, and invoice records
• Tax or VAT identification numbers you provide at checkout are collected and held by our payment provider, Stripe; we never hold them ourselves

Authentication and Session Data

• Session identifiers and authentication tokens
• Password (never stored in plain text)
• IP addresses and browser details may be processed transiently in our infrastructure and security logs
• Session timestamps
• One-time passcodes for email verification (temporary, deleted after use)

Developer and API Data

• Projects you create and their settings
• API key records (we store only a cryptographic hash of each key, with usage timestamps)
• End-user identifiers, optional end-user display names, and memory content submitted to your projects through the API or the console (processed on the developer's behalf; see Section 1)
• Messages you send in the console chat and the memory recalled to answer them, processed to generate a response and not retained
• Usage records for each request (operation type, AI model used, token counts and charges), used for billing

Feedback Data

• Feedback messages you submit (category and content)

Enquiry and Waitlist Data

• Name and email address for users who join our waitlist or submit an enquiry
• Company or organisation name (where provided)

Special Category Data

We do not intentionally collect special category data (such as information about health, political opinions, or religious beliefs). If such information reaches us through content submitted to your project, you are the controller for it and Schedule 1 of our Terms of Use applies; we recommend that you avoid submitting sensitive personal data unless necessary.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing and maintaining the developer console and API
• Authenticating your identity and managing your sessions
• Processing memory content and console chat messages through third-party AI providers to store memories and generate responses
• Processing payments and managing prepaid credit
• Sending billing and service communications (such as payment reminders)
• Retaining records we are legally required to keep, such as tax and accounting records
• Preventing fraud and abuse, including bot detection on public forms and handling payment disputes
• Understanding how our website and console are used via privacy-preserving analytics
• Monitoring service usage and enforcing usage limits
• Reviewing a sample of memory content to improve and assure the quality of the Memory System
• Sending transactional emails (such as verification codes and service notifications)
• Managing the waitlist and enquiry system
• Sending newsletter and marketing communications (with your consent)
• Collecting and responding to your feedback
• Ensuring the security of our Platform and preventing abuse
• Complying with our legal obligations

We do not sell your personal data to third parties.

4. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract performance (Article 6(1)(b)): Processing account data, authentication data, project data and billing data is necessary to provide our services to you. This also covers processing payments, managing prepaid credit, and sending billing and service communications.
• Consent (Article 6(1)(a)): Marketing communications are based on your consent, which you may withdraw at any time.
• Legal obligation (Article 6(1)(c)): We retain billing and transaction records to meet tax and accounting requirements.
• Legitimate interests (Article 6(1)(f)): We process security logs to protect our platform and prevent abuse, including bot detection on public forms, payment-dispute handling, and our email suppression list. We also rely on legitimate interests for privacy-preserving analytics, and to review a sample of memory content for service improvement and quality assurance. We have assessed that these interests do not override your fundamental rights.
• Explicit consent (Article 9(2)(a)): We do not intentionally collect special category data (such as information about health, political opinions, or religious beliefs). If special category data reaches us through content submitted to your project, you are the controller for it and must have a lawful basis and appropriate safeguards (Schedule 1, clause 12 of our Terms of Use).

Where we rely on consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Providing your account data (name and email address) is necessary to enter into a contract with us and use our services. If you do not provide this data, we will not be able to create your account.

5. The Memory System

A core feature of Neurophic is our Memory System, which stores and organises the memories a developer's application submits for its users. For that data the developer is the controller (see Section 1) and our Data Processing Terms describe the processing in full. This section explains what the processing involves.

What It Does

The Memory System stores content submitted to a project and uses it to answer retrieval and context requests about each end-user. It:

• Stores and organises memory content submitted for each identifier
• Extracts facts, preferences and context, and links related memories
• Uses stored information to answer retrieval and context requests, including the console chat
• Performs periodic background processing to organise and maintain stored information

Background processing runs on a schedule and involves transmitting stored memories to our AI providers (see Section 6) without further action from you, for example to classify, connect and consolidate what has been stored. During this processing, any display name a developer has supplied for an end-user is included so that extracted facts are attributed to the correct person.

Profiling

This processing constitutes profiling of the end-users concerned under UK GDPR Article 4(4). We carry it out on the developer's instructions as their processor; the developer is responsible for the lawful basis and for telling their users about it.

Developers can delete memories, reset or delete identifiers, or delete whole projects at any time. If you use an application built on Neurophic, please direct requests about your memories to its operator. See Section 10 for details.

6. Third-Party Providers

We share your personal data with the following categories of third-party data processors:

AI Providers

When memory content is submitted to a project, when a retrieval or context request is made, and when you use the console chat, the relevant memory content, your message and any display name attached to the identifier are transmitted to a third-party AI provider to process the memory or generate a response. The providers we currently use are:

• OpenAI (United States)
• Anthropic (United States)

Content may be processed by both providers regardless of the model you select in the console chat: for example, Memory System embeddings and background processing use OpenAI models even when you choose an Anthropic model. All AI traffic is routed through our AI gateway, Vercel (United States). We may add or change providers from time to time and will update this list accordingly.

Payment Provider

Stripe (United States) processes your name, email, billing address, card details and transaction history when you top up.

Infrastructure Providers

We use third-party cloud hosting, database, and infrastructure providers to deliver our services.

Analytics

Plausible (EU), a privacy-preserving, cookieless analytics service, measures page views on our website and console.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We only share data as described in this Policy or where required by law.

7. International Data Transfers

Our AI Providers and gateway, our payment provider, and some infrastructure providers are based in the United States. This means your personal data, including console chat messages, project end-user data (including any display names developers supply) and billing data, is transferred outside the United Kingdom for processing.

We ensure appropriate safeguards are in place for these transfers, including:

• The UK Extension to the EU-US Data Privacy Framework, where the receiving organisation is certified
• UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) where the Data Privacy Framework does not apply

You may request further details about the specific safeguards applied to your data by contacting us at [email protected].

8. Automated Decision-Making and Profiling

The Memory System constitutes profiling under UK data protection law. It automatically analyses memory content submitted to a project to identify and store relevant information about each end-user.

This profiling is used to:

• Answer retrieval and context requests with the most relevant memories
• Recall information from previously submitted content
• Identify patterns and connections in stored information

In accordance with the Data (Use and Access) Act 2025, you have the right to:

• Be informed about significant decisions influenced by automated processing
• Make representations about automated processing and its effects on you
• Request human intervention in any decision significantly affected by automated processing
• Contest any automated decision that significantly affects you

To exercise any of these rights, contact us at [email protected].

9. Data Retention

We retain your data for the following periods:

• Account data: deleted promptly when your account deletion completes (an automated process, typically the same day). Accounts with no projects that have not been signed in to for 6 months or more may be deleted after we give notice by email.
• Console chat messages: processed to generate a response and not retained; the usage record of the request is kept for billing for the life of the project.
• Billing and transaction records: retained for up to 6 years after the relevant financial year, as required by UK tax law, including at our payment provider after account deletion.
• Usage and session records: for the life of your account or project.
• Email suppression list: if an email to you bounces or you report our email as spam, we keep that email address after account deletion so we never contact it again (legitimate interests).
• Erasure receipts: a pseudonymised record of each deletion (a hashed reference, counts and timestamps, no readable personal data) is kept indefinitely as proof of deletion.
• Project end-user data: retained until the developer deletes it or the project is deleted. Suspended projects' data is retained; projects suspended for 90 days or more may be deleted after notice. A display name attached to an identifier is retained until the developer overwrites it, resets the identifier (which clears it) or deletes the identifier; because names can appear inside derived memory content, complete removal of a name requires an identifier reset or deletion.
• Waitlist and enquiry data: until you ask us to delete it at [email protected].
• Verification codes: expire within minutes of being issued.
• Residual copies: may persist in encrypted backups, transient processing queues and operational logs for a limited period before expiring automatically.

When you delete your account, we delete your personal data except the specific records described above (suppression list, erasure receipt, legally required billing records, and expiring backups) and records we reasonably need to establish, exercise or defend legal claims or to investigate fraud or abuse.

10. Your Data Protection Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request that we correct any inaccurate personal data.
• Right to erasure: Request deletion of your personal data.
• Right to restrict processing: Request that we limit how we process your data.
• Right to data portability: Request your data in a structured, commonly used, and machine-readable format.
• Right to object: Object to processing of your data. You have an absolute right to object to direct marketing.
• Right to withdraw consent: Where processing is based on consent (such as marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You can exercise deletion yourself at any time: Settings offers Delete account (full erasure), and project owners can delete or reset identifiers (reset also clears any stored display name), delete memories or whole projects in the console. For access and portability, email [email protected] and we will provide your data in a machine-readable format within one month.

If your data reached us through an application built on Neurophic, that application's operator is the controller: please direct requests to them, and we will assist them in fulfilling your request.

To exercise any of these rights, email us at [email protected]. We will respond within one month. In complex cases, we may extend this by a further two months, and we will inform you if this is necessary.

Requests are free of charge unless they are manifestly unfounded or excessive.

If you are unhappy with how we handle your personal data, you have the right to complain to us: contact [email protected] and we will acknowledge your complaint within 30 days and investigate.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by telephone on 0303 123 1113.

11. Cookies

We use only strictly necessary storage in your browser: to keep you signed in and to remember interface preferences. This is essential for the platform to function and does not require your consent.

Our website and console analytics (Plausible) are cookieless and do not identify you, and public forms are protected against bots by Cloudflare Turnstile. We do not use cookies or any other tracking for advertising, and no cross-site tracking of any kind.

12. Children

Our services are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that data promptly.

13. Marketing and Communications

We only send marketing communications (such as newsletters and product updates) with your explicit consent. We will not send marketing emails unless you have actively opted in.

Transactional emails, such as verification codes and important service notifications, are sent as part of providing our services and do not require marketing consent.

You can unsubscribe from marketing communications at any time by using the unsubscribe link in any marketing email, or by contacting us at [email protected].

14. Data Security

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Platform before the changes take effect.

The latest version of this Policy will always be available on this page.

16. Contact Us

If you have any questions about this Policy or how we handle your personal data, please contact us at:

Email: [email protected]
Website: https://neurophic.ai