# Privacy notice > How Neural Inverse collects, uses and protects personal information, and the rights you have. Source: https://neuralinverse.com/legal/privacy/ --- Legal # Privacy notice How we collect, use and protect personal information when you visit this website, contact us or do business with us, and the rights you have. Last updated 18 October 2026 Contents 1. [Who we are](https://neuralinverse.com/#who) 2. [What this notice covers](https://neuralinverse.com/#scope) 3. [What we collect](https://neuralinverse.com/#collect) 4. [How we use it, and our legal bases](https://neuralinverse.com/#use) 5. [Data in our products](https://neuralinverse.com/#products) 6. [Who we share it with](https://neuralinverse.com/#share) 7. [International transfers](https://neuralinverse.com/#transfers) 8. [How long we keep it](https://neuralinverse.com/#retention) 9. [How we protect it](https://neuralinverse.com/#security) 10. [Your rights](https://neuralinverse.com/#rights) 11. [Regional information](https://neuralinverse.com/#regional) 12. [Children](https://neuralinverse.com/#children) 13. [Changes to this notice](https://neuralinverse.com/#changes) 14. [Contact and complaints](https://neuralinverse.com/#contact) **In short:** this website uses Google Analytics only if you accept analytics cookies, and has no advertising or social media tools. We collect what you send us, use it to answer you and run our business, never sell it, and keep it no longer than we need to. ## Who we are Neural Inverse is a group of companies. The parent company is Neural Inverse, Inc., a corporation registered in Delaware, United States. Its subsidiaries are: - Neural Inverse Private Limited, registered in India - \[registered name of the subsidiary, united kingdom: to be confirmed\], registered in England and Wales For this website and for enquiries, Neural Inverse, Inc. is the controller of your personal information. When you do business with one of our subsidiaries, that subsidiary is also a controller for that relationship. Registered details for each company are on the [company information](https://neuralinverse.com/legal/company-information/) page. ## What this notice covers This notice applies to personal information we handle as a controller: - visitors to this website; - people who contact us, including sales, partnership, support and press enquiries; - people who subscribe to our newsletter or register for our events; - contacts at our customers, prospects, partners and suppliers; - people who report security vulnerabilities to us; - people who apply for a job with us; - administrators and billing contacts of organisations that use the service we host. It does not cover personal information inside our products when an organisation uses them. That organisation decides how its data is processed; see [data in our products](https://neuralinverse.com/#products). ## What we collect ### When you visit this website Our web servers record each request: your IP address, the date and time, the page requested, the response, your browser's user agent and the referring page. We use these logs to run and secure the website. We do not use advertising or social media tools. ### If you accept analytics cookies We use Google Analytics to count visits and see which pages are useful. Only if you accept analytics cookies, your browser loads Google's script and sends Google your IP address, browser and device details, the pages you visit and how you reached them, with a cookie that recognises your browser on later visits. Google Signals and advertising features are switched off, and we do not combine this with anything else we know about you. You can withdraw at any time in Cookie settings; see the [cookie policy](https://neuralinverse.com/legal/cookies/). ### When you contact us The contact form asks for your name, work email address, company, role, country, the topic and your message. You may also give us information by email, phone, at events or in meetings. Please do not send us special category information (such as health data) or confidential data from your systems. If you accepted analytics or marketing cookies, we also record which link or campaign brought you to the site, and the page you arrived on, with your enquiry. To count enquiries, our server log notes the kind of request, its topic and region, and that campaign and page, without your name, email address, company or message. ### When you subscribe to our newsletter The [newsletter](https://neuralinverse.com/newsletter/) form asks for your work email address and, if you wish, your name. We then email you a link to confirm. When you confirm, we keep your address, your name if given, and a record of your consent: the wording you agreed to, its version, where on the website you signed up, and when you asked and confirmed. Our email tool also records whether our emails were delivered. If you do not confirm within 7 days, the link expires and you are not subscribed; the website itself stores nothing about unconfirmed sign-ups. ### When you use the website assistant Where the website offers “Ask AI”, the question you type is sent, with passages from our published pages, to the AI model provider listed below, which writes the answer. We do not store your questions or the answers, and our logs record only that a question was answered, not what it said. The assistant refuses questions that contain an email address, a phone number or something that looks like a key or password, so please do not include personal or confidential information. ### When you register for an event The registration form asks for your name, work email address, company and role, and for your agreement that we contact you about that event. ### When we work with you For customers, prospects, partners and suppliers we keep business contact details (name, work email and phone, company, role), our correspondence, meeting notes, contracts, orders and invoices. ### When you report a vulnerability We keep your report, your contact details and our correspondence, and, if you wish, the name you want to be credited under. ### When you apply for a job We keep what you send us (usually your CV, contact details and covering note), our notes from interviews and assessments, and references you agree to us taking. Please do not send special category information unless we ask for it to make adjustments for you. ### When your organisation uses the service we host We keep the account details needed to provide and bill the service: administrator and billing contact names and email addresses, billing address and tax identifiers, and records of the service ordered. Card payments are handled by our payment processor; we do not see or store full card numbers. ## How we use it, and our legal bases Where UK or EU data protection law applies, we must have a legal basis for each use. Where other laws apply (for example India's Digital Personal Data Protection Act 2023), we process personal information for the same purposes on the grounds those laws allow. | Purpose | Information | Legal basis (UK and EU GDPR) | | --- | --- | --- | | Run this website and keep it secure, including detecting abuse | Server logs | Legitimate interests: operating a secure website | | Measure how the website is used (Google Analytics) | Analytics cookie identifiers, IP address, device and browser details, pages visited | Consent, given in the cookie banner or Cookie settings; you can withdraw it at any time | | Answer your enquiry and follow up on it | Contact details, enquiry | Legitimate interests: responding to people who contact us; or steps before a contract at your request | | Provide, manage and bill our products and services | Account, business contact and billing information | Performance of a contract; legal obligation for tax and accounting records | | Send our newsletter: product news, release notes and event invitations | Work email, name if given, record of consent | Consent, given when you tick the box on the newsletter or contact form and, for the newsletter, confirm by email; you can withdraw it at any time with the unsubscribe link in every email | | Answer a question you ask the website assistant | The question you type | Legitimate interests: answering questions about our products when you ask them | | Keep a record that you unsubscribed, so we do not email you again | Work email, date you unsubscribed | Legitimate interests: making sure we respect your choice not to receive marketing | | Run an event you register for: joining details, reminders and changes | Name, work email, company, role | Consent, given when you tick the box on the registration form; you can withdraw it at any time | | Handle vulnerability reports and credit researchers | Report, contact details | Legitimate interests: keeping our products and customers secure | | Consider your job application | Application, interview notes, references | Steps before a contract at your request; legitimate interests: recruiting | | Meet legal obligations and establish or defend legal claims | Any of the above, as needed | Legal obligation; legitimate interests | We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not use your information to train AI models. ## Data in our products When an organisation runs Neural Inverse Build or Neural Inverse Govern on its own infrastructure (self-hosted, in its own cloud account or air-gapped), the personal information in it stays there. We do not receive it. When we host the service for an organisation, we process the personal information in it (such as the names and work email addresses of its people, their activity records and audit logs) only on that organisation's instructions, as its processor, under the agreement and data processing terms we sign with it. Please direct requests about that data to the organisation, and we will help it respond. See [data processing](https://neuralinverse.com/legal/data-processing/) and the list of [sub-processors](https://neuralinverse.com/legal/subprocessors/). ## Who we share it with We never sell personal information or share it for advertising. We share it only with: - companies in the Neural Inverse group, to serve you and run our business; - service providers who process it for us under contract and our instructions, for the purposes in this notice: | Service provider | Purpose | Location | | --- | --- | --- | | [provider: to be confirmed] | Hosting of this website and its server logs | [location: to be confirmed] | | [provider: to be confirmed] | Delivery of contact form enquiries and event registrations to our team, and newsletter confirmation emails (email) | [location: to be confirmed] | | Amazon Web Services, Inc. (Amazon SES) | Newsletter mailing list and sending | [location: to be confirmed] | | Google LLC (Google Analytics) | Website analytics, only for visitors who accept analytics cookies | United States (EU-U.S. Data Privacy Framework) | | Stripe, Inc. | Invoices and card payments for the service we host (billing contacts only; never your content) | United States | | Anthropic, PBC (Claude API) | Writing the website assistant's answers from the question you type (only when you use it) | [location: to be confirmed] | - professional advisers such as lawyers, auditors and insurers, under confidentiality; - authorities, courts or others where the law requires it, or to protect rights, property or safety; - a buyer or successor if all or part of our business is sold or reorganised, under this notice. ## International transfers Our companies and service providers are in the United States, India and the United Kingdom, and some service providers may process data elsewhere. When personal information leaves the UK or the European Economic Area for a country without an adequacy decision, we use the safeguards the law provides, such as the European Commission's standard contractual clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the safeguards that apply. ## How long we keep it - Web server logs: 30 days, longer only when needed to investigate an incident. - Google Analytics data: 14 months, then deleted by Google. - Enquiries that do not lead to a business relationship: 24 months after our last exchange. - Customer, partner and supplier records: for the relationship and then as long as tax, accounting and limitation laws require. - Vulnerability reports: 5 years after the issue is closed. - Job applications that do not lead to a job: 12 months after the role is filled, unless you ask us to delete them sooner. - Newsletter subscriptions and their consent record: until you unsubscribe. We then delete your name and keep only your email address and the date you unsubscribed, as a suppression record, so that you are not emailed again. You can ask us to delete that record too, knowing that we could then no longer make sure you are not added again. - Other marketing consent (the contact form box): until you withdraw it, with the same suppression record. - Event registrations: 12 months after the event, unless you also became a customer or subscriber. ## How we protect it We use access control, encryption in transit and at rest, logging and least privilege to protect personal information, and we require the same of our service providers. If a breach puts your rights at risk, we will tell you and the authorities as the law requires. ## Your rights Depending on where you live, you may have the right to: - know whether we hold personal information about you and get a copy of it; - have it corrected or completed; - have it deleted; - restrict or object to how we use it, including at any time to direct marketing; - receive it in a portable format; - withdraw consent where we rely on it, without affecting earlier processing; - nominate someone to exercise your rights if you die or become incapacitated (India). To exercise a right, email [legal@neuralinverse.com](mailto:legal@neuralinverse.com) or choose “Privacy request” on the [contact form](https://neuralinverse.com/contact/). We may need to confirm your identity. We answer within one month (UK and EU), or the period your local law sets, and we will not treat you less favourably for using your rights. Someone you authorise may make a request for you. ## Regional information ### United Kingdom and European Economic Area UK representative \[UK representative: to be confirmed\] EU representative \[EU representative: to be confirmed\] Data protection officer \[data protection officer, or that none is required: to be confirmed\] ### India Under the Digital Personal Data Protection Act 2023 you may access, correct, complete and erase your personal data, withdraw consent and seek grievance redressal. Contact for grievances: \[grievance contact: to be confirmed\]. If you are not satisfied with our response, you may complain to the Data Protection Board of India. ### United States Residents of California and other states with consumer privacy laws may request access to, correction of and deletion of their personal information, and information about how we use it. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give a right to limit it. We honour Global Privacy Control signals. In the last twelve months we collected the categories described in [what we collect](https://neuralinverse.com/#collect), for the purposes in [how we use it](https://neuralinverse.com/#use), and disclosed them only to the recipients in [who we share it with](https://neuralinverse.com/#share). ## Children This website and our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it. ## Changes to this notice We will update this notice when our practices change and show the date of the latest version at the top. If a change matters to you, we will tell you before it takes effect. ## Contact and complaints Privacy questions and requests: [legal@neuralinverse.com](mailto:legal@neuralinverse.com). Other legal matters: [legal@neuralinverse.com](mailto:legal@neuralinverse.com). You may complain to a data protection authority, for example the Information Commissioner's Office in the UK, the authority in your EU country, or the Data Protection Board of India. We would appreciate the chance to address your concern first.