Privacy Policy · Neura Name

1. Who is responsible

The controller for the processing described here is Neura Space GmbH, [registered address], Germany (commercial register: [register court], [HRB number]; managing directors: [managing director(s)]).

For anything about your personal data, write to privacy@neura.space. We answer within one month, as the GDPR requires.

This policy covers neura.new (requesting a Neura Name), neura.name (your Neura Name: sign-in, profile, security, wallet) and the Neura Name sign-in pages. Neura Space, Neura Zone and Neura Build use your Neura Name to sign you in; what they do with the content you create there is described on each platform.

2. What we process

Your request: The Neura Name you choose, your full name, your e-mail address (confirmed with a one-time code) and the platforms you would like to use.
Photo and card portrait (optional): A photo you upload, reduced in your browser to a small 512-pixel JPEG. If you choose to, a monochrome card portrait is prepared from it by an AI model. On approval the photo becomes your profile picture and the portrait your card artwork. We do not use photos for facial recognition or any other biometric identification.
Phone number (optional): A mobile number, either confirmed with a code sent by SMS or stored as unconfirmed. On approval it is added to your profile, where you can change or remove it.
Account and security: Your Neura Name, e-mail addresses, display name, sign-in methods (a password is stored only as a salted hash; for passkeys we store only the public key), active sessions and devices (IP address, browser, operating system), sign-in and security events, and the access you have on each Neura platform.
Wallet and payments: Your NESP balance and transactions. Card payments are handled by Stripe in its own payment form; we receive the amount and the payment status, never your card details.
AI features: When you use AI features on a Neura platform, your prompts, files and the answers pass through the Neura AI gateway to the AI model provider, and the usage is recorded to charge NESP.
Technical data: IP address and time of each request, used for rate limits and abuse protection, and server logs in which e-mail addresses and phone numbers are masked.

3. Why we process it (legal bases)

To review your request, create and run your Neura Name, sign you in to every Neura platform and provide the wallet - performance of a contract, Art. 6(1)(b) GDPR.
Your optional photo, card portrait and phone number - your consent, Art. 6(1)(a) GDPR. You can remove them on neura.name at any time; this does not affect processing before the removal.
Security: e-mail and SMS codes, rate limits, abuse and fraud prevention, sign-in alerts and the audit log - our legitimate interest in keeping accounts and platforms safe, Art. 6(1)(f) GDPR.
Keeping invoices and payment records - legal obligations under German commercial and tax law, Art. 6(1)(c) GDPR.

We do not sell personal data, do not show advertising and do not use your data or content to train AI models.

4. Service providers (processors)

We use the following providers. Each processes personal data only on our instructions under a data processing agreement (Art. 28 GDPR).

DigitalOcean, LLC (USA): Cloud hosting: servers, managed databases, storage and backups for every Neura service.
Stripe Payments Europe, Ltd. (Ireland): Card payments for NESP top-ups. Stripe is also an independent controller for its own legal duties (for example anti-money-laundering checks).
Twilio Inc. (USA): Sends the SMS code that confirms your phone number.
Resend (Plus Five Five, Inc., USA): Sends our e-mails: codes, links and alerts.
OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.): AI models reached through the Neura AI gateway: the optional card portrait on neura.new and AI features on Neura platforms. Under OpenAI's API terms, data sent through the API is not used to train its models.

Where a provider processes data outside the EU/EEA, the transfer is covered by an adequacy decision (for example the EU-U.S. Data Privacy Framework, where the provider is certified) or by the EU Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of these safeguards.

5. How long we keep it

E-mail and SMS codes: valid for 10 minutes, deleted one day after they expire.
Rate-limit counters that contain an IP address: deleted after two days.
Activation links: valid for 7 days, the record of them is deleted 90 days after they expire.
The photo, card portrait and phone number neura.new keeps with your request: deleted 60 days after they were handed over to your Neura Name, or 12 months after the request if it is never approved.
Your Neura Name, profile and security settings: for as long as you have your Neura Name. When it is deleted, neura.name removes your profile, photo, card artwork and phone number.
When you delete your account: your Neura Name is deleted 14 days after you ask (until then the link in our e-mail keeps it); your Space, Neva AI memories, files and Zone history are deleted 30 days after you ask; AI usage records are kept without your name; wallet transactions and receipts are kept as stated below.
A data export you ask for: kept 24 hours, then deleted.
Backups: deleted data stays in our backups until they expire on their own schedule, normally 7 to 30 days and at most 8 weeks for the Neura Zone server. Backups are only used to recover from a failure; if we ever restore one, we repeat every deletion made since that backup before the service is used again.
Security events and the audit log: up to 12 months, longer only while we investigate a specific incident.
Invoices and payment records: up to 10 years, as German commercial and tax law requires (§ 257 HGB, § 147 AO).

6. Cookies and storage in your browser

We use only cookies that are strictly necessary to provide what you asked for: your sign-in session on neura.name and, on neura.new, short-lived cookies that remember a confirmed e-mail address or phone number and your request (up to 60 days). They are HttpOnly and never used for tracking. neura.new keeps an unfinished request in your browser tab (session storage) so a reload does not lose it.

We use no analytics, advertising or third-party tracking cookies, so no consent banner is needed. Stripe sets its own cookies only inside its payment form, for fraud prevention.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to withdraw a consent at any time with effect for the future (Art. 7(3)).

Where we rely on our legitimate interests, you may object to the processing on grounds relating to your particular situation (Art. 21).

To use any of these rights, write to privacy@neura.space from an address of your Neura Name. Much of it you can do yourself on neura.name: change your name, photo and phone number, add or remove e-mail addresses, and end sessions.

On neura.name/security you can download a copy of your data (one zip file with your profile, sign-in history, wallet and receipts, usage, Neva AI memories, Neura Build and Neura Zone data) and delete your account yourself.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where we have our registered office.

8. What is required

A Neura Name needs a name, your full name and a confirmed e-mail address; without them we cannot create it. Your photo, card portrait and phone number are optional. We do not make decisions about you based solely on automated processing; every request for a Neura Name is approved or declined by a person.

9. Changes

We update this policy when our services or the law change. The date at the top shows the latest version; for important changes we tell you by e-mail or on neura.name beforehand.