Privacy Policy

Neonous AI ("we," "us," or "our") operates the neonous-ai.com platform and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI agent builder platform. This policy applies to: • The neonous-ai.com website and web application • Our API services • Any related services, features, or content we offer This policy does not apply to third-party services you connect, including MCP servers, external APIs, or LLM providers you configure.

We collect several categories of information: Identifiers: • Email address, display name, account ID • IP address and device identifiers Account Information: • Password (securely hashed with bcrypt) • OAuth profile data from Google or other providers • Subscription plan and billing information User Content: • Agent configurations and instructions • Custom tools and workflows • Chat sessions and conversations • Artifacts and saved content Usage Data: • Token consumption and API usage • Feature usage and interaction patterns • Login timestamps and session duration Technical Data: • Browser type and version • Operating system • Referral URLs AI Memory (opt-in): • Communication preferences • Learned habits and patterns

We process your personal data based on the following legal grounds: Contract Performance: • To provide the Services you requested • To process payments and manage your subscription • To provide customer support Legitimate Interests: • To improve and optimize our Services • To detect and prevent fraud or abuse • To ensure security of our platform • To send service-related communications Consent: • For optional AI memory features • For marketing communications (if opted in) • For cookies and similar technologies Legal Obligations: • To comply with applicable laws • To respond to legal process • To protect our legal rights

We use the information we collect to: • Provide, maintain, and improve our services • Process transactions and send related information • Track token usage and enforce plan limits • Send technical notices and support messages • Respond to your comments and questions • Detect, investigate, and prevent fraudulent or unauthorized activity • Personalize and improve your experience (with opt-in features) • Analyze usage patterns to improve the platform • Comply with legal obligations

We retain your information for specific periods based on data type: Account Data: • Retained until account deletion plus 30 days • Billing records retained for 7 years for tax compliance Chat Sessions: • Retained until you delete them • Summarized context may be retained for active sessions Usage Logs: • Retained for 2 years for billing and analytics • Aggregated statistics may be retained indefinitely Deleted Data: • Deleted immediately upon request • Permanently purged after 30 days • Backups purged within 90 days You can delete your account from Settings in the app or use our account deletion page if you cannot sign in.

We share information in the following circumstances: With Your Consent: • Community features when you opt-in to share templates • Artifact sharing via public links you create Service Providers: • Cloud hosting providers (data storage) • Payment processors (billing only) • All bound by strict data processing agreements Legal Requirements: • To comply with legal process • To protect our rights and safety • To prevent fraud or security threats Business Transfers: • In connection with merger, acquisition, or sale of assets • With notice to affected users We DO NOT sell your personal information to third parties and have never done so.

We implement industry-standard security measures: • PostgreSQL database with user-scoped data isolation • Password hashing using bcrypt (10 rounds) • API keys hashed with SHA-256 • JWT-based authentication with secure token handling • Redis caching for sessions and rate limiting • HTTPS/TLS encryption for all data in transit • Regular security audits and penetration testing All user data is isolated by user_id to ensure multi-tenant security. While we take reasonable measures to protect your data, no system is completely secure.

When you use our Service, your prompts and queries may be processed by: • Google (Gemini API) - Subject to Google's Privacy Policy • OpenAI (GPT-4 API) - Subject to OpenAI's Privacy Policy • Perplexity (Search API) - Subject to Perplexity's Privacy Policy • User-configured MCP servers - Subject to their respective policies We recommend reviewing the privacy policies of any third-party services you use. MCP servers you configure are your responsibility to evaluate for privacy compliance. We use the following categories of service providers: • Cloud infrastructure (hosting and storage) • Payment processing • Email delivery • Analytics (privacy-respecting, no cross-site tracking)

Neonous AI offers optional integration with Google Workspace services (Gmail, Google Calendar, and Google Drive). This section describes how we handle data from these services. What We Access: • Gmail: Read, send, and manage emails on your behalf when you use email-related agent features • Google Calendar: Read and manage calendar events when you use scheduling-related agent features • Google Drive: Access files already shared with the app and files created by the app when you use file-related agent features. If you select a Google Drive folder in Settings, we use it as a preferred location, but access to existing items and writes inside that folder still depend on Google Drive permissions under the drive.file scope. How We Use Google Workspace Data: • Solely to provide the agent features you explicitly request (e.g., sending an email, creating a calendar event, reading a file) • Data is processed in real-time and passed to the AI model only within the context of your active conversation • We do not store Gmail message content, calendar event details, or Drive file contents in our database beyond the chat session context How We Protect Google Workspace Data: • OAuth tokens are encrypted at rest using AES-256 encryption • All API calls to Google services use HTTPS/TLS • Access tokens are refreshed automatically and securely; refresh tokens are stored encrypted • Data is isolated per user — no other user can access your Google Workspace data AI/ML Model Training Disclosure: • Neonous AI does NOT use your Google Workspace data to train, improve, or develop AI/ML models • Your Google Workspace data is never used for advertising, profiling, or any purpose other than providing the features you request • Third-party AI providers (Google Gemini, OpenAI, etc.) process your prompts under their respective API terms, which prohibit using API inputs for model training Revoking Access: • You can disconnect your Google account at any time from Settings > Connections in the Neonous AI dashboard • You can also revoke access from your Google Account at https://myaccount.google.com/permissions • Upon disconnection, we immediately delete your stored OAuth tokens Neonous AI's use of Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Your information may be transferred to and processed in the United States and other countries where we or our service providers operate. For transfers from the European Economic Area, UK, or Switzerland, we rely on: • Standard Contractual Clauses (SCCs) approved by the European Commission • The EU-U.S. Data Privacy Framework (where applicable) By using our Service, you consent to the transfer of your information as described in this policy.

Neonous AI complies with applicable data protection frameworks: EU-U.S. Data Privacy Framework: • We commit to cooperating with EU data protection authorities • You may invoke binding arbitration for unresolved complaints UK Extension to the EU-U.S. DPF: • Same protections apply for UK residents For complaints, contact [email protected] first. If unresolved, you may contact your local data protection authority.

Depending on your location, you may have the following rights: For All Users: • Access: Request a copy of your personal data • Rectification: Correct inaccurate or incomplete data • Erasure: Request deletion of your personal data • Portability: Export your data in machine-readable format • Opt-out: Disable AI memory and personalization California Residents (CCPA/CPRA): • Right to know what data we collect and how we use it • Right to delete your personal information • Right to opt-out of sale (we don't sell data) • Right to non-discrimination for exercising rights • Right to limit use of sensitive personal information EU/UK Residents (GDPR): • Right to access and rectification • Right to erasure ("right to be forgotten") • Right to restrict processing • Right to data portability • Right to object to processing • Right to withdraw consent To exercise these rights, use the settings in your account dashboard, our account deletion page, or contact [email protected].

We do not sell your personal information and have never done so. Under the California Consumer Privacy Act (CCPA) and similar laws, "sale" includes sharing data for monetary or valuable consideration. Our data sharing practices do not constitute a sale. If you wish to limit sharing of your data even for non-sale purposes, you can: • Disable community sharing features in settings • Request deletion of your account • Contact us at [email protected]

We use minimal cookies and tracking: Essential Cookies: • Authentication tokens (secure HTTP-only) • Session identifiers • Security tokens (CSRF protection) Functional Cookies: • Language preferences • Theme settings • UI state You can control cookies through your browser settings. Disabling essential cookies may affect functionality.

Our Service is not intended for users under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected]. We will take steps to delete such information promptly.

We may update this Privacy Policy from time to time. When we make changes: • We will notify you by email or through the Service • The "Last Updated" date will be revised • Material changes will be highlighted • We will provide at least 30 days notice for material changes Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

We maintain an archive of previous versions of this Privacy Policy. You can request access to prior versions by contacting [email protected].

If you have questions about this Privacy Policy or our data practices: Email: [email protected] Mailing Address: Neonous AI Delaware, United States For EU residents, you may also contact your local data protection authority if you have concerns about our data practices.