NeuropackLens
Privacy Policy
This policy explains what personal data NeuropackLens collects, why, who it is shared with, how long it is kept, and the rights you can exercise over it. It names every sub-processor that receives your data, because a provider you cannot identify is not one you can object to.
Last updated: August 13, 2026
1. At a glance
- We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
- We do not train AI models on your uploads or reports, and our AI providers process them under agreements that prohibit training on our API content.
- You decide how long your work is kept. Analyses stay available for as long as your account is active; you can delete any single one — images included — or your whole account, at any time.
- Files are never served from public URLs — access is through signed links that expire after 24 hours, and every link issued is logged.
- You can delete your account, and everything attached to it, yourself at any time.
This summary is for orientation only; the sections below govern.
2. Who we are
The controller responsible for your personal data is Nitid Studio, LLC, Texas SOS filing number 805012266, operator of NeuropackLens, registered at 5900 Balcones Drive, STE 100, Austin, TX 78731, United States. You can reach us about any privacy matter at legal@neuropacklens.com.
3. Scope
This policy applies to our website, web application and related services (the "Platform"), and to visitors, registered users, members of Team and Enterprise groups, and people who contact us. It does not apply to third-party sites we link to, or to how your own organisation handles data it obtains from the Platform.
4. Data we collect
| Category | Examples |
|---|---|
| Account data | Name, email address, hashed authentication credentials, plan and role, account status, language preference. |
| Content you submit | Packaging and creative images, PDFs and documents, product category and brief, prompts, follow-up questions and free-text notes. This may incidentally include personal data if you include it — please do not upload more than the evaluation needs. |
| Generated output | Analysis reports, strengths, weaknesses, recommendations, confidence scores, citations, concept sketches and exports. |
| Assistant conversations | Messages you exchange with the in-app assistant, the tools it used, whether a guardrail or escalation was triggered, and token counts. |
| Usage & device data | Log events, IP address, browser and device type, approximate location inferred from IP, pages viewed, in-product click events, timestamps, error diagnostics and performance timings. |
| Billing data | Plan and subscription status, billing period, purchase and credit history, invoice and transaction identifiers, refund and dispute records. Card details go directly to our payment processor — we never receive or store full card numbers. |
| Security & audit data | Sign-in events, signed-link access logs, rate-limit and anti-abuse signals, reCAPTCHA risk scores. |
| Support & sales data | Messages sent through our contact and enterprise-enquiry forms, feedback you submit, and related correspondence. |
5. Where it comes from
- From you — registration, uploads, purchases, forms, support messages.
- Automatically — logs, cookies and local storage, device signals, product telemetry as you use the Platform.
- From third parties — our payment processor (payment status, subscription events, refunds and disputes), our email provider (delivery and bounce events), and, for Enterprise members, the administrator of the organisation that created or assigned the account.
6. Purposes & legal bases
Where the GDPR or UK GDPR applies, we rely on the legal bases set out below. Where other laws apply, we process on the equivalent grounds those laws provide.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Platform: run analyses, generate reports and sketches, answer follow-ups, store your history | Account, content, output | Performance of a contract |
| Authenticate you, enforce plan limits, and keep accounts separate | Account, usage, security | Performance of a contract |
| Process payments, credits, renewals, refunds and disputes | Account, billing | Performance of a contract; legal obligation (tax and accounting records) |
| Transactional email: receipts, renewal and failure notices, security alerts | Account, billing, security | Performance of a contract; legitimate interests (account security) |
| Prevent fraud, abuse and automated attacks; enforce our Terms | Usage, security, reCAPTCHA signals | Legitimate interests (protecting the service and its users) |
| Diagnose errors, monitor reliability, and improve product performance and quality | Usage, error diagnostics, aggregated assistant metrics | Legitimate interests (operating and improving a reliable service) |
| Respond to enquiries, support requests and enterprise sales contact | Support and sales data | Legitimate interests; steps prior to entering a contract |
| Comply with legal obligations and respond to lawful requests; establish or defend legal claims | As required | Legal obligation; legitimate interests |
| Optional marketing communications, where offered | Account contact details | Consent (withdrawable at any time) |
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You may object at any time (see section 15).
7. AI processing & model training
Delivering an analysis requires sending your uploaded file and the associated prompt to third-party AI providers. Concretely: images and documents are sent to OpenAI for vision analysis, report generation, embeddings and follow-up chat, and to Google for optical character recognition and concept-sketch image generation. Each is listed in section 11.
- We do not train models on your content. Your uploads, reports and assistant conversations are not used to train, fine-tune or evaluate any model of ours.
- Our providers process on our instructions. We use their business/API offerings, under terms which provide that content submitted through the API is not used to train their models.
- Providers may retain content briefly for abuse monitoring in line with their own policies, and then delete it. We do not control those internal periods.
- Human review is limited. Our personnel access your content only where necessary to operate or support the Platform, investigate abuse or a security incident, or comply with law — and such access is restricted to authorised staff.
- Concept-sketch rendering may be carried out on dedicated processing nodes we operate or control, which receive the image for the sole purpose of producing the sketch, under authenticated access and the same confidentiality obligations.
- We may use aggregated and de-identified statistics (for example, average processing time, guardrail-hit rates, feature usage) to improve the Platform. These cannot reasonably be used to identify you and we do not attempt to re-identify them.
8. In-app assistant
The in-app assistant is available to signed-in users. Conversations are stored against your account so we can maintain context, measure quality (how often it is corrected, how often it hands off to a person), and investigate misuse. Where you ask for something a human must handle — a refund, a repeated failure, a billing dispute — the assistant escalates by sending the relevant details to our support inbox. The assistant does not have access to your payment card details and applies guardrails against attempts to extract system instructions or corpus content.
10. Analytics
Product analytics are first-party: interaction events (such as which control was used, on which page, at what time, and the signed-in user or anonymous session it belongs to) are recorded in our own database to understand how the Platform is used and where it fails. We do not send this data to advertising networks, data brokers or third-party tracking services.
12. International transfers
The providers above operate primarily in the United States, so your data may be transferred outside your country, including outside the EEA, the UK, Switzerland and Latin America. Where such a transfer is subject to transfer rules, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) incorporated into our agreements with those providers, together with technical measures such as encryption in transit and at rest. You may request a copy of the relevant safeguards at legal@neuropacklens.com.
13. Retention & deletion
We keep personal data only as long as it is needed for the purpose it was collected for. For your evaluations that purpose includes giving you access to your own history, which is part of what a paid plan provides — so we keep them until you tell us otherwise, rather than deleting them on a fixed clock.
| Data | Retention period |
|---|---|
| Analyses, uploaded assets and generated sketches | Kept for as long as your account is active, so your evaluation history remains available. Deleted as soon as you delete them, and on account deletion. |
| Signed access links to stored files | Expire 24 hours after issue |
| Account data | While the account is open; deleted on account deletion |
| Assistant conversations | While the account is open; deleted on account deletion |
| Asset access and security logs | Kept for security auditing and incident investigation; the link to your account is severed when your account is deleted |
| Product analytics events | Kept for product analysis; the link to your account is severed on account deletion, leaving no identifier attached |
| Billing, invoice and tax records | As required by tax, accounting and anti-fraud law (typically 5–10 years), even after account deletion |
| Support correspondence | Up to 24 months after the matter is closed, or longer where needed for a legal claim |
| Backups | Encrypted backups may retain deleted data for a short rolling window before being overwritten |
Deleting things yourself
You can delete any individual analysis from the product at any time, which removes its stored images along with it. You can delete your entire account from account settings: this cancels any active subscription, then removes your profile, analyses, uploads and assistant history, except for records we are legally required to retain.
Inactive accounts
We may delete stored content from accounts that have been inactive for more than 24 months, after notifying you at the email address on file, so that data is not held indefinitely for people who have stopped using the Platform. The Platform is not a backup service — export anything you cannot afford to lose.
14. Security
- Encryption in transit (TLS) and encryption at rest for stored data and files.
- Per-user isolation enforced at the database level by row-level security, so one account's data is not reachable from another.
- No public file URLs. Assets are served through short-lived signed links that expire after 24 hours, and every link issued is recorded in an access log.
- Role-based access controls, administrative audit logging, server-side validation of every upload, rate limiting and bot protection on public endpoints.
- Segregated environments and secrets management, with production credentials never exposed to the browser.
- A security alert to your email whenever your password is changed.
No system is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password and tell us immediately at legal@neuropacklens.com if you suspect a problem.
15. Your privacy rights
Depending on where you live, you may have the following rights over your personal data:
- Access — obtain confirmation of processing and a copy of your data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — have your data deleted where no overriding ground to keep it applies.
- Restriction — limit processing in certain circumstances.
- Portability — receive data you provided in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where processing is based on consent, without affecting prior lawful processing.
- Complain — lodge a complaint with your supervisory or data protection authority.
How to exercise them
Many of these are available directly in the product: you can view and update your profile, export reports, delete individual analyses, and delete your entire account from account settings. For anything else, write to legal@neuropacklens.com from the address on your account. We respond within 30 days, and will tell you if we need an extension permitted by law. We may ask for information to verify your identity, and we will not discriminate against you for exercising a right.
16. US state privacy rights
If you are a resident of California or another US state with a comprehensive privacy law, you have rights to know, access, correct, delete and obtain a portable copy of your personal information, to opt out of sale or sharing for cross-context behavioural advertising (we do neither), and to be free from discrimination for exercising them. You may use an authorised agent, with proof of authorisation. Requests go to legal@neuropacklens.com.
In the last 12 months we have collected the categories listed in section 4 for the purposes in section 6, and disclosed them for business purposes to the sub-processors in section 11. We do not knowingly collect or process sensitive personal information for the purpose of inferring characteristics.
17. No sale of personal data
We do not sell personal data, we have never sold personal data, and we do not share it for cross-context behavioural advertising. We do not disclose your uploads or reports to any party except the sub-processors needed to produce them, and we do not use them for advertising.
18. Automated decision-making
The Platform generates automated evaluations of the creative you submit. These are advisory and are not decisions producing legal or similarly significant effects on you. Automated logic is also used for anti-abuse purposes (rate limiting and bot scoring), which can restrict access to a form or endpoint; if you believe you were wrongly blocked, contact us and a person will review it.
19. Team & Enterprise accounts
If your account belongs to an organisation's group, that organisation's administrator can manage membership and view group usage and the consumption attributed to each member, and analyses are metered against a shared pool. Where an organisation provisions accounts for its staff, it acts as controller (or joint controller) for that use, and its own internal privacy notice applies alongside this one. Use a personal account for personal material.
20. Children
The Platform is intended for business use by adults and is not directed to children under 16 (or the higher age set by local law). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact legal@neuropacklens.com and we will delete it.
21. Breach notification
We maintain an incident response process. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where the risk is high, notify affected users directly at the email address on file, describing what happened, what data was involved and what to do.
22. Third-party links
Reports and citations link to external publisher and DOI pages, and the Platform may link to other third-party sites. Those sites have their own privacy practices, which we do not control and are not responsible for.
23. Changes to this policy
We may update this policy. The current version is always posted here with the "Last updated" date. For material changes — a new purpose, a new category of recipient, or a change in retention — we will give reasonable advance notice by email or in-product notice before the change takes effect and, where required, obtain your consent.
24. Contact & complaints
Nitid Studio, LLC, Texas SOS filing number 805012266 — 5900 Balcones Drive, STE 100, Austin, TX 78731, United States
Privacy requests and questions: legal@neuropacklens.com. If you are in the EEA, the UK or Switzerland and are not satisfied with our response, you may lodge a complaint with your local data protection authority. See also our Terms of Service.