01
Status and controller details
This notice is a working draft and is not yet effective. The legal identity and contact details of the data controller must be confirmed by the service owner and legal counsel before publication.
02
Information covered by this draft
Depending on how Neuphlo is used, relevant categories may include account and profile details; workspace and Team membership; Rooms, messages, attachments, Work, Pages, and resources; invitations and notifications; device, model, provider, agent, consent, connection, and AI-reply metadata; billing plan, accepted human count, invoices, subscription state, and payment handoff records; support communications; and technical security or reliability records.
Stripe handles hosted checkout and payment management. Payment details are not part of ordinary shared workspace replication. The exact processor arrangement and the data received from Stripe require confirmation before this notice becomes effective.
03
Why information may be used
Information may be needed to authenticate people, create and operate accounts and workspaces, apply access rules, synchronise shared content, deliver explicitly requested agent replies, connect devices and providers, administer subscriptions, prevent abuse, diagnose reliability issues, respond to support, and meet legal obligations.
04
Legal bases
Possible legal bases include performing a contract, complying with legal obligations, pursuing legitimate interests in operating and protecting the service, and consent where the law requires it. The controller must confirm the basis for each actual purpose before this notice becomes effective. Consent can be withdrawn where processing relies on consent, without affecting earlier lawful processing.
06
Connected AI and devices
Neuphlo Connect can pair a Mac and expose configured Codex, Claude Code, or selected local model runtimes. A person or authorised workspace may separately configure model consent, sharing, and agent bindings.
Selected context may leave the device when an authorised cloud runtime is used. A local-only configuration is intended to remain local-only. The product records the provider and runtime used where the current service contract requires that provenance.
07
International transfers
Whether personal data is transferred outside the country or region where a person is located depends on the confirmed service infrastructure, processors, and connected providers. Transfer locations and safeguards have not been verified for publication and must be completed before this notice becomes effective.
08
Retention and deletion
Neuphlo needs documented retention rules for account data, workspace content, files, device and connection records, billing records, security records, operation recovery, and support communications. No retention schedule or deletion promise is stated in this draft because those details require operational and legal confirmation before effectiveness.
09
Your data-protection rights
Subject to the GDPR and other applicable law, you may have rights to be informed, access personal data, correct inaccurate data, request erasure, restrict processing, receive portable data, object to certain processing, withdraw consent where consent is used, and complain to a competent supervisory authority.
Requests can be sent to help@neuphlo.com. Identity may need to be verified, and legal exceptions may apply. The final controller contact and request process require approval before publication.
10
Changes to this notice
A published notice should explain when material changes take effect and how people are informed. This draft has no effective date and should not be treated as the operative notice.