Privacy Policy

Who we are

NeuroLeash Ltd is the controller for personal information described in this policy, unless we act as a processor for Customer Data under our Data Processing Addendum.

• Company: NeuroLeash Ltd, registered in England and Wales, company number 16720384.
• Registered office and postal address: 124 City Road, London, EC1V 2NX, United Kingdom.
• Privacy contact: hello@luni.gg.

Individuals in the UK may contact the Information Commissioner’s Office (ICO). See ico.org.uk. EEA individuals may contact their local supervisory authority.

Personal information we collect

Information you provide may include:

• Contact and account data: first and last name, email address, and an optional company name you give at sign-up.
• Sign-in data: your email address and a password (stored only as a salted hash by our authentication service) and, if you choose to sign in with Microsoft, the name and email address Microsoft shares with us.
• Communications: messages you send to support or hello@luni.gg, including contact-form submissions.
• Billing data: once paid plans launch, payment records processed by Stripe. We never receive or store full card numbers.
• Workspace configuration: API keys (stored only as SHA-256 hashes), webhook URLs and signing secrets, Studio definitions, MCP client grants, and similar settings.

Information collected automatically: device and log data (IP address, user agent, timestamps, request paths and error codes) needed to run and secure the Service, the signals Cloudflare Turnstile uses to tell people from bots on our forms, and aggregate page-load statistics from Cloudflare Web Analytics.

Customer Data / retrieved content: when you use extraction APIs, you instruct us to fetch public URLs and return content. That content may incidentally include personal data about third parties. For that processing we typically act as your processor under the DPA when it applies; you are responsible for your lawful basis and instructions.

We do not intentionally collect special-category data, government ID numbers, or children’s data. Do not submit those through the Service.

How we use personal information

• Provide, secure, and operate the Service (contractual necessity / legitimate interests).
• Create and manage accounts, keys, and workspaces (contractual necessity).
• Communicate service notices, security alerts, and support replies (contractual necessity / legitimate interests).
• Measure usage, improve reliability, and plan capacity (legitimate interests; consent where required for non-essential cookies).
• Send product updates or marketing only where permitted; you may opt out of marketing emails (legitimate interests or consent as required).
• Comply with law, prevent abuse, and enforce our Terms (legal obligation / legitimate interests).
• Process payments and credits when billing is enabled (contractual necessity).

We do not sell personal information for money. We do not use Customer Data to train generalised public AI models.

How we share personal information

We may share personal information with:

• The service providers listed below, which process data on our behalf under written contracts.
• Professional advisers and authorities when required by law or to protect rights and security.
• A buyer or successor in a genuine corporate transaction, under appropriate safeguards.
• Third parties you direct us to (for example a webhook endpoint you configure).

If you sign in with Microsoft, Microsoft processes that sign-in under its own privacy statement. We do not use advertising networks.

Cookies and tracking

See our Cookie Notice for the cookies we use. Essential cookies keep the websites secure and remember your preferences. If you accept analytics cookies, Google Analytics measures how the websites are used; if you reject them, it never loads. We do not use advertising cookies. We also count page views with Cloudflare Web Analytics, which sets no cookies and does not track you across sites.

Retention

We retain account and billing records for as long as your workspace remains active and thereafter as needed for legal, accounting, dispute, and security purposes. Saved extraction results are deleted after seven days. Encrypted database backups are kept for up to 12 months and then deleted, so deleted data can remain in a backup until that backup expires. You can ask us to delete your account at any time.

International transfers

NeuroLeash Ltd is organised in the United Kingdom. Service providers may process data in the UK, EEA, United States, or other countries. Where we transfer personal data from the UK/EEA to a country without an adequacy decision, we use appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and/or EU Standard Contractual Clauses, unless another lawful mechanism applies.

Our application servers, database and backups are in London. Cloudflare serves traffic from its global network, and Google, Resend and Stripe process data in the United States. For those transfers we rely on the UK–US data bridge where the provider is certified, or on standard contractual clauses with the UK Addendum.

Security

We use technical and organisational measures designed to protect personal information (access controls, encryption in transit, key scoping, and similar). No method of transmission or storage is perfectly secure. Practical guidance for customers is on the Luni security page.

Your rights (UK / EEA)

Subject to UK GDPR / EU GDPR, you may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is consent-based. You may also complain to the ICO or your local supervisory authority.

To exercise rights, email hello@luni.gg. We may need to verify your identity. Some rights are limited where we act only as a processor—contact the relevant customer/controller first for Customer Data.

U.S. state privacy notices

If U.S. state privacy laws apply to you, you may have rights to know, access, correct, delete, and opt out of certain sales, sharing, or targeted advertising. We do not sell personal information for money and do not presently use the Service for cross-context behavioural advertising. Requests: hello@luni.gg.

Children

The Service is not directed to anyone under 18. If you believe we collected a child’s personal information, contact us and we will take appropriate steps.

Changes

We may update this Privacy Policy by posting a revised version with a new “Last updated” date. Material changes may also be notified by email or in-product notice where appropriate.