Privacy Policy

Scope

NeuraLIA Labs is committed to respecting the privacy of those who visit and use its website, hosted at the URL https://neuralialabs.com (the "Website").

This Privacy Policy aims to inform users about the processing of personal data collected through the Website and its associated services.

The use of https://neuralialabs.com or any of its associated services (such as sales funnels) implies acceptance by the user of the provisions contained in this Privacy Policy and that their personal data will be processed as established herein and in accordance with the uses and powers provided by the regulations.

Controller – Who is responsible for data processing?

We inform you that the personal data provided through forms or other use derived from browsing NEURALIALABS.COM, as well as your email address, have been included in a data processing owned by NeuraLIA Labs S.L., with CIF B26681452, email support@neuralialabs.com, and registered address at AVINGUDA MIQUEL BATLLORI, 81, Piso 0, 25001, LLEIDA, ESPAÑA.

The person in charge of managing and operating the website is NeuraLIA Labs S.L., with CIF no. B26681452 and contact email support@neuralialabs.com.

When you use NeuraLIA Labs inside an organization, such as your company's, the data processed in that organization's space — what its members do in it, its audit log and the data of its customers that comes in through its support channels — is processed by us on the organization's behalf, and the organization decides what it is used for. For that data, the organization is the controller and we are its processor, under clause 15 of the Terms and Conditions. Requests about that data, for example to access or erase it, are for the organization to handle; if they reach us, we will pass them on to it. For your account (your registration, your profile, your payments and your personal space), we remain the controller.

We have not appointed a data protection officer. For any question about your personal data, write to us at support@neuralialabs.com.

Purposes

Please note that data may be processed for the purpose of providing you, by electronic means, commercial information and updates from the website and our products or services, provided that you authorize their processing.

We do not have a loyalty plan. To offer you discounts and send you notices we do two things: some discount campaigns are only for recently created accounts or for accounts that have never paid, and to know whether one applies to you we look at your account's creation date and whether you have ever paid; and we may send a notice to everyone on the same plan, respecting your notification preferences. On the website we also use analytics and advertising tools to measure how it is used and which campaigns work; where the law requires your prior consent, only if you accept them in the cookie notice. They are explained in "Providers That Process Data" and in the Cookie Policy.

If the user contacts https://neuralialabs.com through the website, their personal data will be used to respond to requests for information and other inquiries they may have made.

You can oppose this type of communication at any time by sending an email to support@neuralialabs.com stating in the subject "Unsubscribe from the distribution list" or by clicking on the unsubscribe link found in the communications.

About the privacy policy

NeuraLIA Labs is especially sensitive to the protection of the data of users and customers accessed through https://neuralialabs.com.

All this with the aim of being a transparent website and service with its community and facilitating that people accessing the website decide, freely and voluntarily, what information they wish to provide at all times.

Confidentiality and Security

Users leave their data with NeuraLIA Labs. Payments are not always made through us: purchases on the website are charged through Stripe, and purchases made inside the mobile apps are charged by Apple (App Store) or Google (Google Play), which handle the payment data under their own policies. NeuraLIA Labs never receives or stores your card number in any of the three cases. This personal data will be treated with total confidentiality. In addition, it is informed that https://neuralialabs.com will transfer the data to the person responsible for the organized event, in addition to any others that may be linked to the event, but not to unrelated third parties without justification.

https://neuralialabs.com informs that it has adopted the necessary technical and organizational measures to guarantee the security and confidentiality and to prevent alteration, loss, treatment or unauthorized access to the data.

All this taking into account the state of technological evolution, the nature of the data stored, and the risks to which they are exposed, whether they come from human action, automated action or robot, or from the physical or natural environment.

However, there is no completely secure system, so https://neuralialabs.com cannot guarantee that the data can be fully protected at all times and under any circumstances beyond NeuraLIA Labs.

Where We Store Data

We store the service's data on Google Cloud. Its main database and its file storage are in the United States, in multi-region locations in that country, and sign-in runs from data centers in the United States. Google Cloud processes the data on our behalf, as a processor, under the data processing terms it offers its customers.

As a result, your personal data is transferred to the United States, outside the European Economic Area. The transfer relies on Google LLC's certification under the EU-U.S. Data Privacy Framework, which Google Cloud's terms apply to these transfers, and, should that framework stop applying, on the standard contractual clauses approved by the European Commission, which the same terms provide for. The same goes for the data in an organization's space, which we process on its behalf.

Providers That Process Data

To provide the service, these providers process personal data on our behalf, as processors (for the data in an organization's space, as its sub-processors). They may only process it to provide their service to us and following our instructions.

Google Cloud and Firebase (Google): hosting the service (its functions, the database, the files and the knowledge database), sign-in, push notifications and, in the apps, crash reports, their analytics and app verification. Where, and with what safeguards, is in "Where We Store Data".
Google Cloud's Vertex AI: artificial intelligence models by Google (Gemini, Imagen, Veo and Lyria) and by other makers (Claude, Llama, Mistral, Qwen, Grok and DeepSeek), reading the text in images and transcribing some meetings. With the same safeguards as Google Cloud.
The Gemini API (Google): real-time voice conversation with the Gemini models. With the same safeguards as Google Cloud.
OpenAI: text, image, voice and transcription models (the GPT ones), content moderation and search in the knowledge base. It may process the data outside the European Economic Area, including in the United States, with the standard contractual clauses approved by the European Commission or with an adequacy decision.
xAI: Grok text and vision models, and the transcription of Work meetings. In the United States, with the standard contractual clauses.
Luma AI: video generation. In the United States, with the standard contractual clauses.
Replicate: image, video and audio models by several makers, voice cloning and training image styles with your photos. In the United States.
Cerebras: the chat's text models. In the United States.
Serper and SerpApi: the web searches the chat makes from what you write. SerpApi, in the United States.
Twilio and Twilio SendGrid: phone calls, some WhatsApp messages and sending emails. In the United States, with Twilio Inc.'s certification under the EU-U.S. Data Privacy Framework and, failing that, the standard contractual clauses.
Meta (WhatsApp): WhatsApp messages and calls, both LIA's and those of the channels organizations connect. Meta Platforms Ireland processes them, in the European Union, and takes them to Meta Platforms, Inc. with its own safeguards.
Stripe: card payments on the website. Stripe Payments Europe, in Ireland, processes them and takes them to Stripe, LLC, in the United States, with its certification under the Data Privacy Framework and, failing that, the standard contractual clauses.
Vercel: hosting the website. In the United States, with its certification under the Data Privacy Framework and the standard contractual clauses.
Cloudflare: the check that you are not a robot when you sign up and when you write to us from the sales form (Turnstile), which receives your IP address. In the United States, with its certification under the Data Privacy Framework and the standard contractual clauses.
Google Analytics and Google Tag Manager (Google): analytics for the website. With the same safeguards as Google Cloud.
CookieYes: the cookie notice and the record of what you choose in it. In the United Kingdom, which has an adequacy decision from the European Commission.

Others process data under their own terms, as controllers, and not on our behalf:

Apple (App Store) and Google (Google Play), for purchases inside the apps.
Meta, for Instagram and Messenger messages, and with its pixel on the website, which we use to measure our campaigns.
Telegram, if you talk to LIA or to an organization's bot on Telegram, and Amazon, if you use LIA with Alexa.
Google, Apple, GitHub or Microsoft, if you sign in with them.
The services you or your organization connect (for example, Gmail, Google Drive, Slack, Notion, Shopify or Zendesk): we send them what they need to work, and they are governed by their own terms.

The website's analytics and advertising tools (Google Analytics, Google Tag Manager and the Meta pixel) only load if you accept them in the cookie notice when you visit the website from a country where the law requires your prior consent, such as those of the European Union or the United Kingdom; from other countries, they load when you enter the website.

Before adding or replacing a provider in the first list, we will tell organizations as the Terms and Conditions say (clause 15).

Organizations and Company Spaces

You can create an organization or join one by invitation, such as your company's. Each organization has its own space, separate from your personal space. This section explains which of your data can be seen in an organization and which stays in it.

Who owns what you create in an organization? The organization. What you create in its space — agents, chatbots, channels, scheduled tasks, knowledge, accounts connected for the organization, and Work projects, tasks, comments and files — stays in it even if you leave or delete your account. Your chats in an organization's space are the exception: they are yours and private, and only the people you add can see them, who must be members of the organization.

Who manages it? Its owner and its administrators. They invite and remove members, change roles, decide which resources are shared and with which teams, can turn off Work's AI helps and choose their model, and see the organization's audit log.

What can other people in the organization see about you? Your name, your photo, your role (owner, administrator or member), your teams and the job title written by you or an administrator. Only the owner and the administrators can see your email. In Work, whoever can see a project sees what you do in it: the tasks assigned to you, your comments, the files you upload and the history of changes to its tasks.

What do the organization's administrators see of your use of artificial intelligence? If the organization has the Business plan, its owner and administrators see how many credits each person spends in the organization's space, by day, by use (for example, chat, agents or Work), by model and by team; they can download it as a CSV file and set each person a monthly limit of extra credits. They never see the content: neither what you write nor what the artificial intelligence answers. Without the plan, they only see how much the organization has spent in the month, with no breakdown by person. You see your own use in the organization (and, with the plan, what is left of your seat), never anyone else's. If you have no seat, run out of credits or reach your limit, you can let the organization's administrators know, and they receive your name with the notice. They do not see what you do in your personal space. The organization, which is the controller of this data, processes it for its legitimate interest in controlling what it pays for (Article 6(1)(f) GDPR), and we process it on its behalf, as its processor.

What the organization's automations do. The organization's agents, scheduled tasks and other automations can work in Work on its behalf: for example, create tasks, comment on them or add files to them. What they do appears signed by LIA, on behalf of the person responsible for that automation.

The organization's notices. If you are removed from an organization, lose access to something of it that you used, or become responsible for something, we let you know in the app, and we may also send you an email, in your language. If you administer an organization, we also let you know when someone leaves it or when a change leaves someone without access to something. You can turn off each type of notice in your preferences.

If you leave an organization. What you created stays in it. What you were responsible for (an agent, a chatbot, a channel…) passes to another person in the organization: the one chosen by whoever administers it or, if they choose no one, its owner. Your name keeps appearing on what you did, marked "no longer in the organization". Your private chats in the organization stay closed: no one can open them, and they come back to you if you return.

Archived organizations. The owner of an organization can archive it. Its members then stop seeing it, its automations stop and nothing in it can be changed; only its owner can still look at it. It is kept for as long as its owner's account exists — the owner can restore it at any time — and when the owner deletes their account, it is kept for 30 more days, with no one able to open it, and then deleted.

Exporting an organization. Its owner can export the organization's data in machine-readable files: among them, each member's name, email, role and teams, the audit log with its IP addresses, what was written in its Work and in its company conversations, and its knowledge. It never includes what is private to each member (their chats and templates, their unshared views, their inbox or their drafts), or passwords or credentials. Each export is kept for 7 days and is recorded in the audit log; the Terms explain it (clause 18).

If you delete your account. In addition to the above, your private chats in organizations are deleted, and what you did in Work and in the audit log stops carrying your name: where you appeared, it says "A deleted account". If you are the owner of an organization with other active members, you first have to transfer its ownership to someone else. If you are the owner of an organization in which there is no one else active, or of an archived organization, after you confirm it that organization is kept archived for 30 days, so that you can take its data with the link we give you, and it is then deleted with everything in it. Deleting Your Account has all the detail.

An Organization's Audit Log

Each organization has an audit log: a list of the changes made in it, with who made them and when, so that whoever administers it can review them.

What is recorded? Changes to how the organization is managed: who joins and who leaves, changes of role and job title, invitations, the organization's name, ownership, archiving, restoring and scheduled deletion, the exports of its data, teams, the resources that are shared and who can use them, changes of who is responsible for what, and Work settings (including turning the AI helps off or changing their model). Also who uploads, opens or downloads, and removes files in Work: opening a file to view it counts the same as downloading it, and the times a person opens the same file within five minutes are recorded once. What you write in chats and the content of tasks or files are not recorded.

What does each entry keep? Who made the change, what changed (for example, the previous role and the new one), what it was about (with the name it had at the time), when and, if a person made it, the IP address they made it from. For invitations, the invited person's email. For files, their name, type and size, and the task they belong to.

Who can see it? Only the organization's owner and administrators; if the organization is archived, only its owner. They can filter it by person, type of change and dates, and download up to 10,000 entries as a CSV file, with the IP address of each. Other members cannot see it.

What is it used for? So that the organization knows who changed what and when, can investigate improper access or an improper change, and can account for how it has been managed.

How long is it kept? Each entry is deleted automatically once a year has passed since the change. If the organization is deleted, its log is deleted with it.

And if you delete your account? The entries you appear in stay, because they are the organization's history, but they stop naming you: in your place it says "A deleted account", and the name or email and the IP address they kept about you are deleted.

On what legal basis? The organization, which is the controller of this log, processes it on the basis of its legitimate interest in knowing who changes its settings and its data and in protecting its account (Article 6(1)(f) GDPR). We process it on its behalf, as its processor.

Work

Work is the organizations' projects and tasks tool. It only exists in an organization's space, and what is done in it belongs to the organization.

What does it keep? Projects, tasks and their details, comments and updates, the links and files that are added, and the history of changes to each task: who changed what and when, with what was there before and what is there after. Whoever can see the project can see it. To send you Work's notices at your local time (for example, the reminder of a due date, the day before at 9:00), we keep your device's time zone.

Notices. Work notifies you in the app, in the bell and with push notifications, about what affects you: for example, tasks assigned to you, mentions, due dates and stalled tasks. On Mondays at 9:00 your time, if there is anything to report, it sends you a summary of your week, and on Fridays, if you lead a project, the reminder of its weekly close and, if you have turned it on, its draft prepared with AI (explained in "Artificial Intelligence in Work"). You can turn off each type of notice in your preferences, and whoever manages a project can turn off its weekly close. If you turn on Work notices by email, we may send them to you grouped, roughly one per hour, in your language; mentions and assignments, within a few minutes. Those emails only carry the names of the organization and the project, the key and title of tasks, the name of whoever made the change, statuses, dates and figures and, for a mention, an excerpt of the comment or update; never a task's description, anyone's email or anything from the conversation or document a task came from. From each email you can unsubscribe from them without signing in to your account.

Files. Files uploaded to Work belong to the organization. Whoever uploads one appears as its author, but the file stays even if that person leaves the organization or deletes their account. Whoever can see the project can see them. They are stored on Google Cloud servers, without public access, and only open through a temporary link that the app requests at that moment and that expires after an hour. Who uploads, opens or downloads, and removes each file is recorded in the organization's audit log. Files are deleted when someone with permission removes them (whoever uploaded it or whoever manages the project), and a removed file cannot be recovered. Archiving a project or a task does not delete them. If the organization is deleted, all its files are deleted. Anything that starts uploading and is not finished is deleted after 24 hours.

Tasks from a document. If you ask the AI to propose tasks from a document, we read its text at that moment, without storing it separately, and send it to the model's provider (explained in "Artificial Intelligence in Work"). The tasks you create keep a record of which document they came from.

Tasks from a message or a conversation with a customer. You can create a task from a message in an organization chat or from a conversation in the customer support inbox. The app fills in the form only with the text of the message you choose, and never copies the customer's name, email, phone number or address on its own. What you write or copy into the task will be seen by whoever can see the project, and it stays in the task even if the original conversation is later deleted, including when it is deleted because of a privacy request from the customer. So copy only what is needed. The task keeps a record of which conversation it came from; whoever cannot open that conversation sees neither its title nor the customer.

Artificial Intelligence in Work

In Work you can ask artificial intelligence for help: when creating or editing a task, to organize its requirements, suggest who could do it, point out what it is missing, find duplicate or similar tasks, split it into subtasks or propose a date and an estimate; to create a task from a sentence or propose tasks from a document; to summarize a task; and to prepare the draft of a project update. In addition, if you lead a project and turn it on in its settings, every Friday we prepare the draft of its weekly close for you. The AI only proposes: nothing changes until you accept or publish it.

What is sent? What the help you ask for needs, and only from what you can see in Work: the task's text as it stands in the form and project details (its name, part of its description, its goals, its statuses, its labels and its milestones). Depending on the help, also:

to suggest who could do it or to create a task from a sentence, the name, job title, teams and workload of the people who could take it on;
to find similar tasks or propose a date, the title and the beginning of the description of other tasks;
to summarize a task, its most recent comments, its history of changes, its subtasks and the tasks that block it or that it blocks, with the name and job title of the people who appear in it;
for the draft of an update or of the weekly close, what has happened in the project over that period, its previous update and recent comments on tasks that are overdue, blocked or stalled;
to propose tasks from a document, the document's text.

No one's email is ever sent, nor anything from projects you cannot see or from other organizations. The draft of the weekly close is prepared with what the project lead can see.

To whom? To the provider of the model the organization has chosen, through our model gateway: OpenAI, for the GPT models, and Google Cloud's Vertex AI, for the Gemini models, by Google, and the Claude models, by Anthropic. They process the data on our behalf, only to give us the answer, and under their terms they do not use it to train their models. They may keep records of requests for a limited time to detect misuse: OpenAI, for up to 30 days, and Google, for up to 90 days, the requests to its Gemini models that its systems flag as possible abuse. According to Google Cloud's documentation, prompts and responses are not shared with third parties, including when models from other makers are used, and Google only processes that data as instructed by its customer.

What do we keep? Work does not keep what the helps you ask for propose: only what you accept or publish is saved, like any change you make by hand. The draft of the weekly close is kept until the project lead uses or discards it, or for 14 days at most. Our model gateway keeps a technical copy of each answer for 7 days, so as not to charge twice if the same request is repeated after a dropped connection, and then it is deleted automatically. For each help we keep, for billing, the model, how much was used, what it cost, the organization and the project, and who asked for it or paid for it; never the text. That record is kept in the account of whoever paid for it (yours or, if the organization has the Business plan, the organization's), for as long as that account exists. Our technical logs do not keep the text either.

Who decides? The organization's owner and administrators can turn these helps off for the whole organization and choose the model. All members can see which model is used and what it costs. Those changes are recorded in the audit log.

On what legal basis? This data belongs to the organization: it decides to use these helps and is responsible for having a legal basis to do so, such as its legitimate interest in its team working with them (Article 6(1)(f) GDPR). We process it on its behalf, as its processor, and the model providers on ours.

Is it transferred outside the European Economic Area? Yes. Requests to OpenAI may be processed outside the European Economic Area, including in the United States, and Google Cloud's Vertex AI may process them in any region of the world where the model is available. For OpenAI, the transfer relies on the standard contractual clauses approved by the European Commission or on an adequacy decision, as its data processing terms provide; for Google, on what we explain in "Where We Store Data".

Meetings

Meetings is part of Work and only exists in an organization's space. It lets you record a meeting with the microphone, upload its audio or import the transcript of a Google Meet meeting, and get a transcript split by speaker, with a summary, the decisions and suggested tasks.

What do we keep? The original audio of the meeting, on Google Cloud servers with no public access; the transcript, with the text of each turn, its timing and a numeric speaker label ("1", "2"…) that can be replaced with a name; the participants that are added (their name and, optionally, a contact); the summary, the decisions and the tasks; and who owns the meeting and who its editors are. While you record, your device (the browser on the web, or the app's private storage on your phone) also keeps a copy of the audio and of pending corrections, so they are not lost if the upload fails or you leave the meeting. On the web it is deleted once the audio has been uploaded and transcribed.

Speaker separation. The transcript tells voices apart only to separate who says what within each recording, with numeric labels that are not carried from one recording to another. It does not identify anyone by their voice, and we do not keep voiceprints or any other biometric data.

Who sees it? A meeting starts as a draft that only its owner and the editors they choose can see. When it is published, only the reviewed text (the transcript, the summary, the decisions and the tasks) is shared with the organization's members or, if the meeting belongs to a project, with whoever has access to that project; its owner can also keep it private. The original audio is never published: only editors can listen to it, through a link that expires after 5 minutes. Search and "Ask about meetings" only use published meetings you can see.

Who is it sent to?

To transcribe it, the audio is sent to xAI, in the United States, both when recording live and when uploading audio. Some short files (up to 15 minutes) may be transcribed with Gemini, through Google Cloud Vertex AI. They process it on our behalf, to give us back the transcript.
To prepare the summary, the decisions and the tasks, and suggestions during the meeting if you turn them on, the participants and the transcript are sent to the provider of the model the organization has chosen, through our model gateway, as explained in "Artificial Intelligence in Work". The organization must have AI turned on.
Google Meet: if you connect your Google account and allow us to read your Meet meetings, we read, from your meetings of the last 28 days, the transcript Google Meet generates, the participants' display names and the title of the calendar event. We do not read recordings. What is imported comes in as a private draft, and automatic import checks for new transcripts every 15 minutes. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long do we keep it? The audio, the transcript and the rest of the meeting, for as long as the meeting exists. When its owner deletes it, shortly afterwards we also delete its audio, all its versions and its assistant conversation; only a mark with the identifier of the meeting, of the organization and of its owner remains, so that a meeting imported from Google Meet is not imported again. Uploads that are started and not finished are deleted. If the organization is deleted, its meetings and their audio are deleted with it. Our model gateway keeps a technical copy of each response (for example, a summary) for 7 days, as explained in "Artificial Intelligence in Work".

Billing. For each transcription and each analysis we keep, for billing, the model, the minutes or usage, what it cost and the meeting it belongs to; never the text.

Notice to participants and legal basis. Meetings are the organization's data: it is the organization that decides to record them and that is the controller, including of the voice and words of those who speak in them, people outside the organization included. It is therefore up to the organization to inform participants before recording and, where the law requires it, to obtain their consent. We process that data on its behalf, as its processor, under clause 15 of the Terms and Conditions, and the transcription and model providers process it on ours.

Is it transferred outside the European Economic Area? Yes. xAI processes the audio in the United States, under the standard contractual clauses approved by the European Commission. For Google Cloud and the model providers, what we explain in "Where We Store Data" and "Artificial Intelligence in Work" applies.

AI photo tools

Some of our services let you upload a photo so that artificial intelligence can generate a result from it, such as restoring an old photo, creating a portrait or editing an image. This section explains what happens to that photo.

What do we use your photo for? Only to generate the result you request and show it to you. We do not reuse your photos or results for any other purpose, such as creating content or training artificial intelligence models. We process them because it is necessary to provide the service you ask for (Article 6(1)(b) GDPR). If you upload a photo of other people, make sure you have their permission.

Who else processes it? To generate the result, we send your photo to artificial intelligence service providers that act as data processors on our behalf. They may only process it to provide the service to us, following our instructions, and may keep records of requests for a limited time, for example to detect misuse or meet legal obligations.

How long do we keep it? We store the photo you upload and the result on Google Cloud servers until you ask us to delete them by writing to support@neuralialabs.com. Please include the link to the result, or the service and date you used, so we can find them. Anyone who has the link to the result can view it.

Is it transferred outside the European Economic Area? Our servers and the artificial intelligence providers may process your photo outside the European Economic Area, including in the United States. When that happens, the transfer relies on the safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission.

If you sign up for our newsletter, this section explains which data we keep and what for.

What data do we keep? Your email address, the language you signed up in, the status of your subscription (pending confirmation, confirmed or unsubscribed), the date you signed up, the date you confirmed it, which is when you gave your consent, and, if you unsubscribe, the date you did. We also keep where you signed up: the form you used (for example, the one at the top of the blog), the address of the page it was on and, if that address had them, its campaign parameters (utm_source, utm_medium, utm_campaign and utm_content, which say, for example, that you arrived from a link in one of our videos). We take them from the address of the page when you send the form. To protect the form from abuse, we also keep your IP address and a fingerprint of your email address (a hash, not the address itself) for about a day, only to limit how many sign-ups can come from each one per hour; we do this on the basis of our legitimate interest in protecting the service (Article 6(1)(f) GDPR), and they are then deleted automatically.

What do we use them for? Your email address, only to send you the confirmation email and the newsletter, in your language. The form, the page and the campaign parameters, to know which pages and campaigns bring us subscribers. We do not use these data for anything else.

On what legal basis? Your consent (Article 6(1)(a) GDPR). You give it when you confirm your subscription from the email we send you; until then, you do not receive the newsletter.

How long do we keep them, and how do you unsubscribe? Every newsletter includes a link to unsubscribe, and you can also write to support@neuralialabs.com. When you unsubscribe, we stop sending you the newsletter and keep the record of your subscription, with the data above and marked as unsubscribed, until you ask us to delete it by writing to support@neuralialabs.com. If you never confirm your subscription, you do not receive the newsletter, and the record is kept in the same way.

Rights of Access, Rectification, Cancellation, and Opposition

At any time, the user may access, rectify, erase or object to the processing of their personal data by writing to support@neuralialabs.com from the address of their account. To stop receiving commercial messages it is enough to use the unsubscribe option included in any of those emails.

Rights of Users

The interested party of the personal data may in any case exercise the rights that assist them, in accordance with the General Data Protection Regulation and Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights. These rights are:

A. Right of access: to access and know the data stored about you.

B. The rights of rectification and deletion may be exercised whenever the interested party considers that the data collected in our processing is inaccurate, incomplete, inadequate, or excessive.

C. The right of opposition may be exercised whenever the interested party wishes to object to the processing of their personal data, both because the data is processed lawfully and because of legitimate personal interest or relative consent for advertising purposes.

D. The right to portability may be exercised whenever the interested party considers that the data collected in our processing should be returned to the data subject, or to another third party (Data Processor).

What We Keep If You Delete Your Account

You can delete your account from the app or by writing to us. Deleting Your Account explains how, and everything that gets deleted.

These things survive, each for a reason we can point to. Beyond what each one says, everything else is deleted.

Your invoices and payment records. Kept because we are legally obliged to: an issued invoice cannot be destroyed on the customer's request (tax and accounting law; Article 17(3)(b) GDPR, compliance with a legal obligation), and the law sets how long, at least six years (Article 30 of the Spanish Commercial Code). They hold what was charged and when, not what you did with the service.
A one-way hash of your email address, if you claimed the welcome credits. Kept to prevent fraud (legitimate interest, Article 6(1)(f) GDPR): without it, deleting and re-registering would hand out the free credits again and again. It is a SHA-256 hash plus two timestamps; your email cannot be recovered from it.
A record that the deletion happened. Kept as proof of it — the app stores require it, and so does the accountability principle (Article 5(2) GDPR). Once the deletion has fully finished, it only holds dates and counts of what was deleted, not your email and not your content. While something is still left to finish, it also keeps your account's internal identifier and what is missing, only so that we can complete it.
Messages you left in conversations of other people and of organizations are anonymised rather than destroyed, because those conversations also belong to the people still in them or to the organization (legitimate interest, Article 6(1)(f) GDPR). They stay as you wrote them, signed by "A deleted account" and without your email or your photo, and you stop being a member of those conversations. The same goes for what you wrote in an organization's support inboxes. What each message cost stays, because it is what the organization adds up from its usage, but without saying who paid for it or who asked for it. Of an agent run you started in one of those conversations, an internal identifier that is shown to no one remains; if it was still running when you deleted your account, it keeps who started it. In the conversation of a Work task's agent, you stop being among those who launched it, who are the ones who can read it.
Records of costs we absorb without charging you, if there are any, are summarised into anonymous totals and deleted. Some things we pay a provider for and charge no one; for example, a phone call rejected for lack of balance, a generation that fails because of an error on our side, or an image-style training or a video that fails or is cancelled. We record them to keep track of those costs, and losing their totals would stop our accounts from adding up (legitimate interest, Article 6(1)(f) GDPR). No individual entry is kept: entries are added up into totals per month, reason, provider, model and the service that recorded them (how many, the usage and the cost). Of the moment, only the month remains, and those totals carry no identifier of yours or of your calls.
A mark of an organization's free trial, if you started it as its owner. The trial is one per organization and one per owner: without this mark, deleting the organization or the account and starting again would give the trial again (fraud prevention, legitimate interest, Article 6(1)(f) GDPR). It is a hash of the organization's identifier, or of yours, with the date the trial started: neither the organization nor your account can be recovered from it.
Your entries in the audit log of the organizations you belonged to, with nothing that identifies you. Each organization keeps a log of the changes made in it (who changed what, when and from which IP address), which only its owner and administrators can see. The entries you appear in stay, because they are the organization's history and not only yours, but in your place it says "A deleted account", and the name or email and the IP address they kept about you are deleted. Each entry is deleted automatically a year after the change (legitimate interest of the organization, Article 6(1)(f) GDPR).
What you wrote or uploaded in an organization's Work: tasks and projects, comments and updates, links and files, milestones, the views you shared and the history of changes. It belongs to the organization and to the people who work in it, and deleting it would break their work (legitimate interest of the organization, Article 6(1)(f) GDPR). It stays as it was written and uploaded, signed by "A deleted account" and without the chat you wrote it from: you are no longer assigned to tasks, following them, or a member or lead of projects or milestones, and what an automation of the organization did on your behalf no longer says for whom. Because the text is not changed, it may still name you if someone named you in it, for example in a mention. Your saved views that you did not share, and the weekly close drafts that were waiting for you, are deleted.
What the agents you launched did on an organization's tasks: each time you launched an agent on a task (by giving it the task, mentioning it or trying again) or stopped its work, the agent, the task, how it ended and why, what it spent and the dates stay. It is the organization's record of what its agents did and what they spent, which each task shows (legitimate interest, Article 6(1)(f) GDPR). It stays without saying who launched it or who stopped it, and it is deleted on its own one year after it ended. While an agent waits for an approval, a summary of what it asks is kept too, with secrets hidden, until someone answers or its work ends; and what it proposes, until someone applies or discards it, or 14 days.
Other people's bell notices that tell what you did in an organization: in Work, a change of access, a departure or a change of who is responsible. They are the inbox of whoever received them, and taking them away would take away what happened to that person (legitimate interest, Article 6(1)(f) GDPR). They stay with "A deleted account" where your name was, without your email; if they quote an excerpt of a comment or update of yours, up to 140 characters, it stays as you wrote it. They are deleted automatically after 90 days, like every notice in the bell.
What you shared or created in other people's organizations: the resources you shared, the company tasks you created and, in a company email channel, your consent to unlimited replies and the recoveries you ran. It belongs to the organization (legitimate interest, Article 6(1)(f) GDPR). It stays in it without saying who shared, created, consented to or recovered it (a task's signature says "A deleted account", without email or photo), and what you were responsible for passes to whoever is its owner. Your membership record, your invitations, your permissions and your departures are deleted.
What you uploaded to an organization's knowledge: folders, documents and files, the image you set on one of its folders, and the indexed fragments made from them. The organization uses it in its chats and its channels (legitimate interest, Article 6(1)(f) GDPR), and it is deleted with the folder or with the organization. It is kept under the internal identifier it was uploaded with, also in what is crawled from a website for that folder, which leads to no profile except the billing records the law obliges us to keep; who uploaded it becomes "A deleted account".
Website crawls you launched in an organization's knowledge: the organization keeps watching its knowledge with them and keeps their record (legitimate interest, Article 6(1)(f) GDPR). The website being crawled passes to whoever owns the folder — the organization itself, which crawls it without charging anyone, or the person the folder went back to — and its finished crawls say "A deleted account"; one still running stops on its own and, when it ends, says the same. The trust you gave to the read-only hints of a company tool server (MCP) no longer names you either. Neither your name nor your email.
What you spent in an organization's space: the organization's usage by day and by month (by use, model and team), what was spent in its pool's period or your seat's, the seat you held, and what the state of its plan says. It is the organization's account and goes with it (legitimate interest, Article 6(1)(f) GDPR). Your share is added to "A deleted account" and your identifier leaves the list of who appears: the totals stay, and they don't say whose. Your share of what was spent in its pool's period or your seat's leaves (the total stays); the seat you still held becomes free, with its credits, for the organization, and from the state of its plan go your credit limit, your request for more credits and your identifier. Neither your name nor your email.
Content reports you made, or that concern something you wrote. A report and how it was resolved must stay reviewable even if the person who reported or the person reported leaves (moderation and abuse prevention; legitimate interest, Article 6(1)(f) GDPR). They stay as they were made: the internal identifier of the reporter's account and that of the account that wrote what was reported, what was reported, why, and what the reporter wrote.
The record of something of yours that you moved to an organization, for example a channel or an automation: whose it was, where it went and how it was, so that the organization can know it and undo it (legitimate interest of the organization). It says "A deleted account" instead of your name, and your own "drafts only" locks of an email channel are deleted. Only your account's internal identifier stays, inside the keys of the links and conversations of an email channel you moved to the company, which are shown to no one: rebuilding them would break that channel.
The connection of an integration you connected for an organization. It belongs to the organization, which needs it to keep working until it disconnects it (legitimate interest, Article 6(1)(f) GDPR). It keeps the name of the external account you connected (for example, your email address in that service) and what the provider answered when it was connected, but not your account's identifier.
Two technical records: the ticket of each voice call (the channel, its owner, who pays for the call, the calling number and what it will answer), which only serves to open the call and is deleted after 2 minutes or, if nobody uses it, within the day; and each failed delivery of a webhook of an organization's chat (the webhook's address, the chat and the text that was not delivered), which belongs to the organization to review the failure and is deleted on its own after 30 or 90 days (legitimate interest, Article 6(1)(f) GDPR). Those of your own chats are deleted with your account. Neither your name nor your email.
Exports already prepared of an organization you belonged to. They are a copy the organization asked for of its own data: a snapshot of the day it was prepared, with what it then said about you (your name, your email and what you wrote). They are not rewritten when you delete your account: each one is deleted automatically 7 days after it was prepared.
Your organizations that are deleted with you, for 30 days. If you were the owner of an organization in which no one else was active, or of an archived one, it is not deleted at once: it is kept archived for 30 days, with no one able to open it and nothing in it running, so that you can take its data with the link we gave you when you deleted your account, as the EU Data Act provides (Regulation (EU) 2023/2854, Article 25). What you wrote or did in it stops naming you from the first day, as in any other organization. After the 30 days, it is deleted entirely.

One thing is outside our reach: anything already handed to a third party before you deleted the account — for example, images you sent for training an image style, which are processed by an external provider. Their retention is governed by that provider, not by us.

Spam

NeuraLIA Labs does not endorse the practice of "spamming." This word means the mass and repeated sending of unsolicited email messages, usually of a commercial nature, to people with whom the sender has had no previous contact, or people who have expressed their desire not to receive such messages. In the event that https://neuralialabs.com considers that certain information may be of interest to users, it reserves the right to provide them with such information by email, with their prior consent and always offering the possibility to opt-out of that information service.

Sales Funnels and Advertising

NeuraLIA Labs may use advertising campaigns and sales techniques through which it may request certain personal data in order to provide the requested service, such as delivering a quote. In any case, interested parties can exercise their rights at any time regarding personal data.

Disclaimer

The establishment is not responsible for the opinions and comments that individuals outside the organization publish on social networks, websites, forums, reviews, or apps about NeuraLIA Labs or any of its services, personnel, or facilities, with the author being solely responsible for their accuracy.

Modification of the Privacy Policy

NeuraLIA Labs reserves the right to modify this policy at any time in order to adapt it to legislative developments, with successive versions being published on the website. If we later make an important change to this policy (for example, to what we use your data for, to whom we disclose it or where it is processed), we will tell you in advance, in the app or by email, and we will change the date below. If a change needs your consent, we will ask for it. Any doubts, questions, or comments you may have regarding this policy, do not hesitate to consult them by directing your communication in this regard to: support@neuralialabs.com.

This Privacy Policy is updated as of November 6, 2026.

Complaints to the Supervisory Authority

Beyond writing to us, you may lodge a complaint with the data protection supervisory authority of your country. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es).

Minors and Minimum Age

The service is not directed to minors. You must be at least 18 years old to create an account, wherever you live.

We do not knowingly collect personal data from anyone under 18. We do not ask for a date of birth: the age declaration is made when the account is created, and we close the account and delete its data if we learn that it belongs to a minor.

If you are a parent or legal guardian and believe that a child in your care has given us personal data, write to support@neuralialabs.com: we will delete the account and the data associated with it, and confirm it to you.