Privacy Policy

1. Scope & Who Is Responsible

1.1 This policy applies to all personal data processed in connection with the Neurosly digital wellbeing platform — the website at www.neurosly.com and any Neurosly-branded application.

1.2 The data controller — the company responsible for your data — is:

1.3 We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable legislation.

1.4 We may update this policy as our practices, technology or the law change. When a change is significant, we will notify registered users by email or with a clear notice on the platform.

2. The Data We Collect

2.1 Account information

When you register we collect your name, email address, an encrypted password, your account settings and preferences, and the date the account was created.

2.2 Payment and order information

To process your subscription we collect your billing details, currency and payment-method preferences, and a record of your orders — amounts, dates and the plan you chose. Card details themselves are handled by our payment processors, not stored by us.

2.3 How you use Neurosly

To improve the product we record which sessions you listen to and complete, how long and how often you use the platform, how you navigate it, your quiz responses and progress, and any ratings or feedback you leave.

2.4 Device and technical data

For security and troubleshooting we log your IP address, device identifiers, operating system, browser type and language, screen size, time zone, approximate location and the source that referred you to us.

2.5 Support conversations

When you contact support we keep the messages exchanged, ticket details, attachments and how the issue was resolved.

2.6 Marketing data (with your consent)

If you agree, we track your marketing preferences, how you engage with our emails and campaigns, ad clicks and conversions, and participation in A/B tests.

3. Why We Process It & Legal Bases

Every processing activity rests on one of the lawful bases in Article 6 GDPR:

3.1 To perform our contract with you — Art. 6(1)(b)

• Providing the service and managing your account — account details, subscription and usage data. Kept while your subscription is active and for 6 years after the account closes or you last log in, whichever is later.
• Taking payments — billing details, tokenised card data and transaction records. Kept for 10 years from the transaction, as accounting law requires.

3.2 To comply with the law — Art. 6(1)(c)

• Accounting and tax — invoices and payment records kept 10 years from the end of the fiscal year, as required by Lithuanian accounting law.
• Legal proceedings and regulation — relevant data kept for the duration of any proceedings plus 3 years after final resolution.

3.3 Our legitimate interests — Art. 6(1)(f)

• Security and fraud prevention — IP addresses, device identifiers and login records, kept 2 years. These measures are proportionate and do not override your rights.
• Improving the service — anonymised usage statistics, kept 3 years.
• Running the business — operational and account records, kept 5 years from last interaction.

3.4 Your consent — Art. 6(1)(a)

• Marketing emails — your name, email and engagement history. Withdraw consent any time via the unsubscribe link or your account settings; data kept until withdrawal or after 3 years of inactivity.
• Non-essential cookies — managed through the cookie banner; typically kept 12–24 months.
• Support history — kept 4 years from the last message.

4. Who We Share Data With

4.1 We never sell, rent or trade your personal data. We share it only where it is needed to run the service, where the law requires it, or where you have agreed. Every processor we use is bound by contract to GDPR-level protection.

4.2 Categories of recipients

• Payment processors — handle transactions and fraud checks (EU/US; PCI-DSS compliant, protected by Standard Contractual Clauses).
• Hosting and cloud providers — store and back up data (EU data centres, ISO 27001 certified, encrypted in transit and at rest).
• Support tooling providers — help us answer your messages (EU-based, under confidentiality and data-processing agreements).
• Analytics tools — receive anonymised, aggregated usage data (may include US; SCCs and anonymisation applied).
• Email and marketing platforms — deliver our communications (EU/US; GDPR-compliant, with opt-out built in).
• Professional advisers — lawyers and accountants bound by professional secrecy.
• Authorities — only when legally compelled, and only the data the law strictly requires, after we verify the request.

4.3 Transfers outside the EEA

Where data leaves the European Economic Area, we rely on one of these safeguards: a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or — for specific cases — your explicit consent.

5. Your Rights

Under the GDPR you can, subject to the limits set out in the law, exercise the following rights free of charge. Send requests to support@neurosly.com with the subject "Data Subject Rights Request" — we respond within one month unless the request is unusually complex.

• Access (Art. 15) — find out whether we hold data about you and receive a copy, along with details of purposes, recipients and retention.
• Rectification (Art. 16) — have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17) — have your data deleted when it is no longer needed, when you withdraw consent, or when it was processed unlawfully. This right does not apply where we must keep data to comply with the law or defend legal claims.
• Restriction (Art. 18) — pause processing while accuracy is checked, while an objection is assessed, or where you need the data preserved for a legal claim.
• Portability (Art. 20) — receive the data you gave us in a structured, machine-readable format (e.g. CSV or JSON) and pass it to another provider.
• Objection (Art. 21) — object to processing based on legitimate interests. If you object to direct marketing, we stop immediately, without exception.
• Withdraw consent (Art. 7(3)) — at any time, through your settings or unsubscribe links; earlier processing remains lawful.
• Complain (Art. 77) — if you believe your rights have been breached, you can complain to the Lithuanian supervisory authority: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius · www.ada.lt.

6. How We Protect Your Data

6.1 Technical measures

• All traffic encrypted with TLS; stored data encrypted with strong industry-standard algorithms
• Role-based access — staff can only see the data their job requires
• Multi-factor authentication on all administrative access
• Firewalls, intrusion detection and continuous monitoring
• Regular security testing and vulnerability reviews
• Data minimisation — we collect and keep only what is genuinely needed

6.2 Organisational measures

• Confidentiality agreements for everyone who works with us
• Ongoing data-protection training for staff
• Documented incident-response procedures aligned with Articles 33–34 GDPR
• Due-diligence checks and contractual safeguards for every vendor
• Privacy-by-design in how our systems are built

6.3 If a breach happens

If a personal-data breach puts your rights at risk, we will notify the supervisory authority within 72 hours of becoming aware of it, inform affected users without undue delay where the risk is high, and document what happened and what we did about it.

7. Cookies & Tracking

7.1 We use cookies and similar technologies to keep the platform working, understand how it is used, and personalise your experience, consistent with the ePrivacy rules.

7.2 Types of cookies we use

7.3 Managing cookies

You choose your cookie settings in the banner shown on your first visit, can change them any time through the preference centre, and can also block or delete cookies in your browser (though blocking essential ones may break parts of the platform).

7.4 Third-party cookies

Some third-party services embedded in the platform — such as analytics providers, payment processors and content delivery networks — set their own cookies. Their own privacy policies apply to those.

7.5 Do Not Track

The platform does not currently react to browser "Do Not Track" signals; use the cookie settings above to control tracking.

8. Automated Decisions & Profiling

8.1 We do not make automated decisions with legal or similarly significant effects on you (Article 22 GDPR). Decisions about accounts, subscriptions and access always involve a human.

8.2 We do use limited profiling to personalise the product — for example recommending sessions based on your listening history or tailoring program suggestions to your quiz answers. This has no legal effect on you, and you may object to it at any time by writing to support@neurosly.com.

9. Children

9.1 Neurosly is for adults. Our services are not aimed at anyone under 18, and we do not knowingly collect data from minors without verified parental consent.

9.2 If we discover we have collected a minor's data without proper consent, we delete it immediately. Parents or guardians who believe we may hold their child's data should email support@neurosly.com.

10. How Long We Keep Data

10.1 We keep personal data only as long as needed for the purpose it was collected, to meet legal obligations, to resolve disputes and to enforce our agreements. The specific periods reflect the type of data and the applicable law.

10.2 Retention schedule

10.3 When a retention period ends, we securely delete or irreversibly anonymise the data — removing it from live systems and backups and instructing our processors to do the same.

11. Changes to This Policy

We may revise this policy when our practices, the technology we use, or the law change. For significant changes we will email registered users at least 30 days before the change takes effect, place a clear notice on the platform, and update the "Last updated" date at the top of this page. Continuing to use Neurosly after that constitutes acceptance; if you disagree with a change, stop using the platform and, if you wish, request deletion of your account.

12. How to Contact Us

12.1 General privacy inquiries

Questions about this policy, our data practices, or your rights? Write to support@neurosly.com with the subject line "Privacy Inquiry" — we aim to respond within five (5) business days.

12.2 Data Protection Officer

For matters specifically concerning GDPR rights, data-protection compliance, or communications with a supervisory authority, contact our Data Protection Officer at support@neurosly.com with the subject line "Attention: Data Protection Officer".

12.3 Supervisory authority

If you are not satisfied with our response, or believe your data-protection rights have been violated, you may contact the Lithuanian supervisory authority: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) · L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania · +370 5 271 2804 · www.ada.lt.