Privacy Policy

• Account details. Your email address, display name, optional profile information, such as your name, company and country, an optional avatar, and your sign-in methods. Our authentication service processes password credentials, passkey public keys and authentication records, and any second-factor enrolment you enable. A passkey's private key stays with your authenticator; we do not receive a fingerprint or face scan used to unlock it.
• Organisation details. If you administer an organisation, its name, members' names and roles, existing seat assignments, and billing-contact details supplied through our assisted sales or administration process.
• Premium evaluation history. If you explicitly start an individual premium evaluation, we store the selected tier, activation and expiry times, a consumed-evaluation record, and any support-authorized extension history. We use this to provide access and enforce one evaluation per account. It does not include model content or file paths. The account-linked record follows account deletion; separately required staff audit records follow the existing audit retention and erasure rules.
• Billing details. Your billing name and address, country, VAT or tax identification number, and the last four digits and card type of the payment method that Stripe holds. For annual orders, we record your stated consumer or business capacity, renewal consent, agreed amount and currency, and renewal reminder and cancellation evidence. These financial and order records follow the billing retention schedule; account deletion removes the account link where retention is required. Full card numbers go directly to Stripe and never reach our systems.
• Communications. Messages to support, sales, security or privacy, including the product, subject, description and other details you provide. Website request forms store your submission, relevant diagnostic or sales details, replies and case status. Staff can record internal review notes. We send transactional confirmations, replies and status notifications through our email provider. Guest requests use a private access link that expires after 30 days; this expiry does not delete the request. To prevent abuse, we use a keyed hash of the connection IP address in short-lived rate counters. Attachments and Diagnostics are received only through a channel agreed with support.
• Choices. Cookie choices, notification preferences, interface and workflow settings, and saved preferences about product usage analytics, crash reports, personalisation and synchronisation. Availability of these settings in each app depends on the features it supports. Saving an optional choice does not itself send telemetry or a crash report.

• Connection and country data. Cloudflare processes IP addresses, requested pages, timestamps, browser and device information and security signals to deliver and protect the Website. For cookie controls we reduce its country signal to an in-scope or rest-of-world category. Separately, pricing and checkout use country information to select a regional price and check purchase eligibility. Billing, payment-country and pricing-zone information may be retained with transaction records; the reduction used for cookie controls does not apply to all country data.
• Sign-in events. When you sign in or change security settings, our authentication provider records the time, the method used, the IP address and the browser, so that you can review your sessions and we can detect misuse.
• Cookies and similar storage. Section 5 describes sign-in, preference, security and payment storage. With your prior analytics consent, we record public page views and selected link clicks, pseudonymous visitor and session IDs, referring domains and campaign tags, device/browser/operating-system categories, approximate country/region and IP address. We do not collect query strings, form contents or activity on private account, payment or applicant-access pages. We do not use advertising pixels, session replay or account linking. Checkout embeds Stripe's payment interface, and its processing is described separately below.

Paramora Prism™

• Sign-in. Prism signs you in through your system browser and our authorization service; the plugin never sees your password. It receives short-lived tokens that identify your Account.
• Entitlement checks. Account and licence identifiers, activation and lease records, product version and channel, device identifiers or machine hashes, request times and connection information are used to validate access and deliver licensed components. A hash or pseudonymous identifier can still be personal data when linked to an Account; it is not automatically anonymous.
• Automation keys. For headless use, we store only a hash of the key and a four-character hint.
• Local logs. The plugin writes logs and validation reports on your own machine. They are not sent to us.
• Diagnostics. The plugin can keep local logs and technical details on your machine. This site does not currently provide a Diagnostics upload. If support asks for a file through a separately agreed secure channel, you choose what to provide and should review it first; access tokens must never be included.
• Model content. Opening or converting a model locally does not upload its contents, exports or validation reports to us. If you separately provide any of that material to support, we process the material you send for that request.

Update and component requests disclose connection information to the delivery service. Some catalogue information may be public; entitled delivery can also use Account and licence information. We do not treat all update requests as anonymous. Material changes to this processing will be explained before they are introduced.

• Identity providers. If you choose an enabled third-party sign-in method, the provider sends identity information such as a provider identifier, email address and profile name or image, according to the permissions and configuration of that sign-in method.
• Your organisation. If our assisted administration process links your Account to an organisation, we receive the membership and role information needed to do so. Your Account email remains part of your own identity record and is not exposed in the organisation member directory.
• Stripe. Payment and subscription events provide customer, order, invoice and subscription identifiers, amounts, currencies, taxes, billing or payment-country information, payment-method details such as card brand and last four digits where available, and payment, refund, dispute or fraud-review status. We retain transaction records and some provider event data for provisioning, reconciliation and support. Full payment-card numbers are entered directly into Stripe's payment interface.
• Public and commercial sources. For business customers we may check company registration and sanctions lists to meet legal obligations.

We do not intentionally collect special categories of personal data (such as health, biometric, genetic, religious or political data), government identification numbers, precise geolocation, or personal data from children (section 13). Please do not include such data in support requests.

Providers perform different roles. A processor handles data on our instructions; a sub-processor does so where we in turn act for an organisation. An independent controller determines its own purposes under its own notice. The register below distinguishes those roles. Annex B of the Terms governs direct notice and authorisation for changes to sub-processors handling an organisation's data. Contracting entities, locations and safeguards marked for confirmation must be verified before this revised notice is published as final.

• Your organisation. If your Account is part of an organisation, its managers can see your name, role, seat and activation state, and the status of the organisation's licences (section 12). The current member directory does not expose your email address.
• Identity providers. When you sign in through a third-party provider, that provider learns that you signed in to Neobuilt.
• Professional advisers. Auditors, accountants, lawyers and insurers, under confidentiality, where needed to run the company or handle a claim.
• Authorities. Courts, regulators, law-enforcement and tax authorities where the law requires it or where a request is lawful and proportionate. We review every request, disclose only what is required, and tell you when the law allows.
• Business transfers. If we merge, are acquired or sell assets, personal data may be transferred to the successor, which must honour this policy. We will notify you before your data becomes subject to a different policy.
• With your consent or at your direction, for example when you ask us to share something with a colleague.

We do not sell personal data, we do not share it with advertising networks or data brokers, and we do not share it for targeted advertising.

Subject to the conditions and exceptions in applicable law, your rights include:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data where there is no longer a reason for us to keep it;
• restriction of processing in the circumstances the law describes;
• portability: where processing is automated and based on consent or a contract, receive personal data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• object to processing based on legitimate interests, on grounds relating to your particular situation, and to direct marketing at any time;
• withdraw consent at any time where we rely on it, without affecting processing before the withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions in the law;
• lodge a complaint with a supervisory authority.

Use the Account portal to update your profile, request an export, manage sessions and devices, or request deletion. The export request enters our privacy queue for a response; it also unlocks a protected ZIP download containing account data and any saved avatar. Contact privacy@neo-built.com for other personal data or help with any right, including if you cannot sign in. We request additional identity information only where reasonably necessary. Under the GDPR we respond without undue delay and within one month of receipt. If complexity or the number of requests justifies an extension of up to two further months, we tell you within the first month and explain why. Requests are normally free; if a request is manifestly unfounded or excessive, we may charge a reasonable permitted fee or refuse, explaining the reason and your complaint and judicial-remedy options. We do not penalise you for exercising your rights.

You can raise a concern with us, but do not have to do so before complaining to an authority. In Sweden you can contact Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se. Under the GDPR you may also complain to an authority where you habitually live, work or believe an infringement occurred. UK and Swiss residents may contact the Information Commissioner's Office or the Federal Data Protection and Information Commissioner respectively, where the relevant law applies.

The GDPR applies to processing in the context of our Swedish establishment, including where an individual is outside the EEA. UK and Swiss laws apply according to their own scope and requirements; they are not identical to the GDPR. Any required local representative and additional disclosures must be identified for the relevant service before that processing begins.

US state privacy laws have different scope, definitions and rights. Where one applies to our processing, we honour its applicable access, correction, deletion, portability, opt-out, appeal and non-discrimination requirements. We do not sell personal data or share it for cross-context behavioural advertising, and do not use it for targeted advertising. Account credentials may count as sensitive personal information under some laws; we use them for account access and security. Contact the privacy mailbox to make a request or challenge our response. An authorised agent may act where permitted, subject to proportionate verification. A state-specific supplement is required if applicable law requires disclosures beyond this policy.

You may also have rights under other applicable local privacy laws. Contact the privacy mailbox for help exercising them. This policy does not replace a required local notice, representative or complaint route; those must be provided for a service where applicable.