Privacy Policy

1. Information We Collect

Account information

• Name, email address and password (the password is stored hashed by our authentication provider, Supabase)
• If you sign in with Google, GitHub or LinkedIn: the name, email address and profile picture that provider shares
• Your plan, token balance, token usage and activity history
• A referral code and the email address you enter to get one
• Support messages you send us

Payment information

• Razorpay order and payment IDs, amount, and the plan or token pack you bought
• Card, UPI and bank details are entered with Razorpay and never reach our servers

Content you create

• Topics, prompts, generated posts, scripts, images and videos, and images you upload
• Scheduled posts, daily automation settings and post history
• Brand kit (logo, colour, website), which is saved only in your browser

Agents (Cold Mail and LinkedIn DM)

• Details you enter for the agents: name, email, LinkedIn URL, headline, and any resume you upload
• Your own Groq or Google Gemini API key, stored encrypted
• Cold Mail: the company, contact email, subject and text of each draft it writes. Contacts come from email addresses founders published themselves in public Hacker News hiring threads
• LinkedIn DM: the public profile details of prospects (name, headline, company, profile URL), and the messages sent and replies received in those conversations
• Desktop runner: the device name of each computer you link

Connected accounts

LinkedIn, YouTube and Gmail data is described in sections 3 and 4.

Usage information

• Device and browser details (e.g., IP address, type, version) and server logs
• Pages visited and interactions on our website, measured with Google Analytics

2. How We Use Your Information

We use collected data to:

• Provide the services you ask for: generating, scheduling and publishing content, and running the agents you set up
• Process and verify payments via Razorpay, and credit tokens
• Send transaction confirmations, password resets and important updates
• Offer customer support and respond to inquiries
• Analyze website usage to improve performance
• Prevent fraud and abuse, and comply with legal obligations

We do not sell your data, use it for advertising, or use it to train AI models.

3. Connected Accounts

You choose whether to connect each account, and you can disconnect it at any time.

LinkedIn

• What we access: your name, email and profile picture, and permission to post on your behalf (scopes: openid, profile, email, w_member_social)
• Why: to publish the posts you create or schedule, to your own profile
• What we store: the LinkedIn access token and the posts you published or scheduled
• The LinkedIn DM agent does not use this connection. It runs in your own browser on your own computer, signed in with your own LinkedIn session

YouTube (Google)

• What we access: your channel's name and picture, and permission to upload videos to your channel
• Why: to show which channel is connected, and to upload the Shorts you create in Neuroviai, only when you start a run or schedule
• What we store: your channel name and picture, and an encrypted access token
• We only add new videos (with their title, description and thumbnail). We never delete or change your other videos, post comments, or read your viewers' data

Gmail (Google)

• What we access: permission to create drafts in your mailbox (scope: gmail.compose)
• Why: the Cold Mail agent puts each email it writes in your Drafts folder. You review and send drafts yourself
• What we store: your Gmail address and an encrypted refresh token
• We never read, send or delete your email

5. Information Sharing and Service Providers

We do not sell or rent your personal information. We share only what each provider needs to do its job:

• Razorpay: payment processing
• Supabase: database and sign-in
• Render: our application servers
• Netlify: website hosting
• Google Analytics: website usage statistics
• AI providers (Google Gemini, Groq, Together AI, Hugging Face): the topic and text needed to generate your posts, scripts and images. When an agent or the Shorts automation uses your own API key, the request goes to that provider under your account
• Voice providers (Microsoft Edge text-to-speech, Google Gemini): the script of a Short, to create its voiceover
• Stock media (Pexels, Pixabay): search terms only, to find footage, images and music
• LinkedIn, YouTube and Gmail: the content you ask us to publish or draft there
• Government authorities, if legally required

Razorpay processes payment data under their own Privacy Policy.

6. Data Security

We take reasonable measures to protect your data, including:

• HTTPS (TLS) encryption for all traffic
• Encryption at rest for Google tokens and the AI API keys you add
• Limited access to sensitive data
• Compliance with PCI DSS via Razorpay

7. Data Retention and Deletion

• We keep your data while your account is active
• Disconnecting LinkedIn, YouTube or Gmail deletes that account's stored token
• You can delete scheduled posts, API keys, resumes and linked runners at any time in the app
• Settings → Delete Account deactivates your account. To have all your data permanently erased, email neuroviai.dev@gmail.com from your account's email address, and we will delete it within 30 days
• Payment records are kept for as long as tax and accounting law requires

8. Your Rights

As a user, you have the right to:

• Request access to your data
• Update or correct personal information
• Request deletion of your data
• Withdraw consent, disconnect accounts, or opt out of communication

For Razorpay-related data, please contact them directly at dpo@razorpay.com.

9. Cookies, Local Storage and Analytics

• Your browser's local storage keeps you signed in and remembers your settings
• Google Analytics cookies measure how the website is used. They are set only if you choose Accept in the cookie banner, and you can change your choice any time with "Cookie settings" at the bottom of every page

You may disable cookies through your browser settings, or opt out of Google Analytics with Google's opt-out add-on.

10. Mobile App

• Your sign-in is stored in your phone's secure storage (Android Keystore / iOS Keychain)
• The app reads only the photos you pick to attach to a post
• The app has no analytics or advertising tracking

11. Children

Neuroviai is not meant for anyone under 18, and we do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy. Changes will be posted on this page with an updated date above.