Privacy Notice

1. Who controls personal data

NEO ANALYTICA LTD (company number 16877712), registered at 3rd Floor, 86–90 Paul Street, London, England, United Kingdom, EC2A 4NE, operates Aurelia and is controller for account, billing, support and service-usage personal data. Customers are normally controllers of personal data imported from their marketing systems; Aurelia processes that data on their instructions.

2. Data we process

• Account details such as name, work email, organisation and encrypted password.
• Beta and design-partner application details, including company, role, website, advertising-spend range, decision workflow and the budget-allocation challenge submitted.
• Workspace settings, team membership and audit history.
• Stripe customer, subscription and payment-method identifiers; full card numbers are handled by Stripe and are not stored by Aurelia.
• Source connection metadata and marketing, commerce, analytics, CRM or support data selected by the customer.
• Prompts, governed tool results and configuration for Aurelia Auto.
• Security, request and operational logs including IP-derived abuse-prevention counters.

3. Why we process it

We process data to review and respond to beta applications, take steps requested before entering a contract, perform our contract, authenticate users, provide analytics and AI-assisted features, operate billing, secure the service, prevent abuse, respond to support and meet legal obligations. Optional product updates are sent only where the applicant has opted in, and that consent can be withdrawn at any time.

4. Providers, residency and transfers

We use service providers for hosting, transactional databases, warehouse processing, ingestion, payments, email delivery and—where configured—AI inference. These include Vercel, Google Cloud, Airbyte, Stripe and Resend. Customer-selected model providers may include OpenAI, Anthropic or Google. Our current residency position is: See the current subprocessor register. Data may be processed outside the UK; we use applicable transfer safeguards where required. See the subprocessor register and data processing terms.

5. Retention and security

See the current retention schedule. One-time authentication tokens expire automatically. API keys are encrypted at rest, sessions use signed HTTP-only cookies, and warehouse datasets are tenant-isolated. No system is risk-free; report suspected incidents promptly.

6. Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability or objection, and may complain to the UK Information Commissioner’s Office. Some rights are subject to legal exceptions. Customers should handle requests concerning personal data they imported; we assist them as processor.

7. Cookies

Aurelia currently uses strictly necessary session and security storage. See the Cookie Notice. Optional analytics or advertising technologies will require an updated notice and consent controls before being enabled where required.

8. Contact

Send privacy questions or rights requests to privacy@neoanalytica.co.uk.