Personal Data Processing Policy

1. Purpose and scope

This Personal Data Processing Policy describes how we collect, store, use, circulate, and delete the personal data of users, visitors, waitlist subscribers, customers, and contacts of NeuralOS.

It specifically implements Colombia’s Statutory Law 1581 of 2012, which implements the fundamental right of habeas data (Article 15 of the Colombian Constitution), and Decree 1377 of 2013, compiled in Sole Regulatory Decree 1074 of 2015 (Book 2, Part 2, Title 2, Chapter 25), and includes the rules applicable to the European Union, the EEA, and the United Kingdom (GDPR), the United States (CCPA/CPRA), and Brazil (LGPD). It supplements the Privacy Policy, the Cookie Policy, and the GDPR document.

2. Data controller

Klinworks, LLC has no domicile or branch in Colombia. All communications related to personal data processing are handled by email at the address above.

3. Definitions and principles

Definitions

• Data subject: the natural person whose personal data is processed.
• Personal data: any information linked or that can be associated with an identified or identifiable natural person.
• Sensitive data: data that affects the data subject’s privacy or whose misuse may lead to discrimination (racial or ethnic origin, political views, religious beliefs, health, sex life, biometric data, among others).
• Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.
• Controller: the party that decides on the database and the processing; in this case, Klinworks, LLC.
• Processor: a party that processes data on the controller’s behalf, such as our infrastructure and AI model providers.
• Authorization: the data subject’s prior, express, and informed consent to processing.
• Transfer: sending data to a recipient that is itself a controller, inside or outside the country.
• Transmission: communicating data to a processor so it can process it on the controller’s behalf, inside or outside the country.

Principles

We apply the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security, and confidentiality set out in Article 4 of Law 1581 of 2012, which are equivalent to the principles of the GDPR and the LGPD.

4. Data we process and purposes

We never train models on our customers’ private data. We do not use data for purposes other than those disclosed without asking for a new authorization.

5. Data subject authorization

We process your data with your prior, express, and informed authorization, which we obtain before collection through means that allow us to keep proof of it:

• when you create your account and accept this policy and the Terms;
• when you join the waitlist, by checking the acceptance box;
• through unequivocal conduct that reasonably shows you gave it, such as sending us an inquiry by email.

When we request it, we inform you of the processing and its purpose, that answering questions about sensitive data or minors’ data is optional, of your rights, and of our contact details. We keep proof of the authorization, and you can request a copy at any time.

Authorization is not required in the cases of Article 10 of Law 1581 of 2012: information requested by a public or administrative entity exercising its functions or by court order, data of a public nature, medical or health emergencies, processing authorized by law for historical, statistical, or scientific purposes, and data related to the Civil Registry.

6. Sensitive data and minors’ data

Sensitive data

We do not request sensitive data. If it ever becomes necessary, we will explicitly tell you which data is sensitive and why, and you will not be required to authorize its processing. Please do not include sensitive data in your workspace, prompts, or the ATLAS assistant unless it is essential and you have the appropriate authorization.

Minors

NeuralOS is intended for people aged 18 or older, and we do not knowingly collect data from children or adolescents. If we discover that we have, we will delete it. Any exceptional processing would respect the best interests of the minor and their fundamental rights, under Article 7 of Law 1581 of 2012.

7. Data subject rights

Under Article 8 of Law 1581 of 2012, as a data subject you have the right to:

1. Access, update, and correct your personal data, including partial, inaccurate, incomplete, fragmented, or misleading data.
2. Request proof of the authorization you gave.
3. Be informed, upon request, of how we have used your data.
4. File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after completing the inquiry or claim process with us.
5. Revoke the authorization and/or request deletion of your data when principles, rights, and constitutional and legal guarantees are not respected. Deletion does not apply where there is a legal or contractual duty to remain in the database.
6. Access your personal data being processed free of charge, at least once every calendar month and whenever this policy is substantially modified.

These rights may be exercised by the data subject, their successors, their accredited representative or attorney-in-fact, or anyone designated by stipulation in favor of another.

8. Inquiry and claim procedure

All requests are submitted by email to ceo@neuralos.io, with "Inquiry" or "Claim" in the subject line.

Inquiries

Inquiries let you learn what information we hold about you. We answer within 10 business days of receipt. If we cannot answer within that period, we will tell you why and when we will respond, which will not exceed 5 additional business days.

Claims

Claims let you request correction, update, or deletion of your data, revoke your authorization, or report an alleged breach. A claim must include at least:

• the data subject’s identification (name and ID document);
• a description of the facts giving rise to the claim;
• an email or postal address for the response;
• any documents you wish to rely on.

If the claim is incomplete, we will ask you to fix it within 5 days of receipt. If 2 months pass without you providing the information, we will consider the claim withdrawn. Once we receive a complete claim, we will add the note "claim in process" and its reason to the database within 2 business days and keep it until the claim is resolved.

We respond within 15 business days from the day after we receive the complete claim. If that is not possible, we will tell you why and the new date, which will not exceed 8 additional business days.

Only after completing this process may you file a complaint with the Superintendence of Industry and Commerce.

9. Responsible area

Inquiries, claims, and requests from data subjects are handled by Klinworks, LLC through the ceo@neuralos.io mailbox, which is the only official channel. Requests from people in the EEA, the United Kingdom, the United States, and Brazil are also handled from that mailbox.

10. International transfers and transmissions

Klinworks, LLC is in the United States, and our providers process data mainly in the United States. As a result, your data is sent outside Colombia, the EEA, the United Kingdom, or Brazil:

• Transmissions to processors: we share data with providers that process it on our behalf (hosting, database, payments, email, monitoring, and AI models) under contracts requiring them to process it only on our instructions, with security and confidentiality measures, in accordance with Articles 24 and 25 of Decree 1377 of 2013. The named list is at Subprocessors.
• Colombia: by accepting this policy you expressly authorize the international transfer and transmission of your data to the United States and the other countries where our processors operate, under Article 26 of Law 1581 of 2012.
• EU/EEA and UK: we use Standard Contractual Clauses or the provider’s Data Privacy Framework certification, depending on the provider (see GDPR).
• Brazil: we use the mechanisms of Article 33 of the LGPD, including the contractual clauses approved by the ANPD where applicable.

11. European Union, EEA, and United Kingdom (GDPR)

If you are in the EEA or the United Kingdom, we process your data on these legal bases: performance of a contract (account and service), legal obligation (billing), consent (waitlist and non-essential cookies), and legitimate interests (security, abuse prevention, and assistant answers).

You have the rights under Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction, notification to recipients, portability, objection, and not to be subject to solely automated decisions, as well as the right to withdraw consent and to complain to your supervisory authority. We have not appointed a representative in the EU or the UK; you can write directly to ceo@neuralos.io. Details are in GDPR.

12. United States (CCPA/CPRA and other state laws)

This section applies to residents of California and other states with comprehensive privacy laws.

Categories of personal information

In the past 12 months we have collected: identifiers (name, email, IP); customer records information (billing data through Stripe); commercial information (plan and purchase history); internet or network activity (technical logs, user agent); and content you provide (workspace content, prompts, messages). The only sensitive personal information we process is account login credentials, and only to authenticate you.

We collect this data from you, your browser, and our payment providers, for the purposes described in this policy, and disclose it only to service providers for business purposes.

We do not sell or share

We do not sell your personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. Nor do we do so with data of consumers under 16. We honor the Global Privacy Control signal.

Your rights

• Know: what personal information we collect, its sources, why, and who we share it with, and obtain a copy.
• Delete the personal information you gave us, subject to legal exceptions.
• Correct inaccurate information.
• Limit the use of sensitive information: we only use it for permitted purposes (authentication), so we do not use it to infer characteristics about you.
• Non-discrimination: we will not deny you service or charge you differently for exercising your rights.
• Appeal: if we deny your request, you can appeal by replying to our decision, where your state’s law provides for it.

How to exercise them

Email ceo@neuralos.io. We will verify your identity by matching the information you provide with what we already hold. You may designate an authorized agent, who must provide your signed permission; we may ask you to confirm your identity directly. We respond within 30 days and, in any case, within the legal period of 45 days, extendable by another 45 where the law allows.

13. Brazil (LGPD)

If you are in Brazil, we process your data under the General Data Protection Law (Law 13,709/2018), on the legal bases of Article 7: performance of a contract, compliance with a legal obligation, consent, and legitimate interest.

You have the rights under Article 18: confirmation that processing exists, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about who we share it with and about the possibility of not consenting, and revocation of consent. You can also request review of automated decisions (Art. 20) and file a petition with the National Data Protection Authority (ANPD).

To exercise them, email ceo@neuralos.io.

14. Security and retention

We apply technical, human, and administrative measures to protect data against tampering, loss, and unauthorized access or use: encryption in transit and at rest, least-privilege access control, per-workspace isolation, and access logging. More information at Security.

We keep data only as long as needed for the purpose that justified processing and to meet legal obligations. Deletion requests are carried out within 30 days, and customer data is deleted up to 90 days after account closure, unless there is a legal duty to keep it.

15. Effective date and changes

This policy is effective as of October 20, 2026. The databases will remain in effect for as long as the purposes described subsist and Klinworks, LLC provides the service, without prejudice to legal retention periods.

Any substantial change (for example, in the identity of the controller or in the purposes) will be communicated at least 30 days in advance by email or in the product before it applies, and where the purpose changes, we will ask for a new authorization.

16. Contact

For inquiries, claims, and exercising any of the rights described, email ceo@neuralos.io.

Controller: Klinworks, LLC (NeuralOS), a Delaware company, USA, file number 10704723.