Privacy Policy

1. Who we are and scope

This Privacy Policy explains how Klinworks, LLC, a limited liability company organized in the State of Delaware, USA, file number 10704723 ("NeuralOS," "we," "us"), processes personal data when you visit neuralos.io, join the waitlist, chat with the ATLAS assistant on our website, or use the platform.

• It applies to all visitors and users, on free and paid plans.
• We are the controller of account, billing, waitlist, assistant, and technical data.
• When a business customer uploads third-party data to its workspace, that customer is the controller and we act as a processor; in that case the data processing agreement (DPA) signed with that customer prevails.
• Jurisdiction-specific documents supplement this policy: GDPR (EEA and UK) and the Personal Data Processing Policy (Colombia, United States, and Brazil).

For any privacy matter, the single point of contact is ceo@neuralos.io.

2. Data we collect

We do not intentionally collect special categories of data (health, biometrics, beliefs, etc.). Please do not upload them to the platform unless it is essential and you have a legal basis to do so.

3. How we use data and our legal bases

You can withdraw consent at any time without affecting the lawfulness of prior processing. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

4. Artificial intelligence and model training

We never train models on our customers’ private data. Your content, prompts, and outputs are not used to train our own or third-party models.

• To generate outputs, your prompts and the necessary content are sent to model providers (Anthropic (Claude), OpenAI, Google (Gemini) and the others listed under Subprocessors), which process them on our behalf under their API customer terms.
• AI outputs can be inaccurate, including when they mention people. If an output contains incorrect personal data about you, you can ask us to correct or delete it to the extent technically feasible.
• We may use aggregated, anonymized metrics (for example, number of runs or response times) to operate and improve the service; those metrics do not identify you.

More details in our AI Policy.

5. Waitlist and ATLAS assistant

Waitlist

When you join, we store your email, what you want to build, the agent team you chose, the source of your visit, your language, the referrer, and your user agent. Your IP address is not stored in plain text: we keep only a salted hash, which helps us stop abusive sign-ups without being able to reconstruct the IP. We use this data to notify you about launch and give you access. You can unsubscribe from any email or by writing to ceo@neuralos.io.

ATLAS assistant

Messages you type to ATLAS on the website are processed to answer you. If the answer is generated by an external model through OpenRouter, the text of your question is sent to that provider to obtain the answer. Your browser keeps a local copy of the conversation (see the Cookie Policy), which you can clear with the reset button. Do not enter sensitive data or third-party information into the assistant.

6. Who we share data with

We only share personal data in these cases:

• Service providers (subprocessors) we need to operate: hosting, database, payments, email, error monitoring, and AI models. Currently: Supabase, Inc., Vercel, Inc., Railway Corporation, Cloudflare, Inc., Stripe, Inc., Resend (Plus Five Five, Inc.), Functional Software, Inc. (Sentry), Anthropic, PBC, OpenAI, L.L.C., Google LLC, OpenRouter, Inc., ElevenLabs, Inc., Replicate, Inc. · Fal (Features & Labels, Inc.). The full list, with purpose and data processed, is at Subprocessors.
• Integrations you connect (for example, a repository or an external tool): only with the data you authorize.
• Legal obligation: when a law, court order, or competent authority requires it, after checking that the request is valid.
• Corporate transactions: in a merger, acquisition, or asset sale, with safeguards equivalent to this policy and prior notice.

We do not sell your personal data or share it for cross-context behavioral advertising. We treat the Global Privacy Control (GPC) signal as a valid opt-out request. We will give you at least 30 days’ notice before adding a new subprocessor.

7. International transfers

Klinworks, LLC is organized in the United States, and most of our providers process data in the United States. When we transfer data from the EEA, the United Kingdom, or Switzerland, we rely on recognized mechanisms:

• the European Commission’s Standard Contractual Clauses (2021);
• the provider’s certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where the provider is certified;
• the UK International Data Transfer Addendum and the adaptations required by Swiss law.

For transfers from Colombia and Brazil, see the Personal Data Processing Policy.

8. How long we keep data

We may keep certain data longer if a law requires it, to defend against claims, or to record that we fulfilled your own deletion request.

9. Your rights

Depending on where you live, you have the right to access, correct, delete, and port your data, to restrict or object to its processing, to withdraw consent, and to complain to an authority.

• EEA, United Kingdom, and Switzerland: see GDPR.
• Colombia (Law 1581 of 2012), United States (CCPA/CPRA and other state laws), and Brazil (LGPD): see the Personal Data Processing Policy.

To exercise them, email ceo@neuralos.io from the address linked to your account or tell us the email you signed up with. We may ask for additional information to verify your identity. We respond within 30 days and will not discriminate against you for exercising your rights. Many actions (editing your profile, exporting or deleting content) you can also do directly in the app.

10. Security

We apply technical and organizational measures proportionate to the risk: encryption in transit (TLS) and at rest, least-privilege access control, per-workspace data isolation, access logging, and anti-abuse protection. No system is infallible; if a security breach affects your data, we will notify authorities and affected individuals where the law requires (under the GDPR, within 72 hours to the authority where applicable).

More information at Security.

11. Children

NeuralOS is intended for people aged 18 or older. We do not knowingly collect data from minors. If you believe a minor has provided us with data, email ceo@neuralos.io and we will delete it.

12. Cookies and local storage

The public website only uses cookies and storage that are strictly necessary or that serve a feature you request (language, session, your cookie choice, the ATLAS conversation). We currently load no third-party analytics or marketing; if any are added, they will only be enabled with your consent through the banner. Details are in the Cookie Policy.

13. Changes to this policy

This policy is effective as of October 20, 2026. If we make material changes, we will notify you by email or in the product at least 30 days in advance; minor changes (for example, wording) are posted on this page with a new date.

14. Contact

Controller: Klinworks, LLC (NeuralOS), a Delaware company, file number 10704723.

• Privacy and rights requests: ceo@neuralos.io
• EU Digital Services Act point of contact and abuse reports: ceo@neuralos.io

If you are in the EEA or the United Kingdom, you can send your requests directly to that address, and you have the right to lodge a complaint with your supervisory authority.