Plain-language summary
- Klinworks, LLC is the controller of the data of people in the EEA and the UK who use NeuralOS.
- Each processing activity has a specific legal basis: contract, legitimate interests, consent, or legal obligation.
- You have the right to access, rectification, erasure, restriction, portability, and objection, and not to be subject to solely automated decisions.
- Send your requests to ceo@neuralos.io; it is free and we respond within 30 days.
- Transfers to the United States rely on Standard Contractual Clauses or the Data Privacy Framework, depending on the provider.
- You can lodge a complaint with your data protection authority at any time.
This summary helps you understand the essentials. The full text below is what governs.
1. Scope and controller
This document supplements the Privacy Policy for people located in the European Economic Area (EEA), the United Kingdom, and Switzerland, under Regulation (EU) 2016/679 (GDPR), the UK GDPR, and the Data Protection Act 2018.
- Controller: Klinworks, LLC, a Delaware (USA) limited liability company, file number 10704723, which operates NeuralOS.
- Data protection contact: ceo@neuralos.io. We have not appointed a data protection officer or a representative in the EU or the UK; people in the EEA and the UK can write directly to that address.
- When we act as a processor: if a business customer uploads third-party personal data to its workspace, that customer is the controller and we process the data on its instructions and under the data processing agreement (Art. 28 GDPR).
We apply the principles of Article 5: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
2. Legal bases for processing
| Processing | Legal basis | Article |
|---|---|---|
| Account, service delivery, support, and transactional emails | Performance of a contract | 6(1)(b) |
| Sending prompts and content to model providers to generate outputs | Performance of a contract | 6(1)(b) |
| Billing and keeping accounting and tax records | Legal obligation | 6(1)(c) |
| Waitlist and launch notices | Consent | 6(1)(a) |
| Answers from the ATLAS website assistant | Legitimate interest in answering inquiries you start | 6(1)(f) |
| Security, fraud and abuse prevention, technical logs, waitlist IP stored as a salted hash | Legitimate interests | 6(1)(f) |
| Non-essential cookies or storage, if ever enabled | Consent (Art. 5(3) of the ePrivacy Directive and national laws) | 6(1)(a) |
Where we rely on legitimate interests, we have assessed that your interests or rights do not override them; you can object at any time. We never train models on our customers’ private data.
3. Your rights
- Access (Art. 15): learn whether we process your data and get a copy.
- Rectification (Art. 16): correct inaccurate data or complete it.
- Erasure (Art. 17): request deletion; we carry it out within 30 days unless a law requires us to keep the data.
- Restriction (Art. 18): freeze processing while a dispute about accuracy or lawfulness is resolved.
- Notification to recipients (Art. 19): we inform recipients of any rectification, erasure, or restriction.
- Portability (Art. 20): receive the data you gave us in a structured, commonly used, machine-readable format, or have us transmit it to another controller.
- Objection (Art. 21): object to processing based on legitimate interests and, always and without justification, to any direct marketing use.
- Automated decisions (Art. 22): not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
- Withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.
- Complain (Art. 77): to the supervisory authority of your residence, place of work, or place of the alleged infringement.
4. How to exercise your rights
- Email ceo@neuralos.io stating which right you want to exercise and the email address you use with NeuralOS.
- If needed, we will ask for proportionate additional information to verify your identity; we never ask for more than necessary.
- We respond without undue delay and within 30 days. If the request is complex or numerous, the GDPR allows a further two-month extension; we would tell you within the first month and explain why.
Exercising your rights is free. Only if a request is manifestly unfounded or excessive may we charge a reasonable fee or refuse to act, explaining the reason. You can also exercise many rights directly in the app (edit your profile, export or delete content, close your account).
5. International transfers
Klinworks, LLC and most of our providers are in the United States. For each transfer outside the EEA or the UK we use one of these mechanisms, depending on the provider:
- EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss framework), where the provider is certified, under the European Commission’s adequacy decision of July 10, 2023.
- Standard Contractual Clauses of the European Commission (Decision 2021/914), with the UK International Data Transfer Addendum and Swiss adaptations, where the provider is not certified or as an additional safeguard.
We assess the impact of each transfer and apply supplementary measures such as encryption in transit and at rest. You can request a copy of the applicable safeguards by emailing ceo@neuralos.io. The list of providers and their country is at Subprocessors.
6. Processors, security, and data breaches
We only use processors that provide sufficient guarantees and with whom we have a contract compliant with Article 28. We give at least 30 days’ notice before adding a new one. The full list is at Subprocessors.
We apply technical and organizational measures appropriate to the risk (Art. 32), described in Security. We carry out data protection impact assessments (Art. 35) when processing is likely to result in a high risk, for example when giving AI agents access to personal data.
If a personal data breach occurs:
- We notify the competent supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk (Art. 33).
- We inform you without undue delay if it is likely to result in a high risk to your rights and freedoms (Art. 34).
- We document the facts, their effects, and the remedial action taken.
7. Artificial intelligence and automated decisions
NeuralOS uses AI models to generate the outputs you request; we do not use AI to make decisions about you with legal or similarly significant effects. Your prompts and outputs are sent to model providers only to generate the response and are never used to train models.
AI outputs may contain inaccurate personal data. If that affects you, you can exercise your rights to rectification or erasure, and we will act on them to the extent technically feasible. More information in our AI Policy.
8. Supervisory authority
You can lodge a complaint with the data protection authority in your country at any time, although we would appreciate the chance to resolve it first if you write to us.
- EEA: the list of authorities is on the European Data Protection Board website: edpb.europa.eu.
- United Kingdom: Information Commissioner’s Office: ico.org.uk.
- Switzerland: Federal Data Protection and Information Commissioner: edoeb.admin.ch.
9. Changes to this document
This document is effective as of October 20, 2026. If we make material changes, we will notify you at least 30 days in advance by email or in the product, and post the new date here.
10. Contact
For any GDPR question or to exercise your rights: ceo@neuralos.io.
Controller: Klinworks, LLC (NeuralOS), Delaware, USA, file number 10704723. See also the Privacy Policy, the Cookie Policy, and the Personal Data Processing Policy.
Provider: Klinworks, LLC, a Delaware (USA) limited liability company, file number 10704723, which operates NeuralOS.