Skip to main content
NeuroBrixNeuroBrix

Legal

Effective 2026-04-30

Privacy Policy

Version 2026-11-08 · Last updated 2026-11-08

1. Controller

The data controller for the personal data processed through the NeuroBrix Hub is Hocine Benkelaya, the author and sole owner of NeuroBrix. WizWorks OÜ (Estonia) distributes NeuroBrix commercially under licence and does not process personal data of Hub users. The project is supported and funded by Neural Network Holding Ltd. Contact: [email protected].

2. Data we collect

2.1 Account data

When you register, we collect your name, email address, password (hashed with Argon2id — never stored in plain text), and optionally a username/handle. If you sign in with GitHub or Google, we receive your email address, your display name, and your avatar URL from that provider.

2.2 Consent records

We store the version number and timestamp of the Terms and Privacy Policy you accepted, plus your marketing preference, so we can prove a lawful basis for our processing.

2.2b Licence acceptance

Every model is delivered under its own licence. When you download a model from the website while signed in, we record which licence you accepted, for which model, and when, linked to your account. When you accept the licence in the command line client, no account is needed and no acceptance record is stored on your account.

2.3 Usage data

For each download or API call, we record the model identifier, the source (web/CLI/API), the timestamp, and the IP address. This is required to operate the Platform, prevent abuse, and produce aggregated statistics. With each download we also record the name of the client software and the country derived from the IP address on our own server, using the IP to Country Lite database by DB-IP (licensed under CC BY 4.0); the country is kept when the IP address is anonymised.

2.4 Email events

For deliverability, we keep a log of transactional emails we sent you, including the template, subject, status (sent/bounced/complained), and the provider message ID. We use these events to suppress sending to addresses that bounced or marked our messages as spam.

2.5 Cookies

We use strictly-necessary cookies for authentication (your session) and a small dismissable banner cookie (cookieNoticeDismissed). We do not currently use analytics, advertising, or third-party tracking cookies. If we ever introduce them, we will ask for your consent first.

3. Why we use your data (lawful bases)

  • Performance of a contract (Art. 6(1)(b) GDPR): create and operate your account, deliver downloads, send transactional emails (verification, password reset, deletion confirmation, data export).
  • Legitimate interest (Art. 6(1)(f) GDPR): preventing abuse, securing the Platform, troubleshooting incidents, producing aggregate non-identifying statistics.
  • Consent (Art. 6(1)(a) GDPR): newsletter and marketing communications. You can withdraw consent at any time from your account or by clicking unsubscribe.
  • Legal obligation (Art. 6(1)(c) GDPR): retaining records to comply with applicable laws (tax, fraud, security incident reporting).

4. Who has access to your data

  • Inside NeuroBrix: only the operators (admins) of the Platform, on a strictly need-to-know basis.
  • Sub-processors we rely on:
    • Brevo (sib.email SAS, France) — sending transactional and marketing emails. Brevo offers a Data Processing Agreement compliant with the GDPR.
    • Our hosting infrastructure within the European Union — VPS, PostgreSQL, MinIO object storage. Data does not leave the EU during normal operation.
    • OAuth providers you choose to use (GitHub, Google) — they provide only the minimum profile information needed to sign you in.

We never sell your personal data and we do not share it for advertising purposes.

5. International transfers

Our infrastructure is located in the European Union. If we ever need to transfer personal data outside the EU/EEA, we will rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and update this Policy to disclose those transfers.

6. How long we keep your data

  • Account data: kept for as long as your account is active. Upon deletion (see below), data is soft-deleted for 30 days, then permanently erased.
  • Download/audit logs: 12 months for security and abuse prevention, after which they are anonymised.
  • Email delivery events: 12 months for deliverability hygiene.
  • Records required by law (e.g. tax invoices when paid services launch): the duration imposed by the applicable law.

7. Your rights under the GDPR

You have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have your data erased — “right to be forgotten” (Art. 17);
  • restrict processing (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interest, including profiling (Art. 21);
  • withdraw consent at any time (Art. 7) without affecting the lawfulness of processing carried out before withdrawal;
  • lodge a complaint with your national data protection authority.

You can exercise most of these rights directly from /account/privacy in your account. For everything else, write to [email protected].

8. Security

Passwords are hashed with Argon2id. All traffic to the Platform uses HTTPS. Access to the database and object storage is restricted to the application servers on a private network. We log administrative actions to detect anomalies.

9. Children

The Platform is not intended for users under 16 (or the minimum digital consent age in your country if higher). We do not knowingly collect personal data from children. If you believe a child has signed up, please contact us so we can remove the account.

10. Changes to this Policy

We may update this Policy. The new version will appear here with an updated effective date. For material changes, we will notify signed-in users with a notice on the site and, where you subscribed to our newsletter, by email. A privacy policy informs you; it is not something you sign, so we do not ask you to re-accept it. Re-acceptance applies only to the Terms of Use and to model licences, if they change.

Version history

  • 2026-11-08 — §1: the data controller is Hocine Benkelaya, author and sole owner of NeuroBrix; WizWorks OÜ is named as commercial distributor, not as operator. §2.3: each download also records the client name and the country derived from the IP locally (DB-IP Lite, CC BY 4.0); the country is kept after the IP is anonymised.
  • 2026-11-06 — §2.2b added: the user identifier is recorded with each model-licence acceptance.
  • 2026-04-30 — Initial published version.

11. Contact

Email [email protected] for any privacy question or to exercise your rights.