Privacy Policy

1. Responsible Company

The data controller responsible for data processing on this website is:

2. Contact Information

For privacy-related inquiries, please contact us at:

Email: privacy@neurovexa.us
Phone: +1 307-439-4840
Website: https://neurovexa.us/

3. Personal Data We Collect

When you visit our website, we may collect the following types of data:

• Technical data: IP address, browser type and version, operating system, referrer URL, pages visited, date and time of access.
• Usage data: Interaction patterns, session duration, and navigation behavior.
• Communication data: Information you provide when contacting us (name, email address, message content).
• Mobile / SMS data: If you opt in to SMS — your mobile phone number, consent timestamp, and related opt-in/opt-out records.
• Account data: If applicable in the future — name, email address, and authentication credentials.

We do not currently collect payment or transaction data.

4. Purposes of Processing

We process your personal data for the following purposes:

• Providing, operating, and maintaining our website
• Ensuring the security and stability of our systems
• Analyzing usage patterns to improve our services
• Responding to inquiries and providing support
• Sending SMS messages you have expressly opted in to receive (account notifications, verification codes, security alerts, service updates, and customer support)
• Complying with legal obligations
• Preventing fraud and abuse

5. Legal Bases

Where the EU General Data Protection Regulation (GDPR) applies, we process personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent.
• Contractual necessity (Art. 6(1)(b) GDPR): Where processing is necessary for the performance of a contract or pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR): Where processing is required by law.
• Legitimate interest (Art. 6(1)(f) GDPR): Where we have a legitimate business interest that is not overridden by your rights, such as website security, fraud prevention, and service improvement.

For users in the United States, processing is based on applicable state and federal laws and our legitimate business purposes.

6. Cookies and Tracking Technologies

Our website uses only technically necessary storage:

• Language preference: We store your selected language (English or German) in your browser's localStorage. This is not a cookie and does not track you across websites.

We do not currently use marketing cookies, tracking pixels, or third-party advertising technologies.

Should we introduce additional cookies in the future, we will update this policy and implement appropriate consent mechanisms.

7. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits. This includes:

• IP address (may be anonymized)
• Date and time of the request
• Requested page/resource
• HTTP status code
• Referrer URL
• Browser type and operating system
• Amount of data transferred

This data is collected for security purposes and is not combined with other data sources. It is typically deleted within 30 days.

8. Contact Form

Our website does not currently offer a contact form. If we add one in the future, any data you submit (such as your name, email address, and message) will be processed solely to respond to your inquiry. We will retain this data only as long as necessary to fulfill the purpose of the communication.

9. Customer Accounts

We do not currently offer customer accounts. If this feature is introduced, account data (such as name, email, and login credentials) will be processed for the purpose of providing and managing your account. You would be able to delete your account at any time.

10. Orders and Billing Data

We do not currently process orders or billing information. If we offer paid services in the future, billing data (such as name, address, and payment details) will be processed as required to fulfill orders and comply with tax and accounting obligations. Retention periods will follow applicable legal requirements.

11. Hosting Providers

Our website is hosted by professional hosting providers who process data on our behalf. The hosting provider may collect and process technical access data (as described in the Server Log Files section) to ensure the operation and security of the infrastructure.

The hosting provider acts as a data processor under applicable data protection laws and is contractually obligated to protect your data.

12. Payment Providers

We do not currently integrate any payment providers (such as Stripe or PayPal). If payment processing is introduced in the future, this section will be updated with specific information about the providers used, the data they process, and their privacy policies.

13. Analytics and Statistics

We do not currently use Google Analytics or any other third-party analytics services. If analytics tools are introduced in the future, we will update this policy and implement appropriate consent mechanisms where required.

14. Cloudflare

We use Cloudflare, Inc. as a content delivery network (CDN) and security service. Cloudflare processes certain technical data to route traffic, protect against attacks (DDoS mitigation), and optimize delivery of our website content.

Data processed by Cloudflare may include:

• IP address
• System configuration information
• Technical data about traffic to and from our website

Cloudflare acts as a data processor on our behalf. For more information, see Cloudflare's Privacy Policy.

Cloudflare, Inc. is certified under the EU–U.S. Data Privacy Framework, which provides an adequate level of data protection for transfers from the EU/EEA.

15. Twilio

We use Twilio, Inc. as a messaging service provider to deliver SMS/text messages when you have provided express consent. Twilio may process mobile phone numbers, message content, delivery metadata, and related technical data on our behalf to send, route, and manage SMS communications.

Twilio acts as a data processor / service provider for this purpose. For more information, see Twilio's Privacy Policy.

16. SMS/Text Messaging Privacy

This section applies when you choose to receive SMS/text messages from NEUROVEXA LLC.

Data we collect for SMS

• Mobile phone number
• Record of your express SMS consent (including timestamp and method of opt-in, such as our web form)
• Opt-out requests (for example, STOP replies) and related messaging metadata needed to honor your preferences

How we use SMS data

We use this information solely to:

• Send the SMS categories you consented to: account notifications, verification codes, security alerts, service updates, and customer support
• Document and maintain proof of consent
• Process opt-out and help requests
• Operate and secure our messaging program through our messaging provider (Twilio)

No sale or third-party marketing use

We do not sell, rent, or share your mobile phone number or SMS consent data with third parties for their own marketing or promotional purposes. Mobile numbers and SMS consent records are shared only with service providers that process data on our behalf to deliver and manage SMS messages (such as Twilio), or when required by law.

How consent works

SMS consent is obtained only through an affirmative opt-in action, such as submitting our public SMS Opt-In form with the consent checkbox selected by you. Consent is never implied from website use alone, and consent checkboxes are never pre-selected. Consent is not a condition of purchase.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for assistance. See also our SMS Terms.

17. Third-Party Services

Beyond the services described above, we may use additional third-party service providers to operate our business. Any such providers are selected carefully, are bound by contractual data protection agreements, and process your data only as instructed by us.

We will update this policy when new significant third-party integrations are introduced.

18. Data Sharing

We do not sell your personal data. We do not sell or share mobile phone numbers or SMS opt-in/consent information with third parties for their own marketing or advertising purposes. We may share data with third parties only in the following circumstances:

• With service providers who process data on our behalf (as described in this policy), including Twilio for SMS delivery
• When required by law, regulation, or legal process
• To protect the rights, safety, or property of NEUROVEXA LLC, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice to affected users)

19. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS/SSL encryption for data in transit
• Access controls and authentication mechanisms
• Regular review of our security practices
• Use of reputable hosting and CDN providers

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

20. Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Specific retention periods include:

• Server logs: Up to 30 days
• Communication data: Until the purpose of the communication is fulfilled, then deleted within 12 months
• SMS consent and mobile numbers: For as long as you remain opted in, and thereafter as needed to honor opt-outs and maintain compliance records
• Legal obligations: As required by applicable tax, commercial, or regulatory laws (typically 6–10 years)

When data is no longer needed, it is securely deleted or anonymized.

21. International Data Transfers

NEUROVEXA LLC is based in the United States. If you access our website from outside the United States (including from the EU/EEA), your data may be transferred to and processed in the United States.

Where required, we rely on appropriate safeguards for international transfers, such as:

• EU–U.S. Data Privacy Framework certifications
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Your explicit consent where applicable

22. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right of access: Request confirmation of whether we process your data and obtain a copy.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data under certain conditions.
• Right to restriction: Request that we limit processing of your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@neurovexa.us. We will respond within the timeframe required by applicable law.

23. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights:

• Right to know: You may request information about the categories and specific pieces of personal information we have collected.
• Right to delete: You may request deletion of your personal information.
• Right to opt-out of sale: We do not sell personal information. No opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to correct: You may request correction of inaccurate personal information.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined by the CPRA.

To exercise your California privacy rights, contact us at privacy@neurovexa.us. We will verify your identity before processing your request.

24. EU/EEA Privacy Rights (GDPR)

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with the rights described in the "Your Rights" section above.

Additionally:

• You have the right to lodge a complaint with a supervisory authority in your member state.
• Where processing is based on consent, you may withdraw consent at any time.
• You may object to processing based on our legitimate interests, and we must demonstrate compelling grounds to continue.

Our legal representative for data protection matters in the EU can be contacted at privacy@neurovexa.us.

25. Children's Privacy

Our services are not directed at children under the age of 16 (or 13 in certain jurisdictions). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

If you believe that a child has provided us with personal data, please contact us at privacy@neurovexa.us.

26. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make significant changes, we will update the "Effective Date" at the top of this page.

We encourage you to review this page periodically. Continued use of our website after changes constitutes acceptance of the updated policy.

27. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: