Terms of Service

NeuroVecta Privacy Policy & Terms of Service

Effective date: 22/06/2025  |  Last updated: 10/05/2026

1. About NeuroVecta

NeuroVecta is a cloud-based software-as-a-service (SaaS) platform that enables large-scale aggregation, vectorisation, and AI-assisted retrieval of documents. The Service is provided by NeuroVecta Ltd (UK Company No. 16364444), ("we", "us", "our").

Part A – Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you ("you", "your", "User") use NeuroVecta. It complies with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations 2003 (PECR) for cookies and direct marketing to UK residents
• UK ICO adequacy regulations covering transfers to EU/EEA member states (including Finland)

1.1 What data we collect

1.2 How we collect data

• Directly from you when you register, upload documents, or contact us.
• Automatically via cookies and server logs.
• From your organisation's administrator if they create an account on your behalf.

1.3 Lawful bases for processing

1.4 How we use personal information

1. Account administration and identity verification.
2. Document processing – uploaded files are stored in Azure Blob Storage (UK South) and account records are held in Azure SQL (UK South). Files are converted into text chunks and vector embeddings are generated via Azure OpenAI. Embedding storage and AI request processing are handled on backend infrastructure located in Helsinki, Finland (EU/EEA). Finland is an EU/EEA member state covered by UK ICO adequacy regulations, meaning transfers to this infrastructure carry the same legal protections as processing within the UK.
3. AI retrieval and generation – user queries are processed on our backend servers in Helsinki, Finland (EU/EEA). Queries are embedded and matched against stored vectors to provide context to large language models (LLMs). The original text snippets relating to the matching vectors are re-presented to the LLM; snippets can contain personal data from uploaded documents. Generated answers are cached for audit and abuse monitoring. Persistent document and account data is never written to VPS disk and remains in Azure UK South storage.
4. Security monitoring – anomaly detection, MFA enforcement, and incident response.
5. Service analytics & product research – aggregated, de-identified metrics.
6. Compliance & dispute resolution – audits, regulatory reporting, enforcing these Terms.

1.5 Disclosure & international transfers

We only share personal information with:

• Infrastructure providers – Hetzner Cloud (Helsinki, Finland, EU/EEA) for backend compute and vector storage, under Hetzner's standard Data Processing Agreement included automatically in their terms of service.
• Cloud platform providers – Microsoft Azure (UK South) for document storage, database, identity (Azure B2C), and AI model services (Azure OpenAI) – under Microsoft's Data Processing Agreement and Online Services Terms.
• Payment processors and email/SMS gateways – under written data-processing agreements.
• Professional advisers – lawyers, auditors, insurers, where reasonably necessary.
• Regulators or law-enforcement agencies where required by law.

UK → EEA (Finland) transfers: Backend compute and vector storage operate in Helsinki, Finland. Finland is an EU/EEA member state; the UK ICO has issued adequacy regulations covering the entire EEA. Accordingly, transfers from the UK to our Helsinki infrastructure require no additional transfer mechanism — no UK International Data Transfer Agreement (IDTA) and no Standard Contractual Clauses are needed.

UK → non-EEA transfers: Where sub-processors operate outside the EEA (for example, certain Microsoft Azure OpenAI infrastructure components), transfers are governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with robust technical and organisational safeguards (TLS 1.3, AES-256 encryption at rest).

1.6 Security

• End-to-end TLS 1.3
• AES-256 encryption at rest
• Role-based access control and Azure B2C multi-factor authentication
• ISO 27001-aligned ISMS

1.7 Data retention

1.8 Your rights

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with the Information Commissioner's Office (ICO). We respond to verified requests within 30 days.

1.9 Cookies & similar technologies

We use cookies for essential functionality (session management, security) and, with your consent, for analytics and marketing purposes to improve your experience and show relevant content.

You have full control over non-essential cookies. You can accept or reject them when you first visit our site, or change your preferences at any time using the button below:

Essential cookies: Always active, required for the website to function.
Analytics & Marketing cookies: Optional, used to understand user behavior and show relevant ads.

1.10 Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children.

1.11 AI data isolation — Azure OpenAI & Azure AI Foundry (Claude)

We use two AI model services, both operated exclusively within Microsoft's Azure infrastructure:

• Azure OpenAI Service — used for text embeddings and AI-assisted content generation. This service operates solely within Microsoft's Azure environment and does not interact with any services run by OpenAI directly (e.g., ChatGPT, openai.com API).
• Azure AI Foundry (Claude) — used for image analysis. Claude is provided by Anthropic but is hosted and operated exclusively by Microsoft on Azure infrastructure. Requests are not sent to Anthropic's own API or servers; Microsoft acts as the data processor under its Azure AI Foundry terms.

All prompts, completions, image inputs, embeddings, and any other data you supply to either service:

• are NOT available to other customers;
• are NOT available to OpenAI or Anthropic;
• are NOT used to improve OpenAI, Anthropic, or any foundation models;
• are NOT used to train, retrain, or improve any Azure-hosted models;
• are NOT used to improve any Microsoft or third-party products or services without your permission or instruction.

Your prompts and image data are processed by our backend in Helsinki (EU/EEA) before being forwarded to the relevant Azure service over an encrypted connection. They are never written to VPS disk.

1.12 Data residency & infrastructure

The table below summarises where each category of data is stored and processed, and the applicable legal basis for any international transfer.

Note on Helsinki processing: Data processed transiently in RAM on the Hetzner VPS (user queries, JWT tokens, document chunks) is never written to VPS disk. All persistent storage remains in Azure UK South. The Hetzner VPS is protected by end-to-end TLS 1.3, a cloud firewall, and Azure Front Door origin validation.

Part B – Terms of Service

2. Acceptance of Terms

By creating an account, accessing, or using the NeuroVecta platform, you agree to these Terms of Service ("Terms"). If you use the Service on behalf of an organisation, you confirm you have authority to bind that organisation.

3. Service Description

NeuroVecta provides document storage, vector embedding, semantic search, and AI-assisted content generation with citation. Features may change over time.

4. Account Registration & Security

• Provide accurate, current, and complete information.
• Keep credentials confidential; you are responsible for all activities under your account.
• Notify us immediately of unauthorised use or security incidents.

5. Acceptable Use

You must not:

1. Upload content that infringes intellectual property, is unlawful, confidential, or violates privacy.
2. Use the Service for AI model training that contravenes export-control or sanctions laws.
3. Probe, scan, or test the vulnerability of any system or network, or bypass security.
4. Introduce malware or interfere with other Users.
5. Use outputs as the sole basis for legally or clinically significant decisions without human review.

8. Fees & Payment (if applicable)

Subscription fees, billing cycles, and taxes are set out in your Order Form or the pricing page. Payments are due in advance. NeuroVecta offers a 30-day guarantee refund policy requestable at support@neurovecta.com.

9. Confidentiality

Each party must protect the other’s confidential information with the same degree of care it uses for its own (but at least reasonable care) and may only use it to perform obligations under these Terms.

10. Warranties & Disclaimers

The Service is provided “as is”. To the maximum extent permitted by law, we exclude all statutory and implied warranties (including merchantability, fitness for purpose, and non‑infringement). AI‑generated content may contain inaccuracies; you should verify outputs before relying on them.

11. Limitation of Liability

Nothing in these Terms limits liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded under applicable law. Subject to the foregoing, each party’s total liability arising out of or in connection with the Service will not exceed:

• For paid subscriptions – 100 % of fees paid in the 12 months before the event giving rise to the claim.

We are not liable for indirect or consequential loss, loss of profits, data, or goodwill.

12. Indemnity

You will indemnify and hold us harmless against claims arising from your:

• breach of these Terms;
• infringement of third‑party IP; or
• unlawful or negligent use of the Service.

13. Termination & Suspension

Either party may terminate for convenience with 30 days’ notice. We may suspend or terminate immediately if you breach these Terms or your use risks security, legal, or regulatory harm. On termination, your access ceases and data will be deleted after the retention period in § 1.7.

14. Changes to Terms

We may update these Terms from time to time. Material changes will be notified at least 14 days in advance. Continued use after changes take effect constitutes acceptance.

15. Governing Law & Jurisdiction

These Terms are governed by the laws of England and Wales and subject to the exclusive jurisdiction of the English courts, without prejudice to any mandatory consumer protection rights under the UK Consumer Rights Act 2015.

16. Dispute Resolution

Prior to commencing court proceedings, the parties will attempt in good faith to resolve disputes by negotiation. If unresolved after 30 days, either party may refer the dispute to mediation under the Centre for Effective Dispute Resolution (CEDR) rules before litigating.

17. Notices

Notices must be in writing and delivered by email with read receipt, courier, or recorded delivery to the addresses in § 1 or your registered billing address.

18. Force Majeure

Neither party is liable for delay or failure to perform due to events beyond reasonable control (e.g., natural disaster, war, governmental action, Internet outage) provided the affected party promptly notifies the other and mitigates.

19. Entire Agreement & Severability

These Terms (including any Order Form) constitute the entire agreement and supersede prior agreements. If any provision is unenforceable, the remainder remains in effect.

20. No Waiver

Failure to enforce a provision is not a waiver of future enforcement.