Privacy Policy

Last updated: August 16, 2026

1. Information We Collect

When you use neuralbox.ru, we may collect:

• Account information: name, email, avatar, and provider ID from your OAuth provider (Google, Yandex, VK, GitHub, Telegram, TikTok), or your email address if you signed up via one-time code. Where you sign in with Telegram, we also receive your Telegram user ID, username and — if you grant it — your phone number.
• Usage data: generation requests, prompts, uploaded files, generated results, API usage, payment history, and token balance.
• Technical data: IP address, browser type, and device information for security, fraud prevention and analytics.
• Analytics data: pages visited, referrer, interactions with the interface, and — through Yandex.Metrica Webvisor — a recording of your interaction with our pages. See section 9.

2. Legal Basis for Processing

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases:

• Performance of a contract — creating and running your account, processing your generation requests, keeping your history and token balance, handling payments.
• Legal obligation — retaining accounting and tax records.
• Legitimate interests — securing the Service, preventing fraud and abuse, and understanding aggregate usage so we can improve the product.
• Consent — analytics and session recording, where consent is required in your jurisdiction. You may withdraw consent at any time; withdrawal does not affect processing carried out before it.

For users in Russia, processing is carried out under Federal Law No. 152-FZ on Personal Data. For users in India, under the Digital Personal Data Protection Act, 2023.

3. How We Use Your Information

• Provide and maintain the Service, including generation history and balance tracking.
• Process payments and manage your token balance.
• Prevent fraud, abuse, and enforce our Terms of Service.
• Improve the Service and develop new features.
• Send important service notifications (not marketing).

4. Data Storage and Retention

We keep each category of data only as long as it serves the purpose it was collected for, or as long as the law requires. Concretely:

• Account data (name, email, avatar, provider ID, phone) — for as long as your account exists. On deletion it is erased or anonymised within 30 days.
• Generation history and generated files (prompts, parameters, images, audio, video) — retained for as long as your account exists, with no automatic expiry, because this history is the product: you can browse, re-download and export it. You can delete individual generations at any time, and you can request full erasure (section 8).
• Uploaded files — stored in S3-compatible cloud storage and deleted together with the generation record they belong to.
• Payment and transaction records — 5 years from the end of the reporting year for neuralbox.ru (Russian accounting and tax law), 6 years for neuralbox.io (UK tax law). These survive account deletion in minimised form — amount, date, order reference — and contain no prompts or generated content.
• Technical and security logs (including IP addresses) — up to 90 days, then deleted automatically.
• API request records — 12 months.
• One-time login codes — the code itself expires in 10 minutes; the record is deleted within 30 days.
• Analytics data — retained by the analytics providers under their own policies; for Google Analytics we have set user-level retention to 14 months.

5. Third-Party Services

We use third-party services to provide the Service:

• AI model providers: your prompts and uploaded files may be sent to third-party AI providers (e.g. Kie.ai, PiAPI, GoAPI, Suno, HeyGen, OpenAI, Anthropic, Google, AtlasCloud, ElevenLabs) for processing. These providers have their own privacy policies.
• OAuth providers: we receive limited profile information from your chosen login provider.
• Payment processors: payment data is handled by T-Bank, Robokassa, YooKassa, Stripe, CryptoCloud, or NOWPayments. We do not store your card details.
• Cloud storage: generated content and uploads are stored on S3-compatible cloud storage (Selectel, with optional Cloudflare CDN).
• Analytics: Yandex.Metrica (Yandex LLC), including its Webvisor session-recording feature, and Google Analytics 4 together with Google Tag Manager (Google LLC / Google Ireland Ltd). See section 9.

6. International Transfers

Our servers are located in Russia. Depending on which features you use, your data may also be processed in the European Union, the United Kingdom, the United States and other countries where our AI providers, payment processors and analytics providers operate. Analytics data collected through Yandex.Metrica is processed in Russia; data collected through Google Analytics is processed in the United States and other countries where Google operates.

Where such a transfer is made from the EEA or the UK, we rely on the transfer mechanisms available to us under Chapter V of the GDPR, including standard contractual clauses concluded with our processors. If you would like details of the safeguards applied to a specific transfer, contact us at the address in section 13.

7. Data Sharing

We do not sell your personal data. We may share data only:

• With third-party AI providers to process your generation requests.
• With payment processors to handle transactions.
• When required by law or legal process.
• To protect our rights, safety, or property.

8. Your Rights

You can exercise the following rights free of charge, and we will not ask you to justify your request:

• Access your personal data through your profile and generation history, or ask us for a copy.
• Erasure — delete individual generations yourself at any time, or ask us to delete your account together with your generation history and stored files.
• Rectification of inaccurate data.
• Portability — export your generation history.
• Objection and restriction — object to processing based on our legitimate interests, or ask us to restrict processing while a dispute is resolved.
• Withdraw consent to analytics at any time (section 9).

How to make a request

Write to support@neuralbox.ru (for neuralbox.io: support@neuralbox.io) from the email address linked to your account, or from the account itself if you signed in with Telegram, and tell us which account and what you want removed. We ask this only to confirm that the request comes from the account holder — deleting another person's data on an unverified request would itself be a breach.

We complete verified requests within 30 days and confirm in writing once the deletion is done. Where we cannot delete something — see the retention periods in section 4 — we will tell you precisely what is retained and on what legal basis.

Content you have already downloaded, shared or published elsewhere is outside our control, and deletion on our side cannot reach those copies.

If you believe we have handled your data improperly, you may complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national data protection authority; in Russia, Roskomnadzor; in India, the Data Protection Board.

9. Cookies, Local Storage & Analytics

We use browser local storage for data that is strictly necessary to run the Service:

• Authentication token (JWT);
• Language preference;
• Theme preference (dark/light).

We also use third-party analytics, which set their own cookies and identifiers:

• Yandex.Metrica (counter 109683401) — traffic statistics, click maps and Webvisor, which records your interactions with our pages (clicks, scrolling, form input, mouse movement) so we can find usability problems. Webvisor masks form field contents by default. Yandex privacy policy · opt out.
• Google Analytics 4 (G-JVGWVDSTZ4) and Google Tag Manager — aggregate traffic and usage statistics. Google privacy policy · opt-out browser add-on.

We do not use these tools for advertising, and we do not sell or share the data they collect with advertisers. You can block analytics with any standard browser setting, tracker blocker or the opt-out links above; the Service works normally with analytics blocked.

10. Security

We implement reasonable security measures including HTTPS encryption, JWT authentication, and secure API key management. However, no method of transmission over the Internet is 100% secure.

11. Children

The Service is not intended for children under 16, and — for users in India, where the Digital Personal Data Protection Act sets a higher threshold — not for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy at any time. We will notify users of significant changes through the Service. The date at the top of this page shows when it was last revised.

13. Contact

For privacy-related questions, or to exercise any of the rights in section 8, contact us at support@neuralbox.ru (neuralbox.io: support@neuralbox.io). The data controller for each domain is named at the bottom of this page.