Legal · privacy
Privacy policy
Draft, pending reviewThis is a plain-language draft written before legal review. It describes what the site actually does today. Last updated 2026-11-11.
The short version
- If you join the waitlist, we keep your email address and the few answers you give us, and use them only to tell you about this book and its simulator.
- If you buy something, Paddle (our reseller) handles the payment. We keep your email, what you bought and what you downloaded, so we can deliver your files and honour refunds. We never see your card details.
- We do not sell your data, share it for advertising, or use advertising or cross-site tracking cookies.
- We count clicks and page views without cookies and without storing your IP address. The only cookie is a sign-in cookie for your download library, set when you open a library link.
- You can unsubscribe, see your data, or have it deleted by emailing [email protected].
Who we are
The site is run by NeuralyAI (founder-operated, Dhaka, Bangladesh), which publishes books as NeuralyAI Press. For data-protection law we are the “controller” of the data described here. Contact: [email protected].
What we collect and why
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address | You join the waitlist | To send early-access news (about one email a month) and the pre-order link | Your consent, Art. 6(1)(a) |
| Role (optional) and the “working FDE” checkbox | You join the waitlist | To understand who the book is for and, if you ticked the box, to ask you once about a 30-minute interview | Your consent, Art. 6(1)(a) |
| Campaign tags (UTM parameters), the referring website’s domain, the page you landed on, the date | You join the waitlist | To know which posts and channels bring readers | Legitimate interests, Art. 6(1)(f) |
| Anonymous events: page views, button clicks (for example “Try the 3D lab”), with page path, referring domain and campaign tags | You use the site | To measure interest in features before we build them | Legitimate interests, Art. 6(1)(f). No cookies, no identifiers, no IP stored |
| Purchase records: your Paddle customer ID, email address, the transaction ID, what you bought, the amounts, tax and currency, and refund or chargeback status. No card or bank details, no billing address | You buy something (Paddle sends us these details) | To deliver your downloads, keep your library working, answer support requests and process refunds | Performance of a contract, Art. 6(1)(b); accounting obligations, Art. 6(1)(c) |
| Library access: what you are entitled to, single-use sign-in link codes, and a download log (which file, when, and a one-way hash of your IP address) | You use your library | To give you your files, stop shared or leaked links, and investigate abuse | Performance of a contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| A one-way hash of your IP address, held in 10-minute windows | Any form submission or event | To stop spam and abuse (rate limiting). Raw IP addresses are not stored; hashes are deleted after about 24 hours | Legitimate interests, Art. 6(1)(f) |
We do not ask for, and ask you not to send, sensitive information. The book’s case study is fictional, and nothing on this site collects health data.
Cookies and analytics
The site sets one cookie, and only after you open a library sign-in link: nai_lib, a strictly necessary sign-in cookie for your download library. It is HttpOnly, sent only to our own /api address, and expires after 2 hours. It contains a signed customer number, not your email address. No other cookies are set by us. It remembers your light/dark theme choice in your browser’s local storage and keeps campaign tags for the current tab in session storage; neither leaves your device except as part of a form you submit. If you join the waitlist, the email you typed is kept in session storage for that tab so the checkout can be pre-filled; it is cleared when you close the tab.
When you click a buy button, the page loads Paddle’s checkout script from cdn.paddle.com and opens Paddle’s checkout. Paddle may set its own cookies inside the checkout, under Paddle’s privacy policy. Pages without a buy button, including every lab page, never load it.
No third-party analytics scripts run on the site. If we add a cookieless, privacy-focused service (such as Plausible), we will list it here first.
Who processes the data for us
- Cloudflare, Inc. hosts the site and the database (Cloudflare Pages and D1). Cloudflare processes request data, including IP addresses, to deliver and protect the site.
- Cloudflare R2 stores the files you download, in a private bucket.
- Paddle (Paddle.com Market Ltd and affiliates) is our reseller and Merchant of Record. It runs the checkout, takes payment, calculates tax and issues receipts and refunds. Paddle is an independent controller for the payment data it collects, under its own privacy policy. We never see your card details.
- Resend (Resend, Inc.) sends our transactional emails: purchase confirmations, library sign-in links and new-version notices. It processes your email address and the message content.
- An email service for the waitlist newsletter has not been chosen yet; we will name it here before the first newsletter is sent.
International transfers
We operate from Bangladesh, and our providers run servers in many countries, including the United States. Where data protected by EU or UK law leaves those areas, we rely on our providers’ standard contractual clauses or equivalent safeguards.
How long we keep it
- Waitlist data: until you unsubscribe or ask for deletion, and in any case no longer than 12 months after the book’s v1.0 release unless you have bought something or asked to stay on the list.
- Anonymous events: up to 24 months, then deleted or aggregated.
- Rate-limiting hashes: about 24 hours.
- Purchase records (customer, purchases, entitlements, refunds): for as long as you can use what you bought, and at least 6 years after the purchase for accounting and tax records (UNVERIFIED period; to be confirmed by an adviser). Paddle keeps its own records as the seller.
- Download log: 12 months, then deleted.
- Single-use sign-in codes: deleted after the link expires (15 minutes); the sign-in cookie lasts 2 hours.
- Webhook event records (event ID, type and time only, no payload): 24 months.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time (this does not affect anything we did before). Email [email protected]; we will reply within 30 days. Every email we send will include an unsubscribe link. If you are in the EU, UK or another region with a data-protection authority, you can also complain to that authority.
Children
The site is for working professionals and is not directed at children under 16. We do not knowingly collect their data.
Changes
If we change this policy, we will update the date at the top. If a change affects how we use the email you gave us, we will tell you by email first.
Open items before this draft is final
- Confirm the legal entity name and postal address of the controller.
- Name the newsletter email provider; confirm Resend’s and Paddle’s transfer safeguards (DPAs).
- Confirm the purchase-record retention period with an adviser (Bangladesh and EU/UK accounting rules) and set up the scheduled deletion of download logs.
- Check obligations under Bangladesh law (UNVERIFIED) and whether an EU/UK representative is needed (GDPR Art. 27).
- Adviser review of legal bases and retention periods.