Website Privacy Policy

At a glance

This website provides information, a trailer and three separate email signups. We use service providers for hosting, communications and analytics, and will use AI-assisted analysis as described below. We never sell personal data or share it for cross-context behavioural advertising. Joining a mailing list does not create an ecosystem account. You can unsubscribe or ask about your data without creating an account.

Who is responsible

Neural Music OÜ is the controller for personal data handled through https://neural-music.com, its newsletter, ecosystem waitlist, Inner Sound notification and related enquiries. Estonian registry code: 17427530. Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia.

Privacy and general enquiries: contact@neural-music.com. Individual support: team@neural-music.com.

This policy covers the website only. The Neural Music ecosystem will have its own privacy policy. The website currently takes no payments.

Information We Collect

Information we collect falls into one of two categories: “voluntarily provided” information and “automatically collected” information.

“Voluntarily provided” information refers to any information you knowingly and actively provide us when using or participating in any of our services and promotions.

“Automatically collected” information refers to any information automatically sent by your devices in the course of accessing our products and services.

Log Data

When you visit our website, our servers may automatically log the standard data provided by your web browser. It may include your device’s Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

Additionally, if you encounter certain errors while using the site, we may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem. You may or may not receive notice of such errors, even in the moment they occur, that they have occurred, or what the nature of the error is.

Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.

Device Data

When you visit our website or interact with our services, we may automatically collect data about your device, such as:

• Device Type

• Operating system

• Browser type and version; approximate country or region inferred from IP address (not GPS)

Data we collect can depend on the individual settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.

Personal Information

We may ask for personal information - for example, when you submit content to us, when you subscribe to our newsletter or when you contact us — which may include one or more of the following:

• Name

• Email

• Subscription choices, signup time and source page, consent and confirmation records, delivery and withdrawal records, messages and attachments

Legitimate Reasons for Processing Your Personal Information

We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.

How we use information

We use website and communication data to deliver and secure the website and trailer, manage email subscriptions, respond to enquiries, keep consent and withdrawal records, and understand and improve our services. This includes the AI-assisted analysis explained below. Please avoid sending sensitive information that is unnecessary for your enquiry.

Your email choices

• Newsletter: writing on musical identity, the creative process and Neural Music news.

• Ecosystem waitlist: communications about your requested access.

• Inner Sound: the pre-order announcement and necessary delivery follow-up.

These are separate subscriptions. Confirming your address does not add an unrequested subscription. You can unsubscribe from one category or all marketing emails using the links provided, or contact us. Browsing does not require a signup; an email address is necessary for requested email communications.

Security

We apply technical and organisational safeguards appropriate to the risks, including restricting access to people who need the information for their work. No online service can guarantee absolute security. We assess personal data breaches and notify the supervisory authority and affected people where required by law.

How long we keep information

• Newsletter records: While subscribed, until withdrawal or the newsletter ends. Chosen newsletter; HubSpot.

• Ecosystem waitlist records: Until access is fulfilled, the request is withdrawn or the waitlist is cancelled. Requested access communications; HubSpot.

• Inner Sound notification records: Remove unnecessary book-notification data within 60 days after the announcement and necessary delivery follow-up are complete. Pre-order announcement; HubSpot.

• Unconfirmed requests: Expire after 60 days; remove unnecessary pending-request data within the following 7 days. Address confirmation and abuse prevention; HubSpot.

• Enquiries and correspondence: Up to 24 months after the enquiry closes. Reply and follow up; Fastmail and HubSpot.

• Email engagement records: Up to 12 months from each event, then delete or anonymise; sooner if no longer needed. Evaluate email performance; HubSpot.

• Minimal consent evidence: While the subscription is active, then up to 3 years after the later of the last relevant email or withdrawal. Demonstrate subscription choices; HubSpot.

• Suppression records: Only the minimum identifier and opt-out information while needed to prevent accidental re-subscription or sending. Prevent unwanted email; HubSpot.

Ending one subscription does not end another you separately requested. Identifiable AI summaries, reports, exports and working copies follow the relevant underlying retention rule; creating a copy does not restart the period. We remove separate working copies when the analysis is complete and they are no longer needed.

We retain only relevant records longer where necessary for a specific legal obligation, complaint or claim, with access restricted to that purpose. Genuinely anonymous statistics can be kept for longer.

Technical and recovery records have separate lifetimes. Fastmail retains system logs for 375 days; its seven-day deleted-item recovery period is not a guarantee that all backup copies have been erased. Framer and software-delivery logs are retained for service operation, security and legal requirements under the relevant provider terms. Deletion from active systems and removal from protected recovery copies can occur at different times.

Children’s Privacy

This website is not directed to children under 13. Our signup forms do not verify age. If you believe a child has provided personal information without authorisation required by applicable law, contact contact@neural-music.com so we can assess and address it.

Where valid parental authorisation is required for consent-based processing, we must obtain it or stop that processing. The applicable age and requirements depend on the relevant law; this policy does not assume that one age threshold applies everywhere.

Who receives information

We use these providers for the purposes described in this policy. Their own privacy notices explain their practices; these links do not replace our responsibility for your information.

• Framer: website hosting, delivery and built-in statistics.

• HubSpot: signup and CRM records, subscription preferences, consent records, email delivery, engagement measurement and AI-assisted analysis.

• Mux: trailer delivery and thumbnails.

• Fastmail: enquiries and support correspondence, including messages and attachments.

• jsDelivr: delivery of video-player software and the technical request information this requires.

• OpenAI and Anthropic: AI-assisted analysis as described below. Identifiable information is used only through suitable business services and data-processing terms.

We use GetTerms to prepare and maintain this notice. If you follow a link to a policy hosted by GetTerms, that service receives the technical information needed to load its page.

Authorised team members and providers access information needed for their work. We may disclose relevant information to meet legal obligations or establish, exercise or defend legal claims. We never sell personal data or share it for cross-context behavioural advertising.

Your choices and rights

You can browse without signing up. An email address is needed for a subscription or reply, but providing it does not authorise unrelated processing. This notice is not a blanket consent request.

You may request access, correction, erasure, restriction and, where applicable, a portable copy of your personal data. Erasure has legal exceptions. You may object to processing based on legitimate interests for reasons relating to your situation; we must stop unless compelling overriding grounds or legal claims justify continuing. You can withdraw consent without affecting earlier lawful processing.

You may object to direct marketing at any time, including related profiling, and we will stop that use. Use an email unsubscribe or preference link, or contact us. This does not prevent a reply to a separate enquiry or privacy request. Tracking consent can be withdrawn separately from an email subscription.

These protections apply to the processing covered by this policy wherever you live. We serve people internationally, including in the UK, US, Canada, Australia and Brazil. Your local law may provide additional rights, such as using an authorised agent, appealing our response, or opting out of targeted advertising and certain profiling. We handle requests under the law that applies and explain any lawful limitation. We do not penalise people for exercising privacy rights.

Write to contact@neural-music.com to make a request, raise a concern or appeal a response. No ecosystem account is required. We respond without undue delay and within one month, or sooner where applicable law requires. Where a legal extension is available, we explain why and the revised deadline within the required period. Requests are normally free; identity checks, any fee or refusal must be lawful and proportionate.

You can complain directly to Estonia’s Data Protection Inspectorate or another competent authority, including the UK Information Commissioner, Australia’s OAIC, Canada’s Privacy Commissioner, Brazil’s ANPD or the relevant US state authority where applicable. You do not have to complain to us first unless the applicable procedure requires it.

Organisational Changes

We do not treat your personal data as a product to sell. An organisational change does not provide permission to repurpose your data, add you to unrelated mailing lists or disregard your privacy rights.

If a reorganisation requires a lawful change of controller or service provider, any transfer must be necessary, limited to the relevant purposes and subject to applicable safeguards and transparency duties. We will provide the information required by law about material changes. This notice is not advance consent to an unrestricted transfer or a new use of your data.

Limits of Our Policy

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.

If required by law, we will get your permission or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal information.

Legal bases, analytics and AI

Legal bases

Under the GDPR, we rely on:

• Consent (Article 6(1)(a)): your chosen email subscriptions and optional measurement where consent is required.

• Legitimate interests (Article 6(1)(f)): delivering and securing the website, preventing abuse, managing requested communications, respecting opt-outs and carrying out proportionate internal analysis to understand enquiries and improve our services. We balance these interests against your rights.

• Steps you request before a contract (Article 6(1)(b)): responding where necessary to a specific pre-contract enquiry.

• Legal obligations (Article 6(1)(c)): handling privacy requests and complying with specific record-keeping duties.

Analytics and browser storage

Framer provides built-in website statistics from technical request information using a daily rotating identifier, without persistent analytics cookies. We use these limited statistics to understand and improve the website, based on our legitimate interests.

Mux provides trailer and thumbnail delivery. Video, thumbnail and player-software requests can begin when the player loads, before you press Play. These requests include the technical information required to deliver the player and video. Optional Mux playback analytics and analytics cookies are disabled.

HubSpot measures email opens, clicks and associated recipient information only when email-tracking consent has been given. An unspecified or declined tracking choice is not tracked. Use the email preference page to allow or withdraw tracking separately from your subscriptions.

Session storage entries nm-preloader-seen, nm-preloader-switch and nm-preloader-left support introductory and navigation behaviour for the browser session. The local-storage entry nm-synapse-hint-done remembers whether you dismissed the footer interaction hint until you clear it. You can clear stored preferences through your browser.

We do not sell or share information for cross-context behavioural advertising, including for visitors who use Global Privacy Control. We do not otherwise change website behaviour in response to a browser’s “Do Not Track” signal; use the specific privacy choices described here.

AI-assisted analysis

We will use AI to analyse information from website visitors, subscribers and people who contact us, including records in HubSpot. We use the term customer data for these website and communication records. The purposes are to identify recurring questions and interests, summarise correspondence, understand engagement, improve our website and communications, and organise follow-up and ecosystem access requests.

Depending on the task, this involves contact details, subscription choices, messages and lawfully collected interaction history. AI-generated summaries, interest groups or priorities are personal data when linked to you. Grouping or prioritising people by their interests and interactions can constitute profiling. A person remains responsible for individual access decisions; this website does not make solely automated decisions with legal or similarly significant effects.

We will use HubSpot AI and services from OpenAI and Anthropic, including connections to HubSpot. Identifiable information will be processed only through services with suitable business data-processing terms. Personal AI accounts will receive only genuinely anonymised information. We limit inputs to what the task needs, review outputs before acting on them, and apply the retention rules above to identifiable outputs and copies.

This analysis relies on the assessed legitimate interests described above, or consent where required. You can object to legitimate-interest processing and to direct marketing, including related profiling. We have disabled HubSpot’s permission to use our customer data to train its AI models. This is separate from the AI-assisted analysis we carry out. Our team also uses AI to help create website content and images. Private ecosystem conversations, profiles and projects are outside this policy.

International processing

Our providers operate internationally, including outside the European Economic Area. Overseas support and processing can occur even when a service offers EU hosting. Relevant destinations include the United States, Australia and the United Kingdom.

For transfers outside the EEA, we use applicable adequacy decisions or contractual safeguards, including European Commission Standard Contractual Clauses and additional protections where necessary. UK-restricted transfers require an applicable UK adequacy regulation or appropriate safeguards, such as the UK Addendum or IDTA, where required. Other international transfers are assessed under the applicable law. A framework or adequacy decision applies only when the recipient and transfer fall within its scope. Contact contact@neural-music.com for details of the safeguards relevant to your information and how to obtain a copy.

Contact Us

For any questions or concerns regarding your privacy, you may contact us using the following details:

Neural Music OÜ
contact@neural-music.com