Privacy Policy

1. Information We Collect

• Email address (account identification + notifications)
• Google OAuth sign-up: name, profile image, Google account identifier (sub claim)
• Subscription billing: Stripe-tokenized payment information (raw card data is never stored on NEUTAUR servers)
• Marketing analytics (collected at signup, server-side): IP address, User-Agent string, HTTP referrer URL, UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), first-seen timestamp, cumulative login count. Used solely to measure marketing channel attribution, fraud signals, and product engagement cohorts. Lawful basis: GDPR Article 6(1)(f) legitimate interest, CCPA service personalization, Korean PIPA Article 15(1)(4) marketing analysis.
• Product-behavior analytics (first-party, collected as you use the app): pages viewed, industries and companies (tickers) you open, searches you run, watchlist additions and removals, and checkout steps — together with a random device identifier stored in your browser, a session identifier, approximate device and viewport, and the UTM parameters above. For signed-in members these events are associated with your account (the association is made server-side from your authenticated session; the identifier on its own is anonymous). We do not capture what you type beyond the search terms you submit. Lawful basis: GDPR Article 6(1)(f) legitimate interest (product measurement and improvement). You can opt out at any time — see Section 5.
• Service usage logs: sign-up timestamp, slot usage history, subscription lifecycle events

2. How We Use Your Information

• Account identification and service delivery (dashboard, slots, notifications)
• Subscription billing and refund processing (Stripe-compliant)
• Service quality improvement and fraud prevention
• Marketing channel attribution and product analytics — measuring which acquisition channels deliver engaged users, evaluating onboarding funnel conversion, and improving creative/copy decisions. We do not sell or share these data points with third-party advertising networks.
• Legal obligation compliance (tax reporting, dispute resolution)

3. Data Retention

Account data is deleted immediately upon withdrawal request. Payment records are retained separately per US IRS 7-year retention obligation and Korean e-Commerce Act 5-year retention obligation. Service usage logs are automatically anonymized after 6 months.

4. Third-Party Service Providers

• Supabase — Authentication + database hosting (us-east-1)
• Vercel — Web hosting (us-east-1)
• Stripe — Payment processing (PCI-DSS Level 1)
• Google OAuth — Social login provider
• DigitalOcean — Backend infrastructure (NYC1)

5. Cookies and Tracking Technology

We use essential cookies for session management and Supabase Auth token storage. We also persist non-sensitive attribution cookies for up to 30 days (SameSite=Lax, JavaScript-readable) that record UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the first-seen timestamp captured at your first visit. These cookies are read once at signup to record acquisition channel attribution and are not shared with third-party advertising networks. Third-party analytics (e.g., Datadog RUM) and marketing cookies remain off during public beta and will be introduced under a separate consent flow after launch.

For product-behavior analytics we store a random first-party identifier in your browser’s local storage (key neutaur_anon) plus a per-session identifier. These are first-party only and are never shared with third-party advertising networks. You can opt out at any time: choose “Opt out” on the privacy notice shown on your first visit, or enable your browser’s “Do Not Track” or Global Privacy Control signal — either one turns product-behavior analytics off entirely and prevents the identifier from being created.

6. Your Rights

You may request access, correction, deletion, or processing restriction of your personal information by contacting us at the address below. We will respond within 48 hours.

7. Contact

Email: help@neutaur.com
Operating Entities: Neutaur, Inc. (Delaware, USA) / Efdent Corp. (KR, Business Registration No. 745-81-03017)