Privacy Policy

This Privacy Policy explains how NeuroSound collects, uses, stores and protects personal data when you use the NeuroSound website, AI music generation service and related products and services available at neurosound.net (collectively, the "Service").

Please read this Privacy Policy carefully to understand how we process your personal data and the rights you have in relation to it.

1. Who we are

The Service is operated by OBJECT&FORM LIMITED, a company incorporated in the United Kingdom.

Company number: 17413696
Registered office: Initial Business Centre Unit 7, Wilsons Business Park, Manchester, United Kingdom, M40 8WN
Email: hello@neurosound.net

In this Privacy Policy, "NeuroSound", "we", "us" and "our" refer to OBJECT&FORM LIMITED.

For the purposes of applicable data protection legislation, NeuroSound is the data controller responsible for the personal data described in this Privacy Policy.

If you have any questions about how we process your personal data, please contact us at:

hello@neurosound.net

2. What personal data we collect

Depending on how you use the Service, we may collect and process the following categories of personal data.

Account and registration data

When you create or use an account, we may collect:

• your name or other account identifier, where provided;
• email address;
• account credentials, including a securely hashed and salted password;
• account creation and authentication information;
• account status and related account activity.

User Inputs and generated content

When you use the AI music generation features, we may process:

• text prompts and descriptions;
• lyrics you submit;
• titles and other text you provide;
• musical preferences, styles, tags and concepts;
• other materials you submit through the Service; and
• Generated Tracks and related metadata.

User Inputs may contain personal data if you choose to include personal information in them. You should not submit personal data, confidential information or other protected material unless you have the right to do so.

Generated Tracks themselves may not always constitute personal data. However, information associated with a Generated Track, such as your account identifier, creation history or other metadata, may constitute personal data and may therefore be processed as described in this Privacy Policy.

Payment and transaction data

When you purchase credits or other paid products, payment information is processed by our payment service provider.

NeuroSound does not receive or store your full payment card number, CVV or other complete card authentication data unless expressly stated otherwise.

We may receive limited transaction information from our payment provider, such as:

• transaction ID;
• payment status;
• amount and currency;
• date and time of the transaction;
• payment method or card type;
• billing information where necessary; and
• information relating to refunds, chargebacks or payment disputes.

Technical and usage data

When you access or use the Service, we may automatically collect certain technical and usage information, such as:

• IP address;
• browser type and version;
• device type and operating system;
• approximate location derived from IP address, where necessary;
• date and time of access;
• pages or features accessed;
• session and authentication information;
• error logs and diagnostic information; and
• information about how the Service is used.

Some of this information may be collected using cookies or similar technologies. Further information is provided in our Cookie Policy.

Communications and support data

If you contact us, we may process:

• your name and email address;
• the content of your communication;
• information about your account or transaction;
• support requests and related correspondence; and
• information necessary to investigate and resolve your request.

Marketing preferences

If you choose to receive marketing communications from us, we may process your email address and information about your marketing preferences, including whether you have subscribed to or unsubscribed from particular communications.

3. How we use personal data

We use personal data for the following purposes.

Providing and operating the Service

We use personal data to:

• create and maintain your account;
• authenticate users;
• process your User Inputs;
• generate and deliver Generated Tracks;
• store your Generated Tracks and account history;
• provide features and functionality requested by you;
• process purchases and provide purchased credits;
• provide customer support; and
• communicate with you about the operation of the Service.

Security and fraud prevention

We may process personal data to:

• protect accounts and systems;
• detect and prevent fraud, abuse and unauthorised access;
• prevent misuse of free or promotional credits;
• investigate suspicious activity;
• maintain the security and integrity of the Service; and
• enforce our Terms of Service.

Service maintenance and improvement

We may use technical, usage and operational information to:

• monitor Service performance;
• identify errors and technical problems;
• maintain and improve reliability, security and functionality; and
• understand how users interact with the Service.

We do not use User Inputs to train our own AI models.

Payments, accounting and legal obligations

We may process personal data to:

• process and record payments;
• issue and maintain transaction records;
• comply with tax and accounting requirements;
• respond to lawful requests from authorities;
• establish, exercise or defend legal claims; and
• comply with other legal obligations applicable to NeuroSound.

Marketing

Where you have provided the required consent, we may use your contact details to send you product updates, news, offers and other marketing communications.

You can withdraw your consent to marketing at any time by using the unsubscribe mechanism in the relevant communication or by contacting us.

4. Our lawful bases for processing

Under applicable UK data protection law, we must have a lawful basis for processing personal data. The lawful basis we rely on depends on the specific purpose for which we process your personal data.

Performance of a contract

We process personal data where this is necessary to provide the Service and fulfil our contractual obligations to you, including:

• creating and managing your account;
• processing your User Inputs;
• generating and storing Generated Tracks;
• providing purchased credits and other paid features;
• processing transactions; and
• providing customer support relating to the Service.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your interests, rights or freedoms.

Our legitimate interests may include:

• maintaining and improving the Service;
• protecting our systems and users;
• preventing fraud, abuse and misuse;
• monitoring and improving Service security;
• investigating technical problems; and
• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your interests, rights or freedoms override our legitimate interests.

Legal obligation

We may process personal data where this is necessary to comply with a legal obligation, including tax, accounting, financial record-keeping, regulatory and law-enforcement requirements.

Consent

Where required by law, we rely on your consent for specific processing activities, including certain marketing communications and the use of non-essential cookies or similar technologies.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5. How we process User Inputs and AI-generated content

We may transmit User Inputs to third-party AI model providers where this is necessary to provide the requested Service.

Third-party AI model providers may process User Inputs as necessary to provide the requested generation, maintain and secure their services, detect or prevent abuse, troubleshoot technical problems or otherwise perform services for NeuroSound, subject to the terms and data-processing arrangements applicable to the provider used by NeuroSound.

We do not use User Inputs to train our own AI models.

NeuroSound does not currently represent that all third-party AI providers will never use User Inputs for their own model training or development unless this is expressly stated in the applicable provider terms or otherwise confirmed by NeuroSound.

We do not claim ownership of your User Inputs merely because you submit them to the Service. The rights and licence applicable to User Inputs and Generated Tracks are described in our Terms of Service and AI Music Licence & Intellectual Property Policy.

You are responsible for ensuring that you have the necessary rights and permissions to submit personal data or other protected material belonging to another person.

6. Who we share personal data with

We may share personal data with trusted third parties where necessary to provide, operate, secure or support the Service.

These may include:

AI model and technology providers

We may share User Inputs and other information necessary to generate music with third-party AI model providers and related technology providers.

Hosting and infrastructure providers

We may share personal data with hosting, storage, database, security and infrastructure providers that support the operation of the Service.

Payment providers

Payment and transaction information may be shared with payment service providers to process payments, refunds, chargebacks and related transactions.

Email and communications providers

We may use third-party email and communications providers to send account, security, transactional and support messages and, where permitted, marketing communications.

Monitoring and security providers

We may use monitoring and security providers to understand Service performance, detect errors, prevent abuse and protect the Service.

Professional advisers and authorities

We may disclose personal data where reasonably necessary to:

• lawyers, accountants, auditors and other professional advisers;
• insurers;
• courts, regulators and public authorities;
• law-enforcement bodies; or
• other third parties where disclosure is required by law or necessary to establish, exercise or defend legal rights.

We do not sell personal data to third parties.

Where third parties process personal data on our behalf, we take appropriate steps to require them to process the data in accordance with applicable data protection requirements and our instructions.

7. International transfers

Some of our service providers may process personal data outside the United Kingdom.

Where we transfer personal data internationally, we use a lawful transfer mechanism recognised under applicable UK data protection law.

Depending on the destination and circumstances, this may include:

• an applicable adequacy regulation or adequacy decision;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism permitted by applicable law.

Where appropriate safeguards are used, you may contact us at hello@neurosound.net to request further information about the safeguards applicable to a particular transfer.

We may update our service providers and international transfer arrangements from time to time. Where required, we will update this Privacy Policy accordingly.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements.

Different categories of personal data may be retained for different periods.

Account data

We generally retain account data while your account remains active.

After account closure, we may retain relevant account information for up to 12 months, unless a longer period is necessary for legal, security, fraud-prevention or dispute-resolution purposes.

Generated Tracks and User Inputs

We generally retain Generated Tracks, User Inputs and related account information while your account remains active.

After account closure, these materials may be retained for up to 12 months, unless a longer or shorter period is necessary for a specific legal, security or operational purpose.

Where technically feasible and appropriate, you may request deletion of personal data in accordance with Section 11. You may also close your account in accordance with the Terms of Service.

Transaction and accounting records

Transaction, invoice and accounting records may be retained for the period required by applicable tax, accounting and financial record-keeping laws.

Support and correspondence

Support communications may be retained for as long as reasonably necessary to resolve the matter and maintain appropriate business and legal records.

Marketing information

Marketing preferences and suppression records may be retained for as long as necessary to respect your marketing choices and demonstrate compliance with applicable law.

When personal data is no longer required, we will delete it or anonymise it where reasonably practicable.

9. Cookies and similar technologies

We use cookies and similar technologies for purposes such as maintaining the Service, remembering preferences and protecting the Service against bots, fraud and abuse.

We do not currently use cookies or similar technologies for behavioural advertising, cross-site advertising or cross-site tracking.

Some cookies or similar technologies may be strictly necessary for the operation, security or functionality of the Service, while others may require your consent under applicable law.

For further information about the cookies and similar technologies we use, why we use them and how you can manage them, please see our Cookie Policy.

10. Data security

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Depending on the nature of the information and the risks involved, these measures may include:

• encryption of data in transit using TLS;
• secure password hashing and salting;
• access controls and authentication;
• restricted access to production systems;
• monitoring and logging;
• security updates and vulnerability management; and
• appropriate controls for third-party service providers.

No online service can guarantee absolute security. If we become aware of a personal data breach that is subject to notification requirements under applicable law, we will take the steps required by law.

11. Your data protection rights

Subject to applicable law and any relevant exemptions, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing;
• object to processing based on our legitimate interests;
• object to direct marketing;
• request data portability where the right applies;
• withdraw consent where processing is based on consent; and
• make a complaint to the relevant data protection supervisory authority.

Not all rights apply in every circumstance. For example, the right to data portability generally applies only to certain processing based on consent or contract and carried out by automated means.

If you wish to exercise your rights, contact us at:

hello@neurosound.net

We may need to verify your identity before responding to a request.

We will normally respond to a valid data protection request without undue delay and, in any event, within the period required by applicable law.

12. Direct marketing

Where we send marketing communications by email or other electronic means, we will comply with applicable data protection and electronic communications laws.

Where consent is required, we will send marketing communications only where you have provided the required consent.

You can unsubscribe from marketing communications at any time by:

• using the unsubscribe link in the relevant communication; or
• contacting us at hello@neurosound.net.

Even if you opt out of marketing communications, we may continue to send essential service, transactional, security or account-related communications.

13. Automated decision-making

NeuroSound uses AI to generate music based on User Inputs.

We do not use AI or automated processing to make decisions about you that produce legal effects or similarly significant effects within the meaning of applicable data protection law. If this changes, we will update this Privacy Policy and provide any information required by applicable law.

14. Children's privacy

The Service is not intended for children under the age of 16, and children under 16 must not use the Service.

We do not knowingly collect personal data from children under 16 through the Service. If you are under 16, please do not use the Service or provide personal data to us.

If you believe that a child under 16 has provided personal data to us, please contact us at hello@neurosound.net.

If we become aware that we have collected personal data from a child under 16, we will take reasonable steps to delete that data, subject to any legal or regulatory obligations that require us to retain it.

15. Data relating to other people

If you submit personal data relating to another person in a prompt, lyrics, file or other User Input, you are responsible for ensuring that you have a lawful basis or other necessary permission to submit that information to NeuroSound.

You should not submit sensitive or confidential personal information about another person unless you have a lawful and appropriate reason to do so.

You should avoid including personal data about other people that is not necessary for your use of the Service.

NeuroSound may process such information as part of providing the Service, including transmitting it to third-party AI or technology providers where necessary to fulfil your request.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our data processing practices, applicable law or regulatory requirements.

The updated version will be published on this page with a revised "Last updated" date.

Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to your attention before or when the new processing begins, where required by applicable law.

We will not use personal data for a new or materially different purpose without first providing the information required by applicable data protection law.

17. Complaints

If you have concerns about how we process your personal data, please contact us first:

hello@neurosound.net

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

Further information about the ICO and how to make a complaint is available on the ICO's official website.

18. Contact

If you have any questions about this Privacy Policy or how NeuroSound processes personal data, please contact us:

OBJECT&FORM LIMITED
Company number: 17413696
Registered office: Initial Business Centre Unit 7, Wilsons Business Park, Manchester, United Kingdom, M40 8WN
Email: hello@neurosound.net
Website: neurosound.net