Privacy policy

This privacy policy explains what personal data is processed when you use Neural Design Lab and for what purposes.

1. Hosting and server operations

The application is hosted on server infrastructure operated by Hetzner Online GmbH.

When you access the website, technically necessary connection data may be processed. This may include your IP address, access time, requested path, browser information, and technical request data.

This data is processed to provide the website securely and reliably, diagnose errors, and prevent misuse.

2. User account

When you register and use an account, we process the email address you provide and the data needed for sign-in, verification, session management, and account administration.

We process this data as necessary to provide your user account and perform our service relationship with you.

3. Sessions and technically necessary cookies

Neural Design Lab uses a technically necessary session so that sign-in, security features, and the protected account area can work.

This session is necessary for the features requested by the user.

4. Creating designs

When a design is created, we process the design information entered by the user. This may include the topic, design idea, style, target audience, additional preferences, and the prompt generated from that information.

The generated designs and technical information about each request are also stored so they can be made available in the user's account and shown in the design history.

Users should not include personal data in design descriptions unless it is necessary to create the design.

5. OpenAI

We use OpenAI services for AI-powered features and design generation.

Content needed for a feature may be sent to OpenAI and processed there to provide the requested feature.

For users in the European Economic Area, OpenAI Ireland Limited may be involved in processing. Depending on the technical setup, data may also be processed outside the European Economic Area. Where required, appropriate safeguards for international data transfers are used.

6. Google AdSense and advertising

No Google ads are currently loaded. A meta tag and an ads.txt file are provided to verify our website with Google AdSense. These entries alone do not load a Google advertising script or set advertising cookies.

Before advertising is enabled in the future, the data processing information and required consent management will be updated accordingly.

7. Payments with Stripe

We use Stripe to process credit purchases.

When a payment is initiated, Stripe processes the data needed to handle it. This may include the payment amount, email address, technical data, payment information, and fraud prevention data.

Full card details are not stored on our own servers.

Stripe may also process personal data internationally as part of its payment and security infrastructure.

8. Email delivery with Brevo

We use Brevo to send transactional emails.

This may include the email address, technical delivery information, and the content of the relevant system message.

This includes, for example, email verification and password resets.

9. Credits and payment information

To provide the credit system, we store information about credit transactions, balances, and the assignment of completed payments to the relevant user account.

This is used in particular to perform our contract, ensure correct billing, and prevent duplicate transactions or misuse.

10. Legal bases

Personal data is processed in particular when necessary to perform a contract or take steps before entering into a contract.

Where statutory retention or documentation obligations apply, data is processed to comply with those legal obligations.

Data may also be processed on the basis of legitimate interests, particularly for IT security, fraud prevention, error analysis, and secure operation of the application, unless the interests or rights of the data subjects override those interests.

11. Data retention

Personal data is stored only for as long as necessary for the relevant purpose.

User account data may be stored for the duration of the service relationship.

Payment, transaction, and business records may be stored for longer where statutory retention obligations apply.

Technical log data is deleted or overwritten after the retention period needed for security and error analysis, unless a specific security incident requires longer retention.

12. Data recipients

Where necessary to provide the service, personal data may be shared with the following service providers:

• Hetzner Online GmbH — hosting
• OpenAI — AI and design features
• Stripe — payment processing
• Brevo — transactional email delivery

13. Rights of data subjects

Subject to the applicable legal requirements, data subjects have the right to access, rectify, erase, and restrict the processing of their personal data, to data portability, and to object.

Requests can be sent to support@neuraldesignlab.com .

14. Right to lodge a complaint

Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.

15. Changes

This privacy policy may be updated if features, service providers, or legal requirements change.

16. Controller

Last updated: September 2026