Privacy Policy

Last updated: October 23, 2026

1. Introduction

Neurotoned LLC ("Neurotoned," "we," "us," or "our") operates the websites located at neurotoned.com and heal.neurotoned.com, and the Neurotoned iOS and Android apps available on the Apple App Store and Google Play (collectively, the "Service"). Neurotoned is a Delaware limited liability company with its principal office at 8 The Green STE B, Dover, DE 19901.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our websites, use our iOS or Android app, create an account, purchase a subscription, or otherwise interact with our Service. Please read this policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described herein. If you do not agree with this Privacy Policy, please discontinue use of the Service immediately.

Your health data. Some of what you share with us, like your quiz answers, your check-ins and what you tell our assistants, can be health data. Our Consumer Health Data Privacy Policy explains what health data we collect, why, who receives it, and how to see it, delete it or withdraw your consent. It meets the laws of Washington, Nevada and Connecticut, and we follow it for everyone.

1.1 The Neurotoned iOS and Android Apps

The Neurotoned iOS app is a Capacitor native shell around our member experience at heal.neurotoned.com. Subscriptions purchased inside the iOS app are sold through Apple In-App Purchase only. We use RevenueCat to verify entitlement status with Apple so we can unlock member access on your account. Apple processes the payment; we receive purchase and entitlement signals (for example product identifier, transaction status, and renewal state), not your full payment card number.

The Neurotoned Android app is the same kind of shell around the same member experience. Subscriptions purchased inside the Android app are sold through Google Play Billing only. RevenueCat verifies entitlement status with Google so we can unlock member access on your account. Google processes the payment; we receive the same kind of purchase and entitlement signals, not your full payment card number.

No advertising or tracking SDKs run inside the apps. The Meta (Facebook) pixel, Meta Conversions API events for browser traffic, and our website analytics described elsewhere in this policy apply to our websites only. They are not included in the native iOS or Android app, and the iOS app does not request App Tracking Transparency permission. We do collect crash and error diagnostics in-app so we can keep the Service stable.

You can delete your Neurotoned account from inside the app or website via Profile, then Delete account, without contacting support. Section 7 says what that removes and what it does not.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

Create an account: name, email address, phone number, and account credentials (passwords are hashed and never stored in plaintext). We also store a unique user ID for your account.
Take our quiz or check in: your answers to our quiz, including anything you type in a free-text box, and your daily check-ins, where you rate your energy, calm and mood. We use them to suggest practices and programs. These are wellness self-reports, not medical diagnoses. See our Consumer Health Data Privacy Policy.
Chat with our AI assistants: what you write to the Neurotoned Guide in the member area, to the chat on our public pages, or to the Guide at /guide, and what the assistant replies. We keep these chats. At /guide you may also give us your first name and email address, which creates your account.
Make a purchase or subscribe: billing address and payment information. On our websites, card payments are collected and processed by Stripe, Inc., and PayPal payments by PayPal. In the iOS app, payment is handled by Apple In-App Purchase (with RevenueCat used to verify entitlements). In the Android app, payment is handled by Google Play Billing (with RevenueCat used to verify entitlements). We do not store your full credit card number on our servers. We retain purchase history (product, plan, and entitlement status) so we can fulfill your subscription.
Community and messaging: posts, comments, and other community content you publish, and in-app messages you send (for example to a practice partner).
Practice partner: if you opt in to be matched with a practice partner, the preferences you give us, such as your gender, age range and the program you focus on.
Live sessions: if you join a live session, we keep a record that you joined and any comments or ratings you leave. Sessions can be recorded. A recording shows the person speaking or a shared screen large and others in a strip, so if your camera or microphone is on, your face and voice may be in it. We keep recordings so members can watch the replay, and we use them to make a written transcript and notes of the session (see Google in Section 4.1).
Calls with our team: if you book a call with our team, we keep the booking, your name, email address and phone number. The team member who calls you can see your quiz answers to prepare.
Communicate with us / support requests: any information you include in emails, support tickets, or other correspondence sent to support@neurotoned.com.
Submit testimonials or reviews: your name, likeness, and the content of any testimonial you voluntarily provide.
Participate in surveys or promotions: responses, contact details, and any other information you choose to share.

2.2 Information Collected Automatically

When you access the Service, we and our third-party partners automatically collect certain technical and usage information, including but not limited to:

Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
Usage and product interaction: pages or screens visited, time spent, referring URL, click-stream data, navigation paths, and how you interact with programs, practices, and other features, including the videos you watch and finish.
Crash and diagnostic data: crash reports and error logs collected so we can diagnose and fix reliability issues (including in the iOS and Android apps). This is not used for advertising.
Cookies and similar technologies: session identifiers, authentication tokens, and preference cookies. See Section 5 for more detail.
Meta (Facebook) pixel, public website pages only: on our public website pages, Meta's pixel tells Meta which page you opened, with your browser details, your IP address and Meta's cookies. It does not run in the member area, in live session rooms, on staff pages, on pages with a sign-in link in their address, or in the iOS or Android app. It does not run at all when your browser sends Global Privacy Control (see Section 6.2).
Events our server sends to Meta (websites only): our server also tells Meta, through its Conversions API, when someone opens some of our public pages, starts a checkout, signs up, buys, or gets a refund. These events can carry an amount, the page they happened on and, for a program's page, the program's name. They carry your contact details (such as email, phone, name and location) hashed, which means turned into a code before they leave us, plus your IP address, browser details and Meta's cookies. They never carry your quiz answers, check-ins, chats or progress. We do not send these events for purchases made in the iOS or Android app.
Website analytics: when you use our websites in a browser, DashFi analytics measures visits and how the site is used, and Vercel Speed Insights measures how fast pages load. Neither runs in the iOS or Android app.

2.3 Information From Third Parties

Stripe: We receive payment confirmation details, including transaction status, last four digits of your card, and billing address, from Stripe to fulfill and manage your orders.
PayPal: If you pay with PayPal, we receive the payment's status and your name, email address and country as PayPal holds them.
Meta/Facebook (websites only): In connection with website advertising, we may receive aggregated or individual-level ad interaction data from Meta, including information about how you interacted with our advertisements on Meta platforms and whether those interactions led to actions on our websites. This does not apply to use of the iOS or Android app.
Apple / RevenueCat (iOS app): For subscriptions purchased through Apple In-App Purchase, we receive purchase and entitlement information via Apple and RevenueCat so we can grant, renew, or revoke member access on your account.
Google Play / RevenueCat (Android app): For subscriptions purchased through Google Play Billing, we receive purchase and entitlement information via Google and RevenueCat so we can grant, renew, or revoke member access on your account.

2.4 Marketplace Information

If you book a session with an independent practitioner, we collect the booking itself (who, when, how long, and which session type), anything you write for the practitioner, whether you opted in to sharing your focus areas, and, for a paid session, the payment record described above. If you apply to practise, we collect your application as described in Section 4.3.

2.5 Comments and Messages on Instagram and Facebook

When you comment on one of our posts, or send us a message on Instagram or Facebook Messenger, we receive from Meta the identifier Meta assigns you for our account, your public name, your comment and the messages you send us. We use them only to reply to you: to send you what you asked for when you comment a keyword, and to answer your messages, sometimes with an automated assistant that answers questions about our programs. A person on our team can read and take over any conversation. We keep these comments and messages for up to 24 months so we can follow up on your questions. We do not sell them, and we do not use them to message you outside a conversation you started. Reply "stop" at any time and we will not message you again. To have your messages deleted, email support@neurotoned.com and we will delete them within 30 days. Meta handles your messages under its own privacy policy.

2.6 Text Messages

If you say yes to texts, we keep your mobile number, the words you agreed to, when you agreed and the page you agreed on, and every text we send you and you send us. Saying yes to check-ins and practice tips, and saying yes to member offers, are two separate boxes, and offers are texted only if you ticked the second. We use them only to send you the texts you agreed to, and to answer your texts. Our texts go through Twilio, which delivers them. Our assistant, which runs on Anthropic's Claude, writes our texts and answers yours from your first name, your progress in your programme and the conversation so far, and a person on our team can read and take over any conversation. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Reply STOP to any text and we will not text you again. Our SMS Terms say the rest.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

Provide and maintain the Service: deliver content, process your account registration, and enable access to programs and features.
Process payments: complete transactions, send receipts, and manage subscriptions through Stripe and PayPal (websites), Apple In-App Purchase / RevenueCat (iOS app) and Google Play Billing / RevenueCat (Android app).
Manage your account: authenticate your identity, maintain your preferences, and provide customer support.
Answer you with our AI assistants: reply to you in chat, and help our team draft replies to the emails you send us. See Anthropic in Section 4.1.
Communicate with you: send transactional emails (e.g., purchase confirmations, password resets), respond to inquiries, and send marketing communications about new programs, promotions, and updates to people who have established a relationship with us. See Section 3.1 for the basis we rely on and how to stop them at any time.
Personalize your experience: tailor content recommendations and program suggestions based on your quiz answers, your usage patterns and your preferences.
Run live sessions: host sessions, let members watch the replay, and make a transcript and notes of each session.
Improve the Service: analyze usage trends, conduct research, and develop new features and content.
Advertising and analytics (websites only): measure the effectiveness of our website advertising campaigns through the Meta/Facebook pixel and the events our server sends to Meta, create custom and lookalike audiences, and optimize ad delivery. These advertising tools are not used inside the iOS or Android app.
Prevent fraud and ensure security: detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.
Comply with legal obligations: fulfill our legal and regulatory requirements, respond to lawful requests from public authorities, and enforce our terms of service.

3.1 Marketing Emails and Your Choices

We send marketing email to people who have established a relationship with Neurotoned, for example by creating an account, completing our assessment quiz, requesting a free resource, or purchasing a program. Within the United States we rely on that existing business relationship, consistent with the CAN-SPAM Act, rather than on a separate opt-in checkbox. Some sign-up and quiz flows also present an explicit marketing opt-in; ticking it is welcome, but it is not the only basis on which we may email you.

Contacts who joined before 27 July 2026. Our records did not reliably capture a marketing preference before that date. As of 4 August 2026 we treat those earlier contacts as reachable for marketing on the basis of the relationship described above, except anyone who had already unsubscribed. Those opt-outs were preserved in full and were not reset. If you are in that earlier group and would rather not hear from us, a single click on the unsubscribe link in any email is enough, and it takes effect immediately.

Every marketing email carries a one-click unsubscribe link. Unsubscribing is honored globally and permanently: it applies across all of our marketing programs and campaigns, not only the message you clicked from, and we do not require you to sign in or give a reason. You may also unsubscribe by emailing support@neurotoned.com. We suppress unsubscribed addresses from all future marketing sends, and a later purchase or sign-up does not silently re-subscribe you.

EU/EEA/UK residents. Where the GDPR or UK GDPR applies, we rely on your consent where you have given it, and otherwise on our legitimate interests in marketing our own comparable services to existing customers and enquirers (the "soft opt-in"). You have an absolute right to object to direct marketing at any time, with no justification required, and we will stop. See Section 6.3.

Transactional messages are separate. Order confirmations, receipts, password resets, subscription and billing notices, and messages about content you have purchased are service communications, not marketing. They are not covered by a marketing unsubscribe and will continue for as long as you hold an account. To stop those as well, close your account or contact us at support@neurotoned.com.

4. How We Share Your Information

4.1 Service Providers

These companies handle personal information for us, to provide their service to us. Each entry says what it receives.

Stripe, Inc.: card payments on our websites. Stripe receives your card details, billing address, email address, what you buy and the amount. See Stripe's Privacy Policy.
PayPal: PayPal payments on our websites. If you choose PayPal, PayPal receives your PayPal account details, what you buy and the amount.
Apple Inc. and RevenueCat, Inc.: iOS in-app subscriptions. Apple processes App Store payments. RevenueCat receives purchase and entitlement signals so we can unlock member access. See Apple's Privacy Policy and RevenueCat's Privacy Policy.
Google LLC (Google Play) and RevenueCat, Inc.: Android in-app subscriptions. Google processes Google Play payments. RevenueCat receives purchase and entitlement signals so we can unlock member access. See Google's Privacy Policy.
Supabase, Inc.: our database, login system and file storage. Supabase stores the information we hold about you, including your account, quiz answers, check-ins, chats, progress and posts. See Supabase's Privacy Policy.
Vercel, Inc.: website hosting. Everything you send to our websites passes through Vercel, including your IP address and request details. On our websites, Vercel Speed Insights also measures how fast pages load. See Vercel's Privacy Policy.
Meta Platforms, Inc.: advertising on Facebook and Instagram, on our websites only. Meta receives what Section 2.2 describes: which public page you opened, through its pixel, and the events our server sends (some page views, checkouts, sign-ups, purchases and refunds) with your contact details hashed. Meta never receives your quiz answers, check-ins, chats or progress. Nothing is sent to Meta from the iOS app. See Meta's Privacy Policy.
Anthropic, PBC: our AI assistants. They run on Claude, an AI model made by Anthropic. When you chat with the Neurotoned Guide in the member area, with the chat on our public pages, or with the Guide at /guide, what you write is sent to Anthropic so the AI can reply. In the member area, the Guide is also told your name, your plan, whether you finished our quiz and which programs you are in, and it can look up your progress in a program when you ask about it. At /guide, if you give your first name and email address, they pass through the AI so it can create your account. When you email our support team, your email and basic facts about your account, such as your plan and programs, may be sent to Anthropic so the AI can draft a reply. If you comment on our Facebook or Instagram posts, your comment may be sent so the AI can write our reply. We also send Anthropic samples of past /guide chats so it can suggest how the Guide could do better, and summaries across many members with no names in them. If you are matched with a practice partner, your quiz-based focus areas, with no names, are sent so the AI can write a short note about why you were matched. Anthropic's commercial terms say it may not train its AI models on what we send it. See Anthropic's Privacy Policy.
Google LLC: three jobs. First, when a live session is recorded, we send the recording to Google's Gemini AI, which writes the session's transcript and notes. Second, our support mailbox runs on Gmail, so emails you send to support are stored by Google. Third, if you book a call with our team, your name, phone number and email address may be added to the team member's Google Calendar, with a Google Meet link when the call is on Meet. See Google's Privacy Policy.
Resend: sends our emails. Resend receives your email address, your name when we use it, and what each email says, which can mention your programs, plan or live sessions.
Bunny (BunnyWay d.o.o.): hosts and streams our videos, and may stream live session replays. Bunny receives your IP address and which video your device asks for.
LiveKit, Inc.: runs our live sessions. LiveKit carries the audio and video of a session, including yours if your camera or microphone is on, and makes the recording, which is saved to our storage.
DashFi: website analytics. When you use our websites in a browser, DashFi's script measures visits and how the site is used, which includes the address of the page you open and details about your browser. It does not run in the iOS or Android app.
Slack Technologies: our team's chat tool. Alerts to our team about new sign-ups, orders and affiliate applications can include your email address, your name and what you bought.

4.2 Practitioners You Book

Where you book a session with an independent practitioner through the marketplace, we share with that practitioner only:

Your display name and the time, length, and type of session you booked;
Anything you chose to write for them when booking;
Your email address, so a calendar invitation and any change to the booking can reach you; and
Only if you expressly opt in at the time of booking, a short list of the focus areas derived from your onboarding questionnaire, for example “Grief” or “Muscle Tension”.

We never disclose your questionnaire answers themselves to a practitioner, only the derived focus areas described above, and only with your opt-in for that specific booking. The opt-in is off by default, is never inferred from anything else you have done, and declining it does not prevent you booking. You may book sharing nothing beyond your name, your chosen time, and your email address.

Practitioners are independent third parties, not our employees. Once information is shared with a practitioner they act as an independent controller of it and their own privacy practices and professional confidentiality obligations apply. Anything you go on to tell a practitioner directly, during or outside a session, is between you and them and is not collected by us.

4.3 Information Practitioners Share With Us

If you apply to practise on the marketplace, we collect the information in your application: your name, contact details, stated certification and certifying body, any credential reference or verification link you provide, your written answers, and the video you submit. We use it to review your application, to operate your public profile if you are approved, and to contact you about your application and your bookings. Your submitted application video is stored privately and is not published; the clips you choose to publish are shown to members. Application records are retained whether or not you are approved, so that a later application can be considered in context.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to: (a) comply with a legal obligation, court order, or legal process; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Service; or (d) protect the personal safety of users of the Service or the public.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent.

4.7 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, analytics, or other business purposes.

4.8 No Sale of Personal Information

We do NOT sell your personal information. We have not sold personal information in the preceding twelve (12) months and have no plans to do so.

5. Cookies and Tracking Technologies

5.1 Types of Cookies We Use

Essential cookies: These cookies are strictly necessary for the operation of our Service. They enable core functionality such as user authentication, session management, and security features. You cannot opt out of essential cookies as the Service cannot function without them.
Analytics cookies: These cookies help us understand how visitors interact with our Service by collecting information about pages visited, time on site, and navigation paths. This data is used in aggregate to improve the Service.
Advertising and marketing cookies (websites only): On our websites, Meta's cookies (_fbp and _fbc) identify your browser and the Meta ad you clicked, so that visits and purchases can be matched to ads. The fbclid parameter appended to URLs from Meta ad clicks is used to attribute conversions to specific ad campaigns. These advertising cookies are not used in the Neurotoned iOS or Android app.

5.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the Service. To opt out of Meta's use of cookies for ad targeting, visit Meta Ad Preferences. You may also opt out of interest-based advertising through the Digital Advertising Alliance or the Network Advertising Initiative. To stop our websites sharing your visits and purchases with Meta, turn on Global Privacy Control in your browser (see Section 6.2).

6. Your Privacy Rights

6.1 Rights Available to All Users

Regardless of your location, you may:

Access the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Delete your personal information, subject to certain legal exceptions.
Opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at support@neurotoned.com. Opt-outs are honored globally and permanently. See Section 3.1.

6.2 California Residents: CCPA/CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights regarding your personal information:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting or selling the information, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information necessary to complete a transaction, detect security incidents, or comply with legal obligations).
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: While we do not sell personal information for monetary consideration, our use of the Meta/Facebook pixel and the events our server sends to Meta on our websites may constitute "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA. Nothing is sent to Meta from the iOS or Android app. You have the right to opt out of this sharing, in either of two ways.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

The automatic way: Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a request to opt out of sharing for ads. Some browsers and browser extensions can send it for you. When your browser sends it, our websites do not load the Meta pixel, and our server does not send Meta any event about you.

By email. Email support@neurotoned.com with the subject line "Do Not Sell or Share My Personal Information."

To submit any other request, email support@neurotoned.com. We will verify your identity before processing your request and will respond within forty-five (45) days. If we need additional time, we will notify you of the extension and the reason.

If you are located in the European Union, European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR provide you with the following rights:

Right of Access: You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access that data along with information about the purposes of processing.
Right to Rectification: You have the right to obtain the rectification of inaccurate personal data without undue delay.
Right to Erasure ("Right to Be Forgotten"): You have the right to obtain the erasure of personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
Right to Restriction of Processing: You have the right to restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

Legal Bases for Processing: We process your personal data on the following legal bases: (a) Consent, where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications you opt into); (b) Contract, where processing is necessary for the performance of a contract with you (e.g., providing the Service, processing payments); (c) Legitimate Interests, where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights (e.g., fraud prevention, Service improvement, analytics, and, on our websites only, Meta measurement for ads). You may object to processing based on legitimate interests at any time. See "Right to Object" above.

International Data Transfers: Your personal data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office to provide appropriate safeguards for such transfers. See Section 11 for more information.

6.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at support@neurotoned.com. We may ask you to verify your identity before processing your request. We will respond to verifiable requests within the timeframes required by applicable law.

6.5 Washington, Nevada and Connecticut Residents: Health Data

Your rights over health data, and how to use them, are in our Consumer Health Data Privacy Policy.

7. Data Retention

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. The criteria we use to determine retention periods include:

The duration of your active account and subscription with the Service.
Whether there is a legal obligation to which we are subject (e.g., tax and financial reporting requirements may require us to retain transaction data for up to seven years).
Whether retention is advisable in light of our legal position (e.g., regarding applicable statutes of limitation, litigation, or regulatory investigations).

Deleting your account. When you use Profile, then Delete account in the website, iOS app or Android app, we remove at once your quiz answers and focus areas, your check-ins, your program and video progress, favorites and streaks, your community posts and comments, your /guide chat, your practice partner preferences and your call bookings. We replace the name and email address on your account so it no longer points to you, and you can no longer sign in.

The button also removes your chats with the Guide in the member area, your live session attendance, comments and ratings, and your webinar registrations. It does not yet remove chats you had with the Guide on our public pages before signing in, or recordings you appear in. Email support@neurotoned.com and we will delete those too, within thirty (30) days, except where we are required or permitted by law to keep them. Payment transaction records may be retained for up to seven (7) years to comply with financial reporting obligations. Anonymized or aggregated data that can no longer be associated with you may be retained indefinitely.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL and encryption of sensitive data at rest.
Role-based access controls limiting employee and contractor access to personal data on a need-to-know basis.
Regular security assessments and monitoring of our systems and infrastructure.
Use of industry-standard security practices by our service providers (Stripe is PCI DSS Level 1 certified; Supabase employs row-level security and encryption at rest).

However, no method of electronic transmission or storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and applicable regulatory authorities in accordance with applicable law, including within seventy-two (72) hours where required by the GDPR.

9. Children's Privacy

The Service is not directed to individuals under the age of thirteen (13). We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). For users in the EU/EEA/UK, the Service is not directed to individuals under the age of sixteen (16) unless parental consent has been provided in accordance with applicable member state law.

If we become aware that we have collected personal information from a child under the applicable minimum age without verified parental consent, we will take steps to delete that information as quickly as possible. If you believe we have inadvertently collected information from a minor, please contact us at support@neurotoned.com.

10. Do Not Track and Global Privacy Control

Some web browsers transmit "Do Not Track" (DNT) signals to websites. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, our websites do not respond to DNT signals.

Global Privacy Control is different, and we do honor it. When your browser sends it, our websites do not load the Meta pixel, and our server does not send Meta any event about you. See Section 6.2. Advertising cookies and the Meta pixel apply to our websites only; they are not used in the iOS or Android app.

11. International Data Transfers

Your personal information is primarily processed and stored in the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For transfers of personal data from the EU/EEA/UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) and, where applicable, the UK International Data Transfer Addendum issued by the UK Information Commissioner's Office. We also assess the laws and practices of the destination country to ensure an adequate level of protection for your personal data.

12. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Service. Your continued use of the Service after the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: Neurotoned LLC
Address: 8 The Green STE B, Dover, DE 19901
Email: support@neurotoned.com
Phone: +1-910-777-7061

For privacy-specific inquiries, including requests to exercise your rights under the CCPA/CPRA or GDPR, please email support@neurotoned.com with the subject line "Privacy Inquiry."