This policy explains what personal data Neuval processes when someone visits the website, sends a project brief, or chooses whether to allow analytics.
01Controller
Who is responsible for this website
NEUVAL Ε.Ε. (NEUVAL L.P.), established in Greece, operates this website and is the controller of the personal data described here. Neuval SRL, established in Belgium, holds the Neuval name and the neuval.ai domain. For privacy requests, corrections, deletion requests, or questions about how project information is handled, contact info@neuval.ai.
The operator's registered office, registry number, and VAT number are in the legal notice. The contracting details for a project are stated in its proposal, statement of work, or invoice.
02Plain summary
The short version
- We collect only the information needed to run the website, answer enquiries, and prevent spam.
- The contact form asks only for email, phone, and what the visitor wants to discuss.
- Google Analytics runs only after a visitor chooses ALLOW. Until then, nothing is sent to Google.
- Declining analytics does not block access to the website, contact form, portfolio, or FAQ.
- We do not sell personal data.
- We do not use the website to make automated legal, credit, hiring, or eligibility decisions about visitors.
03Data categories
What data may be processed
| Context | Examples | Why it is used |
|---|---|---|
| Website visit | Page URL, device/browser signals, IP address, technical logs, security events | To serve the website, keep it secure, debug errors, and understand whether pages work. |
| Project brief | Email, phone number, what the visitor wants to discuss, the page the form was opened from, the time it was sent | To reply to the enquiry, prepare a conversation, and decide whether there is a fit. |
| Anti-abuse checks | Cloudflare Turnstile token and technical signals, IP address | To confirm a brief comes from a person and to limit how many briefs one connection can send. |
| Analytics | Page views and events such as contact opens and briefs sent, with Google Analytics cookies that recognise a returning browser | To understand site performance and improve content, only after consent. |
04GDPR basis
Why each processing activity is allowed
| Activity | Primary legal basis | Reasoning |
|---|---|---|
| Responding to project briefs | Pre-contract steps and legitimate interest | The visitor asks Neuval to evaluate or discuss a possible project. |
| Security, spam prevention, and service integrity | Legitimate interest | Neuval needs to protect the website, the contact form, and its inbox from abuse. |
| Analytics | Consent | Analytics cookies are set only after the visitor actively allows them. |
| Invoices, accounting, and legal records after a project starts | Legal obligation and contract performance | Business records may need to be retained for accounting, tax, or legal reasons. |
05Service providers
Processors and external services
Neuval uses a small stack of external providers to operate the website and the contact form. These services may process data as independent controllers, processors, or sub-processors depending on the exact feature.
| Provider | Role in this website | Data involved |
|---|---|---|
| Cloudflare | Hosting, HTTPS delivery, the contact form's endpoint, and rate limiting | Website files, request metadata, IP address, brief payloads in transit |
| Cloudflare Turnstile | Checks that a brief is sent by a person | Token, browser and interaction signals, IP address |
| Resend | Delivers each brief to Neuval by email | Email, phone number, topic, source page |
| Google Workspace | Neuval's mailbox, where briefs arrive and replies are sent from | Email, phone number, topic, source page, and the conversation that follows |
| Slack | An internal note that a brief has arrived | Email, the start of the topic, source page |
| Google Analytics 4 | Analytics, only after consent | Page and event data, IP address, browser type, analytics cookies |
06International transfers
Data sent outside the European Economic Area
Cloudflare, Google, Resend, and Slack may process the data described here outside the European Economic Area, mainly in the United States. Each provides the European Commission's standard contractual clauses for these transfers, and Cloudflare, Google, and Resend are also certified under the EU-U.S. Data Privacy Framework. A copy of these safeguards is sent on request to info@neuval.ai.
08Retention
How long data is kept
| Data | Typical retention |
|---|---|
| Unsubmitted form data | Not intentionally stored by Neuval. It remains only in the browser while the visitor is filling the form. |
| Project briefs | Kept in Neuval's mailbox while evaluating, replying to, and following up on the enquiry. Briefs that do not progress are reviewed and removed when no longer useful. |
| Brief notes in Slack | Kept while the enquiry is open, then removed with the brief. |
| Email delivery records | Kept by Resend according to its retention settings. |
| Analytics data | Kept according to the Google Analytics property retention settings. |
| Security and hosting logs | Kept according to Cloudflare's operational retention settings. |
| Client and invoice records | Kept as required for accounting, tax, contract, and legal obligations. |
09GDPR rights
Your rights
Depending on the context and legal basis, people in the European Economic Area may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent.
To exercise a right, email info@neuval.ai. Neuval may need enough information to verify the request and locate the relevant record.
- Access: ask what data is held about you.
- Correction: ask to fix inaccurate or incomplete data.
- Deletion: ask to delete data when there is no overriding reason to keep it.
- Restriction: ask to limit processing in certain cases.
- Portability: ask for data you provided in a usable format when applicable.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: change your analytics preference at any time.
10Supervisory authority
Complaints and official guidance
If a privacy concern cannot be resolved directly, you can contact the Hellenic Data Protection Authority, where the operator is established, or the supervisory authority in your country, such as the Belgian Data Protection Authority.
11Updates
Policy changes
This policy will be updated when the website, contact form, analytics setup, providers, or legal requirements materially change.