Privacy Policy

This policy applies when Pioneers of Intelligence Ltd provides the Neuvix website, applications, API, CLI and MCP connector. It is written to be read rather than to be defended, and it describes what the software actually does.

It covers everything you touch in the product: your account, what you create, what you publish, what you buy, what you connect, and what you write to support.

When you upload material about other people, a photograph of a colleague or a recording of a client, you are the one who needs their permission. We process it for you, on your instruction, and the Acceptable Use Policy sets the limits on what you may do with it.

• Account and profile: your email address, display name, handle, profile image, biography, language, whether your email is verified, and your security settings.
• What you create: prompts, chats, uploaded files, generated images, video and audio, projects, documents, brand material, characters, voices, moodboards, community posts and comments, and the metadata a job needs to run.
• How the service behaves for you: which features you use, when a job ran, what it cost, whether it failed and why, request identifiers, and security events such as a sign in from a new device.
• Technical data your browser or client sends: IP address, browser and device information, and language preference.
• An approximate country. The API derives it once, from the public IP address of your first request, using a country database that runs inside our own infrastructure. It records the country code and the version of the database and nothing else: no raw IP address, no hashed one. It is used to decide which model providers may serve your account, it can be wrong, and it is not proof of where you live.
• Money: your plan, credit balance and ledger, orders, payment status, the reference the gateway returns, and advertising spend. Card numbers never reach us.
• Connected accounts: the identifiers and permissions of a social or advertising account you link, the credential itself in encrypted form, and the posts, messages, campaigns and performance figures the feature needs.
• What you send us: support messages, abuse and moderation reports, privacy requests and anything you attach to them.

Secrets are stored as secrets. Passwords are kept only as hashes and cannot be read back. API keys, recovery codes, two factor seeds, verification links and provider tokens are hashed or encrypted, and none of them appear in your data export in usable form.

• To run the thing you asked for: generating, storing, rendering, scheduling, publishing and exporting your work, and showing it back to you.
• To keep the account working: signing you in, keeping you signed in, sending password resets, verification and the notices you need to receive.
• To charge correctly: pricing a run, reserving and releasing credits, taking a payment, granting what you bought, and being able to reconcile all of it later.
• To keep the service safe: enforcing limits, detecting fraud and abuse, moderating content, investigating an incident, and protecting other people using it.
• To keep it working: error records, failure rates, latency and cost, so a broken model or a slow provider can be found and dealt with.
• To meet obligations we cannot opt out of: accounting records, tax, responding to a lawful request, and defending or bringing a claim.

Your prompts, uploads, generated media, chats, documents, brand material and connected account content are never used to train, fine tune or evaluate an AI model. Not ours, not a provider's, not anyone's. There is no setting to switch this off because it is not on.

We do not sell personal data, we do not rent it, and we do not share it with anybody to advertise to you. Neuvix carries no advertising pixel, no third party analytics script and no cross site tracking cookie.

Nobody at Neuvix browses your library. Staff access to account content is limited to what a specific job requires, such as investigating a fault you reported or acting on an abuse report, and it is recorded in an audit log.

The one feature that trains anything trains it for you: a character model built from images you supply, so a face stays consistent across a set of work. It belongs to your account, it never generates for anyone else, and it is deleted with the character or the account.

We measure the machinery, not the work. Failure rates, render times, queue depth and cost per run are what tell us something is broken. Reading your content is not part of that.

Neuvix does not run the models. When you start a generation, the request goes to the provider that runs the model you picked, and it carries what that request needs: your prompt, and the files it refers to. It does not carry your name, your email address, your payment details or your account profile.

Which provider runs a given request depends on the model you chose, and the model picker names the engine for every option it offers. Generation today reaches OpenRouter, fal.ai, BytePlus ModelArk, ElevenLabs, HeyGen and Beeble (SwitchX video editing), among others; the roster changes as models are added and retired, so the picker is current and this sentence is not.

Each provider applies its own terms and its own retention to a request made through it. We take that into account when we choose one, and the Licenses page points at their terms. A provider can also refuse a request that we would have allowed.

A few features reach a provider without generating media: web research for the automation agent, trend collection, and the content classifiers described below. They receive the query or the item being checked, on the same basis.

The service runs on infrastructure and vendors, each doing one job under contract and none of them free to use your data for their own purposes.

• Hosting, database, object storage, queues and content delivery for the servers Neuvix runs on.
• A transactional email service, which sends verification, password reset, security and billing messages. It sees your email address and the message.
• Payment gateways, which take the payment and return the result. They hold the card details we never receive.
• Content classifiers, which check prompts and images against the Acceptable Use Policy. They receive the item being checked.
• Error monitoring, when a deployment configures it, which receives crash and error reports. These can include a request identifier and a technical stack trace.
• Social networks and advertising platforms, when you connect one and ask us to publish, read or advertise through it. What reaches them is what you asked to send.
• Advisers, auditors and authorities, where the law requires it or a dispute makes it necessary, and a buyer or successor if the business is ever transferred, under the same commitments as this policy.

Files live in two places. Private storage requires a signed, expiring link that only the owner can obtain, and is used for source documents, rendered reports and other material with no reason to be reachable.

Generated media is served from public storage under an unguessable address. The bucket cannot be listed and there is no index, so nothing can be browsed or enumerated, but anyone holding the exact link can open it without signing in. That is deliberate: it is what lets Instagram fetch a video you scheduled, and what lets a provider read a reference image mid job.

The practical consequence is worth stating plainly. Treat a media link as a secret. If you paste one into a public channel, you have shared the file with everyone who reads that channel, and deleting the item is what withdraws it.

Deleting a generation removes it from your library and queues the underlying files for erasure from storage, including derived files such as video segments and thumbnails.

Most of the product is private to your account. Other users cannot see your library, your prompts, your projects, your automations or your connected accounts.

What is public is what you make public: a post you publish to the community gallery, along with your display name, handle, profile image and biography, and who you follow.

Publishing to the community is a deliberate act with a visible control, and unpublishing removes it from the gallery. Something you published and someone else has already copied is beyond anyone's recall, here as anywhere else.

Text and images are checked automatically at the points where they matter most: a chat message, a brand or marketing brief, an image added to a moodboard, and anything published to the community. The check is a classifier returning a verdict, not a person reading your work, and a request it blocks is refused before it costs you anything.

Every generation is also subject to the safety systems of the provider running the model, which are theirs and stricter in places than ours. A run a provider refuses fails, and a failed run is refunded.

A flagged item, or one that somebody reports, can be looked at by a person on the moderation team. That access is limited to the item concerned and is recorded.

Moderation decisions, reports and enforcement actions are kept as records so that a pattern is visible and an appeal can be reviewed against what actually happened.

Neuvix sets a small number of cookies and all of them are necessary: a short lived access token, a longer lived refresh token, a two factor challenge cookie, a sign in state cookie during an OAuth flow, and your language choice.

There is no advertising pixel, no third party analytics script and no cross site tracking cookie, which is why there is no consent banner: there is nothing optional to consent to. The Cookie Policy names each one and what it holds.

Sessions are short lived and can be revoked. Passwords are hashed. Provider credentials and two factor secrets are encrypted. Private storage is not publicly reachable, and no endpoint will hand one account another account's objects. Actions in the admin console are written to an append only audit log.

The part we cannot do for you: use a password you use nowhere else, turn on two factor authentication, and treat API keys and media links as secrets. Tell us quickly if something looks wrong, because early is the difference between a revoked session and a bad week.

No system is perfectly secure and nobody should claim otherwise. If a breach affects you, we will tell you what happened and what to do about it.

Your account and your work stay while the account exists. Nothing of yours is deleted on a timer, and there is no inactivity purge.

Operational error records are pruned after 30 days. Job queue entries are shorter still: a completed job is removed within about an hour and a failed one within a day, with character training kept up to seven days so a failure can be recovered.

Payment records, the credit ledger, subscription history and administrator audit entries are kept for as long as accounting and dispute rules require, and after account deletion they are kept in an anonymised form that no longer identifies a person.

Credits bought as a pack carry their own deadline, which is shown at checkout and on the Billing page. That is a billing rule rather than a retention rule, and it is described in Billing, Credits & Refunds.

Database backups are taken on a rolling schedule and are not rewritten when something is deleted from the live service. Deleted data can persist in a backup until that backup ages out. A backup is only ever restored to recover from a failure, and deletions are reapplied when one is.

You do not need our permission and you do not need to write to anybody. Both controls are in Account data settings and both work immediately.

Individual items can be deleted at any time from where they live: a generation from the library, a chat, a project, a document, a character, a voice, a published post. Deleting one removes the record and queues its files for erasure from storage.

Download export gives you a machine readable file of everything the live service holds for your account. Secrets are redacted, because handing you a readable copy of your own API keys and two factor seeds would be a security hole rather than a feature.

Delete account does what it says. It removes your profile, password, OAuth links, two factor secrets, API keys, sessions and connected account credentials, and it deletes your projects, prompts, generations, chats, automation documents, community content, uploads, voices, characters and moodboards. Stored files are queued for erasure, and provider side assets such as cloned voices and trained character models are queued for deletion at the provider.

One anonymised row remains, and it is worth explaining why. Payment records, the credit ledger and audit entries need a stable key to hang from, and deleting the account row outright would delete the financial history with it. So the account becomes a placeholder with no email, no name, no password and no way to sign in, and the retained records point at that instead of at you.

Deletion is refused while a payment is pending, a generation is running, or an advertising campaign is live, because each of those would otherwise complete against an account that has gone. Finish or cancel them and it proceeds.

What we cannot reach, we cannot delete. A post already published to Instagram, Facebook, YouTube or TikTok is under that platform's control: delete it there and revoke the app's access in that platform's settings. Backups age out on their own schedule, as described above.

Wherever you live, you can see what we hold, correct it, take a copy of it, and delete it. The first, second and fourth are screens in the product, and the third is the export button. We would rather you did not have to ask us for any of them.

Depending on where you live you may also have the right to restrict or object to processing, to withdraw a consent you gave, or to complain to a data protection regulator. Write to the address below and we will deal with it. Some requests have limits: we cannot delete an accounting record we are required to keep, and we may need to confirm who you are before acting on a request about an account.

Exercising any of this is free, and it does not affect how the service treats you.

Neuvix runs on servers in the European Union and stores its data there. Model providers, payment gateways and social platforms operate in other countries, so a request you make can be processed outside where you live.

Where a transfer needs a legal basis and safeguards, we put them in place with the vendor concerned.

Neuvix is for people aged 18 and over. It is not designed for children, not marketed to them, and not offered to them. If we learn that an account belongs to someone under 18 we will close it and delete what it holds, other than records we are required to keep.

This policy changes when the service or the law changes, and the effective date at the top moves with it. A change that materially affects you is announced in the product or by email before it takes effect, rather than slipped in.

The commitment in section 4 is not the kind of thing we intend to change quietly. If it ever changed, it would be announced, in advance, in plain words.

Privacy questions and rights requests go to the address below. Tell us what you want and which account it concerns. We may need to confirm your identity before we act, which is a protection for you rather than an obstacle.

Operator

Pioneers of Intelligence Ltd

Email

support@neuvix.io

Notice address

Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates