Privacy Policy

Last updated: August 13, 2026

1. Overview

NeonData ("we," "our," or "us") operates a marketing data aggregation platform for service businesses. This Privacy Policy explains how we collect, use, store, and protect information in connection with our Service. We are committed to protecting both your personal data and the business data of your customers.

2. Information We Collect

Account information: Name, email address, company name, and billing information when you register for the Service.

Connected source data: Marketing and operational data from third-party sources you explicitly connect (Google, Meta, Ahrefs, Uberall). This includes search performance metrics, ad spend data, website analytics, and business listing information. We access only the data scopes you authorize.

Usage data: Information about how you interact with the platform, including API calls, dashboard views, and feature usage — used to improve the Service.

Technical data: IP addresses, browser type, and session information for security and operational purposes.

Patient communications data: When a clinic using NeonData EMR enables patient text messaging, we process patient phone numbers, opt-in consent records, and message content on the clinic's behalf, solely to deliver the messages the clinic initiates (see Section 12).

3. How We Use Your Information

• To provide, operate, and improve the Service
• To aggregate and transform marketing data into structured formats for your AI tools and dashboards
• To authenticate and secure your account and API access
• To send service-related communications (onboarding, security alerts, feature updates)
• To comply with legal obligations

We do not use your connected marketing data for advertising, cross-customer profiling, or any purpose other than operating the Service on your behalf.

4. Google API Data

NeonData's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google data is used only to provide and improve user-facing features of the Service
• Google data is not used to serve advertising
• Google data is not transferred to third parties except as necessary to provide the Service
• No human reads your Google data except with your explicit permission for support purposes

5. Data Storage and Security

Your data is stored in isolated, account-scoped partitions in encrypted cloud storage (AWS S3 or equivalent). API credentials are encrypted at rest using industry-standard symmetric encryption. Access to your data requires authenticated API keys that you control.

We implement technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit (TLS), access logging, and regular security reviews.

6. Data Sharing and Third Parties

We do not sell your data. We may share data with:

• Infrastructure providers: Cloud storage and compute (under data processing agreements)
• Legal requirements: When required by law, court order, or to protect rights and safety
• Business transfers: In the event of a merger or acquisition, with notice and the same privacy protections

Mobile phone numbers, text-messaging opt-in data, and consent records are never shared with third parties or affiliates for marketing or promotional purposes (see Section 12).

7. Data Retention and Deletion

Connected source data is retained while your account is active to support historical trend analysis. Upon account termination, you may request deletion of all stored data within 90 days. Account records are retained for a minimum of 3 years for legal and billing purposes.

You may request deletion of specific data or revoke third-party source connections at any time through the admin dashboard.

8. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access a copy of your personal data we hold
• Correct inaccurate personal data
• Request deletion of your personal data ("right to be forgotten")
• Object to or restrict certain processing activities
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact us at privacy@neondata.co.

9. Cookies and Tracking

The Service (app.neondata.co) uses session cookies solely for authentication. The NeonData marketing website (neondata.co) uses our own first-party analytics pixel (nd.js) to collect privacy-safe usage data: pageviews, session counts, scroll depth, and conversion signals such as call clicks and form submissions. This pixel is cookieless by default — no durable tracking cookie is set unless you explicitly accept via the consent banner. It never transmits form field values, and all data is stored on NeonData's own servers and never sold or shared with advertising platforms. You may decline tracking via the consent banner or by setting window.ndConsent = false before the script loads.

10. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the Service. Continued use after the effective date of changes constitutes acceptance.

12. Mobile Information and Text Messaging

When a clinic using NeonData EMR enables patient text messaging, we process patient phone numbers, opt-in consent records, and message content on behalf of that clinic, solely to deliver the messages the clinic initiates — such as appointment reminders, confirmations, and other care-related notifications.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text-message services, and only to the extent necessary to deliver the messages you have consented to receive.

You can opt out of text messages at any time by replying STOP to any message, or by contacting the clinic that sends them. Reply HELP for assistance. Message and data rates may apply, and message frequency varies. Full messaging terms are in Section 12 of our Terms of Service.

13. How to Delete Your Data

You can remove your data from NeonData at any time. There are two steps, and you can do either independently.

1. Disconnect the source. Sign in at https://app.neondata.co/portal, open your account page, find the connected source under Data Sources, and choose Disconnect. This immediately deletes the stored access credentials for that source and stops all further data collection. You can do this yourself, without contacting us.

2. Request deletion of data already collected. Email privacy@neondata.co from the address associated with your account, stating which account and which source you want erased. We delete the corresponding records within 30 days and confirm by email.

Facebook and Instagram. For data obtained through a connected Facebook Page or Instagram Business account, you may additionally revoke NeonData's access directly from Facebook: go to Settings & Privacy → Settings → Business Integrations, select NeonData, and choose Remove. Revoking access there stops future collection; email us as described above to also erase data already stored.

Deleting an account removes its ingested source data, stored credentials, and derived reporting. We may retain limited billing and audit records where required by law.

14. Protected Health Information (NeonData EMR only)

This section applies only to clinics using NeonData EMR, which is an optional module. If your account does not have it enabled, NeonData holds no protected health information ("PHI") about your patients. Marketing and operational data — search performance, ad spend, website analytics, listings, documents — is not PHI, and none of the rest of this policy changes because NeonData EMR exists.

What we process. Where a clinic enables NeonData EMR, we process the patient information that clinic enters or generates: identity and contact details, appointments, clinical notes and amendments, treatment and product records, clinical photographs, and — where patient messaging is switched on — phone numbers, consent records, and message content.

Our role. We process this only on the clinic's instructions, as its service provider and HIPAA Business Associate under a Business Associate Agreement. The clinic, not NeonData, decides what is collected and who may see it.

What we never do with it. PHI is not used for advertising or marketing, is not sold or shared for anyone else's marketing, is not used to train artificial-intelligence models, and is not exposed through the MCP server or any AI-agent interface — those reach marketing and document data only.

Safeguards. Clinical data is isolated per clinic at the database level, so one tenant's records are unreachable from another's. Access is recorded in an append-only audit log that the application itself cannot alter or delete. Data is encrypted in transit and at rest. Clinical photographs are stored in a dedicated location separate from marketing data, reachable only by the clinical system.

Sub-processors. We use cloud infrastructure providers to host the service, and a telecommunications provider where a clinic enables patient messaging. We engage these under written agreements appropriate to the data involved.

If you are a patient. Your rights of access, correction, and restriction under HIPAA run against the clinic that treats you, not against NeonData — we hold your records on that clinic's behalf and cannot release or amend them on our own initiative. Contact your clinic directly. We support clinics in answering such requests, and you may reach us at privacy@neondata.co if your clinic directs you to.

Retention and breach notification. PHI is retained, returned, or destroyed as the clinic instructs and as the Business Associate Agreement requires — Section 7's general retention terms do not override it. We notify the clinic of any breach of unsecured PHI within the timeframes that agreement and applicable law require.

15. Contact

For privacy questions or to exercise your rights: privacy@neondata.co

NeonData · Legal inquiries: legal@neondata.co