Legal · NEIGH Ltd

Privacy Policy

Effective: 1 January 2026 · Last updated: 5 July 2026 · Version 2026.07

Contents

01Scope & controller

This Privacy Policy describes how NEIGH Ltd (“NEIGH”) collects, uses and shares personal data when you visit our websites at neighpalm.com and neigh.io, use the NEIGHPalm platform, contact us, or interact with our advisory services (the “Service”).

For visitors and prospects, NEIGH is the controller of personal data. For Customer end-users acting on behalf of a Customer organization, NEIGH acts as a processor under the Data Processing Addendum executed with that Customer; this Policy still describes our practices as background.

B2B-only by design. NEIGH does not store or process the personal data of consumer or end-user data subjects as part of the Service. The Service is contracted, deployed and operated in a strict business-to-business context: the only natural persons whose personal data we process are the Customer’s authorised users (employees, advisors, auditors) and our own contacts at the Customer organisation, in each case in their professional capacity.

Any data the Customer enters into compliance registers, risk registers, vendor registers, evidence repositories, policy stacks or similar workspaces inside the platform is Customer Data: it is owned and controlled by the Customer, processed by NEIGH only on the Customer’s documented instructions under the DPA, and is the Customer’s responsibility to keep free of consumer or special-category personal data the Service is not designed to host. NEIGH does not mine, profile, monetise, sell or share Customer Data, and does not use it to build or train shared or public models.

02Data we collect

Category	Examples
Account & identity	Name, work email, role, company, password hash, MFA factors
Service usage	Logs, IP address, device and browser, pages and features used, timestamps
Customer Data	Policies, controls, evidence, risk / compliance / vendor registers, configurations and integrations the Customer uploads or connects. Owned and controlled by the Customer; processed by NEIGH only on the Customer’s instructions under the DPA. Not for consumer / data-subject personal data — the Service is B2B-only.
Communications	Sales, support and operational emails; chat transcripts; meeting notes
Billing	Order details, billing address, taxpayer ID; payment data is processed by our payment processor and we do not store card numbers
AI interactions	Prompts and responses entered into Designated AI Interfaces, agent traces and tool-use logs

03Purposes & legal bases

We process personal data to: (i) provide and operate the Service; (ii) authenticate users and prevent abuse; (iii) bill and account; (iv) respond to enquiries and provide support; (v) secure the Service and investigate incidents; (vi) comply with legal obligations; and (vii) measure, debug and improve the Service. Our legal bases under GDPR/UK GDPR are contract performance, legitimate interests (running and securing our business), legal obligation, and consent (where required, e.g. for non-essential cookies).

04Cookies & tracking

We use strictly-necessary cookies to authenticate sessions and remember preferences. Non-essential cookies (analytics) are set only after you consent.

Consent management. Our cookie-consent banner is provided by Cookiebot (Usercentrics A/S / Cybot A/S). It lets you accept or reject non-essential cookies and automatically blocks non-essential and third-party scripts — including Google Analytics — until you consent. Your choice is stored in a first-party CookieConsent cookie (retained up to 12 months) and in an anonymised consent record. You can change or withdraw your consent at any time via the banner. Strictly-necessary cookies — including the anti-abuse security check on our contact form (Cloudflare Turnstile) — are treated as essential and are not gated by consent.

For analytics we run two complementary tools:

Vercel Web Analytics — first-party, cookieless, served from our own origin (/_vercel/insights/script.js). Anonymous visitor IDs only; no cookies set.
Google Analytics 4 (gtag.js) — third-party, deployed on both the marketing site (G-FT0JRR913Q) and the customer-facing app (G-022644RPK4) as separate properties. GA4 is auto-blocked by our consent banner and loads only after you accept statistics cookies. When enabled, it sets cookies (typically _ga, _ga_FT0JRR913Q, _ga_022644RPK4) and sends page path, user-agent, device class, referrer and IP (anonymized server-side by Google) to Google LLC for aggregate traffic measurement and traffic-source attribution. See the sub-processor table in §6 for the data-flow and transfer mechanism details.

We do not sell personal data and do not run third-party advertising, remarketing or cross-context behavioural-advertising trackers on the marketing site. You can opt out of Google Analytics via our cookie banner (reject statistics cookies), by installing the Google Analytics Opt-out Browser Add-on, or by blocking the googletagmanager.com domain in your browser. You can control all cookies through your browser; rejecting non-essential cookies will not prevent core use of the Service.

05AI training, crawlers & Output

Bottom line. We do not train shared, cross-tenant or publicly released AI models on Customer Data. We block AI crawlers from our public surfaces. AI use of the Service is permitted only through NEIGH’s Designated AI Interfaces.

5.1 No training on Customer Data

Customer Data — including documents, evidence, prompts you enter into the AI-vCISO interface, and AI agent traces in your tenant — is not used to train shared or publicly released NEIGH foundation models. Within a tenant, we may use Customer Data to fine-tune or contextualize models for that tenant only, with effects scoped to that tenant.

5.2 Sub-processor model providers

We may route Designated AI Interface requests to sub-processor model providers under contracts that prohibit training on our prompts and outputs and that mandate short retention windows. The current list is published in our DPA sub-processor schedule.

5.3 AI crawlers and scrapers

Our marketing site, app and APIs do not authorize ingestion by third-party AI crawlers, dataset builders or LLM training pipelines. We publish robots.txt, X-Robots-Tag, noai/noimageai meta directives and TDM Reservation signals reserving rights under EU Directive 2019/790 Art. 4(3), the UK CDPA, U.S. and equivalent law. Honoring those signals is required. See Terms §6 for the full restriction list.

5.4 Output and review

Outputs from Designated AI Interfaces may contain inaccuracies and must be reviewed by a qualified human before being used as audit evidence, regulatory submission or external attestation.

06Sharing & sub-processors

We share personal data only with: (a) sub-processors that operate the Service under written agreements (cloud infrastructure, observability, model providers, support tooling, payment processing); (b) professional advisors under confidentiality; (c) authorities where legally required, with notice to the Customer when permitted. We do not sell personal data and we do not share it for cross-context behavioral advertising.

6.1 Sub-processor governance

Each sub-processor is engaged under a written contract that imposes data-protection obligations no less protective than those in our Data Processing Addendum (DPA), including confidentiality, purpose-limitation, security, sub-processor onboarding controls, audit rights, breach notification, return / deletion of data on termination, and the relevant transfer mechanism for cross-border processing. We perform a documented risk and security review before engagement and reassess annually or on material change. Customers can subscribe to advance notice of material sub-processor changes via our Trust Center; reasonable objection rights are described in the DPA.

6.2 Current sub-processors

The list below covers sub-processors that may process personal data on NEIGH’s behalf as of the “Last updated” date above. The authoritative live list is published in the Trust Center.

Sub-processor	Purpose	Data categories	Hosting region	Transfer mechanism (where applicable)
Amazon Web Services, Inc. United States	Primary cloud infrastructure, compute, storage, networking, key custody and managed databases for the NEIGHPalm platform.	Account & identity data, Customer Data, audit-evidence artefacts, application logs.	EU (Ireland / Frankfurt) primary; US for tenants electing US residency.	EU SCCs (Modules 2 & 3) with the AWS DPA; UK IDTA addendum; Swiss FDPIC clauses. AWS DPF certification relied on as supplementary safeguard. Encryption in transit (TLS 1.2+) and at rest (AES-256, KMS).
Vercel Inc. United States	Marketing-site hosting and edge delivery for neigh.io and neighpalm.com; build & deployment pipeline; first-party cookieless Web Analytics.	Visitor IP, request metadata, basic analytics. No Customer Data.	Global edge network; control plane in the US.	EU SCCs with the Vercel DPA; UK IDTA addendum. Vercel DPF certification relied on as supplementary safeguard. TLS 1.3 in transit.
Google LLC United States	Marketing-site (`G-FT0JRR913Q`) and customer-facing app (`G-022644RPK4`) analytics via Google Analytics 4 (`gtag.js`) — aggregate traffic measurement, traffic-source attribution, device/browser/geographic breakdown. Separate GA4 properties so app and marketing data don’t cross-contaminate reports.	Visitor IP (anonymized server-side by Google), page path, user-agent, device class, referrer, session timestamps, GA cookie identifiers. No Customer Data.	Global edge; primary processing in US data centers.	EU SCCs (Modules 2 & 3) with the Google Ads Data Processing Terms; UK IDTA addendum. Google EU-U.S. Data Privacy Framework (DPF) certification relied on as supplementary safeguard. TLS in transit.
Usercentrics A/S (Cookiebot) Denmark / Germany (EU)	Cookie-consent management platform (CMP) — presents the consent banner, records and stores end-user consent, and periodically scans the marketing site for cookies and trackers.	Visitor IP address (stored anonymised/encrypted in the consent record), consent state, user-agent, timestamp and an anonymous consent key. No Customer Data.	EU (Azure, Ireland).	EU-based processor — no third-country transfer for EEA/UK visitors. EU SCCs / UK IDTA available under the Usercentrics DPA where applicable.
Anthropic, PBC (Claude) United States	Model provider for Designated AI Interfaces (AI-vCISO, agentic compliance workflows, drafting and review).	Prompts and responses entered into Designated AI Interfaces; tool-use traces. No model training on our prompts or outputs.	United States (zero-data-retention enterprise endpoints where available).	EU SCCs (Module 2) with the Anthropic Commercial DPA; UK IDTA addendum. Contractual prohibition on training on NEIGH or Customer prompts & outputs; short retention windows; abuse-only logging.
OpenAI, L.L.C. United States	Alternate model provider for Designated AI Interfaces; embeddings; specialised reasoning workloads.	Prompts and responses entered into Designated AI Interfaces; embeddings of indexed Customer documents. No model training on our prompts or outputs.	United States (enterprise / zero-data-retention endpoints where available).	EU SCCs (Module 2) with the OpenAI Enterprise DPA; UK IDTA addendum. Contractual prohibition on training on NEIGH or Customer prompts & outputs; configurable retention; abuse-only logging.
Atlassian Pty Ltd — Jira Software Australia / United States	Internal engineering ticketing, change management and product backlog supporting the security & release lifecycle.	Internal employee identifiers; limited issue metadata referencing Customer accounts (no Customer Data payloads).	EU (Frankfurt) data residency for production tenants.	EU SCCs with the Atlassian DPA; UK IDTA addendum. Atlassian DPF certification relied on as supplementary safeguard.
Atlassian Pty Ltd — Jira Service Management Australia / United States	Customer support & ticketing portal for the NEIGHPalm platform.	Requester identity (name, business email), support correspondence, attachments voluntarily provided by the requester.	EU (Frankfurt) data residency for production tenants.	EU SCCs with the Atlassian DPA; UK IDTA addendum. Atlassian DPF certification relied on as supplementary safeguard.

6.3 Notice of changes

NEIGH will give Customers prior written notice (via the Trust Center and, on request, by email) of any intended addition or replacement of a sub-processor that processes Customer Data, with reasonable opportunity to object on legitimate data-protection grounds before the change takes effect. Where the Customer reasonably objects and the parties cannot agree on a workaround within a commercially reasonable period, the Customer may terminate the affected portion of the Service in accordance with the DPA.

07International transfers

Where we transfer personal data outside the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism. We perform transfer impact assessments and apply supplementary safeguards (encryption in transit and at rest, access controls, key management).

08Retention

We retain personal data only for as long as needed for the purposes set out above, then delete or anonymize it. Account and audit-relevant logs are typically retained for the duration of the subscription plus 12 months for legal-claims defense. Customer Data is deleted within 30 days of contract termination unless retention is legally required.

09Security

NEIGH operates an information security program aligned with ISO 27001 and SOC 2 control families. Controls include encryption in transit (TLS 1.2+) and at rest, role-based access, MFA enforcement, least-privilege production access, vulnerability management, incident response and ongoing employee training. No system is perfectly secure; please report suspected vulnerabilities to operations@neigh.io.

10Your rights

Subject to applicable law (including GDPR/UK GDPR, CCPA/CPRA and equivalents), you may have rights to access, correct, delete, port, restrict or object to processing, and to withdraw consent. To exercise rights, email operations@neigh.io. If you are a Customer end-user, please direct rights requests to your organization first; we will support them as a processor. You may also lodge a complaint with your supervisory authority.

11Children

The Service is for business users and is not directed to children under 18. We do not knowingly collect personal data from children.

12Changes

We may update this Policy from time to time. Material changes will be communicated by email or in-product notice. The “Last updated” date above reflects the current version.

13Contact & DPO

NEIGH Ltd · operations@neigh.io