Current version, effective 2026-10-22 · All versions
Data Handling Terms
These Data Handling Terms ("DHT") supplement the Terms of Service for self-serve subscriptions and the Subscription Agreement for sales-assisted subscriptions.
Terms defined in the Terms of Service or Subscription Agreement, including "Customer Content," "Processing Data," and "Voice Input," have the same meaning in these DHT. "NeoSpline Controller Data" has the meaning given in the Data Processing Agreement.
1. Scope
These DHT describe NeoSpline's handling of Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data whether or not such data contains Personal Data.
Where this data contains Personal Data processed on Customer's behalf, the Data Processing Agreement applies to that Personal Data in addition to these DHT.
2. Product Account Data and Service Data
"Product Account Data" means organization account records and authorized-user records stored in NeoSpline's regional service database to provide the Services, such as organization display name, user name, user email address, role or membership, invitation status, account settings, subscription entitlement references, and organization administrative Audit Records (the customer-visible governance history for the organization).
Product Account Data follows the same storage-location commitments as Customer Content and Processing Data. For standard-tier customers, Product Account Data is stored at rest within the EEA on NeoSpline systems. Where an Enterprise Addendum applies, Product Account Data is stored according to the Designated Region specified in that Enterprise Addendum.
NeoSpline processes Product Account Data primarily on Customer's behalf to provide the Services and administer Customer's account. Where you use the Services as a Consumer for personal use, NeoSpline processes Product Account Data as a Data Controller as described in the Privacy Policy, and the processor/controller distinction described in this Section does not apply. Limited Product Account Data fields may also be processed by NeoSpline as an independent controller: (a) account identifiers, subscription tier, and billing contact details, where necessary for billing, legal compliance, security, fraud prevention, and service administration; and (b) authorized-user and organization business contact details (name, email address, organization name, and role), where necessary for account and customer relationship management, service communications, support, product feedback and feature-request tracking, and internal business operations. Where such processing involves Personal Data, NeoSpline's controller-side processing is described in the Privacy Policy and excluded from the Data Processing Agreement as NeoSpline Controller Data. This controller-side processing covers contact details only — it does not extend NeoSpline's use of Customer Content or Processing Data beyond Section 3.
"Service Data" means operational, security, telemetry, billing, and administrative data generated or used by NeoSpline to operate, secure, monitor, support, improve, bill for, and administer the Services, except for Product Account Data. Service Data includes authentication events, security events, API request metadata, API client/application identifiers, permission checks, authorization failures, rate-limit events, operational logs, performance metrics, error codes, correlation identifiers, and billing and administrative records. Service Data does not include Audit Records, which are Product Account Data. Billing and payment records held by the payment provider listed in the Sub-Processor List, including subscription billing records, are Service Data processed by that provider in the locations described in the Sub-Processor List; the subscription entitlement references stored in NeoSpline's regional service database are Product Account Data.
"Authentication Data" means the subcategory of Service Data consisting of authentication identifiers, account credentials and account profile attributes (such as name and email address) held by NeoSpline's authentication provider, login events, SSO and MFA events, and session and security events. Authentication Data does not include the transactional email messages that deliver verification or password-reset links; those messages are Service Data delivered by the transactional email Sub-Processor listed in the Sub-Processor List.
Service Data is processed in NeoSpline's EU operational environment. Where Service Data is processed or accessed outside the EEA (for example by a Sub-Processor listed in the Sub-Processor List) and contains Personal Data, the transfer safeguards described in Section 5 apply. Service Data must not include Customer Content, Processing Data, or Product Account Data, except for limited identifiers (which may include organization name), metadata, or correlation references necessary to operate, secure, or support the Services. NeoSpline implements technical and organizational controls to prevent Customer Content, Processing Data, and Product Account Data from being written into operational logs or telemetry.
Service Data does not include support requests and related support communications exchanged between Customer or its authorized users and NeoSpline. NeoSpline processes support and business contact records as Data Controller as described in the Privacy Policy. Where support communications contain Customer Content or Personal Data processed on Customer's behalf, the no-training commitment in Section 4 and the safeguards in the Data Processing Agreement apply to that content; support communications are processed in the locations described in the Sub-Processor List and are not subject to the storage-location commitments in Section 5.
Some Service Data may be Personal Data processed by NeoSpline as controller (for example, authentication events, security events, and billing administration records). Where NeoSpline processes such Personal Data as controller, this processing is described in the Privacy Policy and excluded from the Data Processing Agreement as NeoSpline Controller Data. Where specific Service Data contains Personal Data processed on Customer's behalf, the Data Processing Agreement applies to that Personal Data.
NeoSpline processes service usage and telemetry data as an independent Data Controller for the purposes of operating, maintaining, securing, and improving the Services. Where such data contains Personal Data, this processing is governed by the Privacy Policy and is outside the processor scope of the Data Processing Agreement as NeoSpline Controller Data.
3. Permitted Use
NeoSpline may use Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data only as reasonably necessary to:
- provide, operate, maintain, secure, and support the Services;
- deliver AI-assisted design features, including model inference and tool execution;
- process Voice Input for speech-to-text transcription;
- monitor service quality, performance, reliability, and safety;
- detect, prevent, and investigate misuse, abuse, security incidents, or technical issues;
- administer accounts, subscriptions, billing, and service communications;
- analyze usage and improve the Services, subject to the no-training commitment in Section 4;
- comply with applicable law or valid legal process;
- compile and disclose Service Data (such as authentication events, timestamps, IP addresses, request and feature metadata, and billing and administrative records) and billing contact details to NeoSpline's payment provider, card networks, issuing banks, or a competent court or authority, as reasonably necessary to contest disputed payments and chargebacks and to establish, exercise, or defend legal claims; this use is limited to Service Data and billing records and does not extend to the content of Customer Content, Processing Data, or Product Account Data; and
- enforce the Agreement and applicable use restrictions.
NeoSpline does not sell Customer Content, Processing Data, Product Account Data, Voice Input, Service Data, or Personal Data contained in them.
4. AI Model Providers and No-Training
NeoSpline uses AI model providers to deliver AI-assisted design features and voice transcription. Customer Content, Processing Data, and Voice Input are transmitted to AI providers only as reasonably necessary to provide inference or speech-to-text transcription functionality for the Services.
NeoSpline does not use Customer Content, Processing Data, Product Account Data, Voice Input, or Personal Data contained in them to train, fine-tune, or improve AI models. AI providers are contractually prohibited from using data received from NeoSpline to train, fine-tune, or improve their models.
AI inference providers keep inputs and outputs for up to 30 days for abuse monitoring, and then delete them. Processing locations are disclosed in the Sub-Processor List. Enterprise regional inference commitments apply only where stated in an Enterprise Addendum or applicable Order Form.
5. Data Location
NeoSpline-operated infrastructure for Customer Content, Processing Data, Voice Input and Product Account Data is located within the EEA by default. Customer Content, Processing Data, and Product Account Data are stored at rest within the EEA on NeoSpline systems for standard-tier customers.
For standard-tier customers, AI inference is performed through the AI infrastructure providers listed in the Sub-Processor List. NeoSpline does not make a contractual commitment to a specific AI processing region for standard-tier AI inference. NeoSpline contractually prohibits AI providers from using Customer Content, Processing Data, or Voice Input to train or improve their models. Where Customer Content, Processing Data, or Voice Input transmitted for standard-tier inference contains Personal Data and is processed outside the EEA, the United Kingdom, or a jurisdiction recognized as providing an adequate level of protection, a valid transfer mechanism applies: for business customers, the transfer safeguards in the Data Processing Agreement; for Consumers, the controller-level transfer safeguards described in the Privacy Policy.
Voice Input audio is transmitted to OpenAI for transcription through the /v1/audio/transcriptions endpoint. OpenAI's published API data controls (opens in a new tab) currently list this endpoint as not used for training and as having no abuse-monitoring retention and no application-state retention for submitted audio or transcription content. This endpoint-specific provider-side retention statement applies to all subscription tiers.
Enterprise customers may obtain data residency commitments under an Enterprise Addendum, available on request from support@neospline.ai. Where an Enterprise Addendum applies, Customer Content, Processing Data, and Product Account Data are stored and processed according to the Designated Region specified in that Enterprise Addendum.
The storage-location commitments in this Section apply to Customer Content, Processing Data, and Product Account Data. The following categories of Service Data are excluded from these commitments and are processed in NeoSpline's EU operational environment:
(a) Operational Logs — system health metrics, error codes, performance measurements, and request metadata (containing correlation identifiers but not Customer Content, Processing Data, or Product Account Data); and
(b) Authentication Data — as defined in Section 2.
Product Account Data is not excluded from the storage-location commitments. The storage-location commitments apply to the records held in NeoSpline's regional systems; copies of account, billing, and contact information held by the payment, support, and business service providers described in the Privacy Policy and the Sub-Processor List are not subject to them. NeoSpline implements technical controls to ensure Customer Content, Processing Data, and Product Account Data are not included in Operational Logs. Operational Logs contain structural metadata and correlation identifiers that reference records stored within the committed storage location. Selected security events also contain client IP addresses. Operational Logs do not contain the content of those records.
Where any data described in these DHT contains Personal Data and is transferred outside the EEA, the United Kingdom, or another jurisdiction recognized as providing an adequate level of protection, the transfer safeguards in the Data Processing Agreement apply where the processing is carried out on Customer's behalf; where NeoSpline acts as controller (including for all Consumer relationships), the transfer safeguards described in the Privacy Policy apply.
6. Retention and Deletion
NeoSpline retains Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data only for the periods needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and operational integrity.
| Category | Retention |
|---|---|
| Customer Content | Duration of account or Agreement, plus a 30-day export and deletion period after termination |
| Processing Data | Same retention as associated Customer Content, unless earlier deletion is technically feasible and no longer needed for service delivery |
| Product Account Data | Duration of account or Agreement, plus a 30-day deletion period after termination |
| Service-quality viewport images | 30 days; not included in backup systems |
| Voice Input | Audio processed in memory and discarded after transcription; transcribed text is ephemeral and retained only if sent as a chat message |
| Authentication and security events | Up to 12 months for security incident investigation and compliance, extendable where required for an active security investigation, payment dispute, or legal claim; these events are Service Data and must not contain Customer Content, Processing Data, or Product Account Data. This period applies to events only; account credentials and profile attributes held by the authentication provider are retained for the duration of the account |
| Billing, accounting, and tax records | As required by applicable tax and accounting law (typically 5 years) |
Where specific records are reasonably necessary for an active payment dispute, chargeback, or other legal claim, NeoSpline may retain those records beyond the periods above until the dispute or claim is finally resolved. Such records are used only for that purpose, protected by the same security measures, and deleted or returned to the standard retention period when the matter closes.
Customer Content, Processing Data, and Product Account Data may persist in encrypted backup systems beyond primary retention periods until overwritten by the backup rotation cycle, typically within 90 days beyond the primary retention period. Backup data is encrypted at rest, access-restricted, and used only for disaster recovery.
Data export and switching procedures are described in the Data Portability document.
7. Access Controls
NeoSpline personnel may access Customer Content, Processing Data, and Product Account Data only where reasonably necessary to provide and operate the Services, monitor service quality, detect anomalies, ensure system performance, investigate suspected misuse, provide support, comply with applicable law, or respond to valid legal process.
Personnel access is subject to role-based access controls, least privilege, audit logging, confidentiality obligations, and the principle of data minimization.
8. Security Measures
NeoSpline implements technical and organizational measures designed to protect Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data from unauthorized access, loss, misuse, alteration, and disclosure. The current baseline measures are described in the Data Processing Agreement Appendix 2.
Additional security posture details are available on request through the security documents form (opens in a new tab).
9. Sub-Processors and Transfers
NeoSpline uses service providers and, where applicable, Sub-Processors to provide hosting, authentication, AI inference, transcription, logging, email, support and feedback management, payment, and, where they act as processors on NeoSpline's behalf, other operational services. Payment and certain other providers act as independent controllers rather than Sub-Processors; their roles are described in the Privacy Policy and the Sub-Processor List. The current list of Sub-Processors, processing locations, provider-side retention commitments, and transfer safeguards is maintained in the Sub-Processor List.
Where a Sub-Processor handles Personal Data on behalf of Customer, the Sub-Processor obligations and transfer safeguards in the Data Processing Agreement apply. Where NeoSpline acts as controller (including for Consumers), the corresponding safeguards described in the Privacy Policy apply.
10. Changes
NeoSpline may update these DHT as described in the Agreement. If a change materially reduces NeoSpline's commitments for Customer Content, Processing Data, Product Account Data, Voice Input, or Service Data, NeoSpline will provide notice consistent with the Agreement.