Current version, effective 2026-10-22 · All versions
Privacy Policy
Terms defined in the Terms of Service (for self-serve subscriptions) or Subscription Agreement (for sales-assisted subscriptions), the Data Processing Agreement, and the Data Handling Terms, including "Product Account Data" and "Service Data," have the same meaning in this Privacy Policy.
Introduction
This Privacy Policy explains how NeoSpline ApS ("NeoSpline", "we", "us") collects and uses personal data. It also describes your rights and how to exercise them.
We may update this Privacy Policy from time to time. Each version shows the date it was published and the date it takes effect, and earlier versions stay available on this page.
This Privacy Policy does not apply to information collected as part of recruitment for employment at NeoSpline.
Who We Are
NeoSpline ApS is a company registered in Denmark (CVR 46494008). See our Imprint for full company details.
For questions about privacy and data protection: privacy@neospline.ai
Data Roles
Consumers (personal use). Where you use the Services as an individual for purposes outside your trade, business, craft, or profession (a "Consumer"), NeoSpline is the Data Controller of all Personal Data we process about you, including any Personal Data contained in your Customer Content, Processing Data, and Voice Input. The Data Processor role described below does not apply to you; instead, this Privacy Policy governs our processing of your Personal Data, the legal bases set out in "How We Use Your Information" apply directly, the safeguards in "International Transfers" apply to any transfer of your Personal Data (including AI inference), and you may exercise the rights in "Your Rights" directly with us.
We act as Data Controller for business contact data, billing, marketing communications, website analytics, authentication and security administration, CRM and sales data, support and business contact records, account and customer relationship management (including the business contact details — name, email address, organization name, and role — of authorized users), internal business records, legal compliance records, service administration, product feedback and feature-request tracking, and other NeoSpline Controller Data.
We act as Data Processor for Personal Data processed on Customer's behalf through the Services, including Personal Data contained in Customer Content, Processing Data, Product Account Data, Voice Input, and support requests concerning the Services submitted by Customer's authorized users. See our Data Processing Agreement for data processing terms and our Data Handling Terms for general data handling commitments.
What Information We Collect
You may provide us information directly or indirectly when you:
- Create an account
- Use the NeoSpline plugin, web platform, APIs, and services
- Contact us for support, including through the support chat
- Subscribe to communications
- Send us a request through a form on our website
- Visit our website
Information we collect:
| Category | Examples |
|---|---|
| Product Account Data | Organization name, authorized-user name, email address, role or membership, account settings |
| Authentication Data | Login events, authentication identifiers, SSO/MFA events, session and security events (as defined in the Data Handling Terms) |
| Service Data | Operational logs, API request metadata, performance metrics, error codes, correlation IDs |
| Usage Data | Information about how you use the Services, such as features and tools used, the number and duration of AI agent runs, aggregate token and cost metrics, actions performed in the product, and ratings or feedback you submit in the product — not the content of your designs or conversations |
| Diagnostic Data | Error events, crash reports, performance and stability metrics, and other diagnostic signals from the plugin, web platform, and APIs |
| Business Contact Data | Sales, CRM, support, contract, and marketing contact details, and email engagement information (such as whether you open or click emails we send) |
| Technical data | IP address, browser and device metadata, operating system, host application environment (such as Rhino version and service release), plugin version, software environment details (such as runtime and framework versions), document environment settings (such as units and tolerance), API client/application identifiers, regional endpoint and zone-routing metadata, and other similar technical information |
| File attachments | Images, documents, and other files you upload and attach to chat messages |
| Voice Input | Audio recording — see Voice Input below |
| Support chat data | Messages and attachments you send in the support chat; on the web platform and in the Support tab of the Rhino plugin, the account identity details we send to Intercom so it can recognize you, such as your name, email address, and organization; on our website, the technical data Intercom collects automatically (see "Where we collect information from") |
| Payment data | Billing contact, payment method (processed via our payment provider — we do not store cards) |
Usage Data and Diagnostic Data are categories of Service Data (as defined in the Data Handling Terms) and never include the content of your designs or conversations.
We also process Customer Content (including file attachments you upload to chat messages), Processing Data, Product Account Data, and Voice Input on Customer's behalf solely to provide the Services. See our Data Handling Terms for general data handling commitments and our Data Processing Agreement where those data contain Personal Data processed on Customer's behalf.
Where we collect information from:
- Directly from you — Product Account Data (account creation, profile, organization membership), API client or integration setup details where applicable, file attachments (images, documents, and other files you upload to chat messages), Voice Input (when you explicitly use the Voice Input feature), Business Contact Data (support requests, feedback, web forms such as interest signup or enterprise enquiries), payment data (billing details)
- Automatically from your use of the Services — Service Data (API request metadata, permission and authorization events, operational logs), Usage Data and Diagnostic Data (such as features used, performance metrics, and error data), technical data (IP address, browser or device metadata, OS, host application and plugin versions, API client/application identifiers, regional endpoint and zone-routing metadata, and other similar environment details), metadata about CAD model changes (during active AI conversations — see below)
- Automatically from the support chat — when you open the support chat, Intercom collects your IP address, browser and device type, operating system, language, and browser storage identifiers (in the Support tab of the Rhino plugin, the storage identifiers of its webview; see the Cookie Policy), and the address of the page where you open the support chat. For our workspace, Intercom has turned off page-view tracking, referrer and campaign tracking, and location lookup from IP addresses
- From third-party services — payment data (transaction status from our payment provider)
- Forms on our website — your contact details, information about your organization, and the other details you give us so that we can answer your request. Each form also records two ticks: a required one that allows us to contact you about your request, and an optional one for marketing email
- Country — when you send a form on our website, our content delivery network (Amazon CloudFront) derives your country from your IP address and passes it to our systems. When an organization signs up for an account, our authentication provider (Auth0) derives the country of the person who signs up from the IP address of the signup request. We store the country code, not the IP address, in our CRM, and we keep it only on the queue entry that creates the CRM record until that record exists
- Public sources — publicly available professional profiles (e.g. LinkedIn) in connection with sales and business development
How We Use Your Information
| Purpose | Processing activity | Legal Basis (GDPR) | Service providers (examples) | Third-country transfer |
|---|---|---|---|---|
| Provide and operate our services | Account creation, web platform and API access, service delivery, AI-assisted design features, Voice Input transcription (transient processing) | Art. 6(1)(b) — performance of a contract | AWS, Auth0, OpenAI (Voice Input transcription only), and the AI inference providers listed in the Sub-Processor List | Yes — see Sub-Processor List |
| Customer support and communications | Responding to requests, providing support, facilitating communications, tracking reported issues and follow-ups, including requests about your contract such as withdrawals, cancellations, and refunds. When you use the support chat on the web platform or in the Support tab of the Rhino plugin, we send Intercom the account identity details listed under "What Information We Collect" (Support chat data), so that Intercom shows you your own conversations and our support team sees who is writing. A support conversation may be stored with the matching contact in our CRM, so that our support team sees the full history. | Art. 6(1)(f) — legitimate interests (customer service); Art. 6(1)(b) — performance of a contract, and Art. 6(1)(c) — legal obligation, for requests about your contract | Intercom, Linear, Pipedrive, Mailgun, Google Workspace | Yes — DPF/SCCs |
| Website pre-sales chat | Answering questions from website visitors who start a chat before they hold an account, including demo requests. Intercom collects your IP address, browser and device data, the address of the page where you open the chat, and browser storage identifiers automatically, and the messages you write. We send Intercom no account identity from the website; if you give us your name or email address in the chat, we store it with the conversation. If the email address matches a contact in our CRM, the conversation may be stored with that contact. A visitor with no matching contact stays in Intercom only. Intercom stores the browser entries described in the Cookie Policy: on the website, only after you accept cookies or click our chat button | Art. 6(1)(f) — legitimate interests (answering pre-sales enquiries and business development); Art. 6(1)(b) where you ask for steps before entering a contract. Storing information on your device rests on your consent or your explicit request for the chat, as set out in the Cookie Policy | Intercom, Pipedrive | Yes — DPF/SCCs. Intercom hosts our workspace in the United States and relies on the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback |
| Website requests | Handling a request that you send through a form on our website: we create a contact and a lead for you in our CRM with the details you give us, send you an email to confirm that we received your request (a copy of that email is stored with your contact in our CRM), and contact you about the request. We also post a notification with your email address and a link to the lead in our internal team chat. If you tick the optional marketing box, we send you an email to confirm your subscription and add your email address to our marketing list only after you confirm; your request does not depend on that tick | Art. 6(1)(f) — legitimate interests (answering requests and business development); Art. 6(1)(b) where you ask for steps before entering a contract; Art. 6(1)(a) — consent, for the optional marketing tick | Pipedrive, Mailgun, Slack, Brevo (marketing tick only) | Yes — DPF/SCCs |
| Account and relationship management | Managing the customer relationship and accounts, recording and following up on product feedback and feature requests, and referencing authorized-user contact details (name, email, organization, role) in our internal business tools for those purposes | Art. 6(1)(f) — legitimate interests (customer relationship management) | Pipedrive, Linear, Notion, Slack, Google Workspace | Yes — DPF/SCCs |
| Service and security notifications | Security alerts, maintenance notices, service announcements | Art. 6(1)(f) — legitimate interests; Art. 6(1)(c) where required by law | Mailgun | Yes — DPF/SCCs |
| Website analytics (with consent) | Understanding how visitors use our website (pages visited, traffic sources). Cookie-based; only active with your consent via our cookie banner — see Cookie Policy | Art. 6(1)(a) — consent | PostHog | Yes — SCCs (event data hosted in EU) |
| Aggregate audience measurement | Counting visits to our website and web platform in aggregate without storing anything on your device, using a pseudonymous, daily-rotating identifier designed to minimize personal data. On the website this applies if you decline analytics cookies; on the web platform it is the only browser-based analytics we use — see Cookie Policy | Art. 6(1)(f) — legitimate interests (audience measurement) | PostHog | Yes — SCCs (event data hosted in EU) |
| Service quality and safety | Automated anomaly detection, service performance monitoring, and investigation of suspected misuse. We use client IP addresses to rate-limit traffic and retain them in a limited set of security-event logs when we block or rate-limit abusive connections or traffic. | Art. 6(1)(f) — legitimate interests (service integrity and safety) | AWS, Auth0, BetterStack | Yes — DPF/SCCs (Auth0) |
| Product development and improvement | Product analytics: analyzing Usage Data and Diagnostic Data from the plugin, web platform, and APIs to understand how the Services are used, improve features, and fix defects. Events are collected by our own servers — not through cookies or your browser — and are keyed to an internal user identifier and organization identifier, never your name, email address, or the content of your designs or conversations. You may object at any time — see Your Rights | Art. 6(1)(f) — legitimate interests (product improvement) | PostHog | Yes — SCCs (event data hosted in EU) |
| Marketing communications | Newsletters, product updates, promotional emails, including when you tick the marketing box on a form on our website and confirm your subscription by email | Art. 6(1)(a) — consent (opt-in only) | Brevo, Typeform | No (EU) |
| CRM and sales management | Managing business contacts, sales pipeline, lead qualification, contract execution. Our CRM holds contact details (such as name, email address, phone number, organization, role, and country), account details (such as organization name, signup date, and internal account identifiers), and subscription details (such as plan, status, and billing dates). When our systems create or change a CRM record for a new account, the changed field values, which can include names, email addresses, and phone numbers, are also posted to an internal team chat channel. With notice at the start of the call, we may also record and transcribe sales and customer calls for note-taking and follow-up purposes | Art. 6(1)(f) — legitimate interests (business development) | Pipedrive, Slack, DocuSign, Google Workspace, Typeform | Yes — DPF/SCCs |
| Subscription analytics | Tracking subscription metrics, revenue reporting | Art. 6(1)(f) — legitimate interests (business operations) | ChartMogul | No (EU) |
| Billing and payment processing | Processing payments, managing subscriptions | Art. 6(1)(b) — performance of a contract | Stripe | Yes — DPF/SCCs |
| Payment-dispute and legal-claims defense | Compiling records of account activity (login and authentication events, timestamps, IP addresses, request and feature-usage metadata) and billing records, and submitting them to our payment provider — and through it to the card network and issuing bank — or to a competent court or authority, to contest disputed charges and chargebacks and to establish, exercise, or defend legal claims | Art. 6(1)(f) — legitimate interests (defense against unjustified payment disputes; enforcement of payment claims) | Stripe | Yes — DPF/SCCs |
| Internal business operations | Internal documentation, collaboration, communications, automations, project management, document storage, day-to-day business administration, and use of productivity AI tools to automate internal business processes | Art. 6(1)(f) — legitimate interests (business administration) | AWS, Notion, Slack, Linear, Dropbox, Google Workspace, OpenAI, Anthropic | Yes — SCCs; DPF where the provider is self-certified |
| Compliance with legal obligations | Accounting records, tax compliance, regulatory responses, record keeping | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests | e-conomic, Dropbox | Yes — DPF/SCCs |
The "DPF where the provider is self-certified" reference in the Internal business operations row applies to internal business tools only. Transfers for AI inference within the Services rely on Standard Contractual Clauses (SCCs) as listed on the Sub-Processor List, not on the Data Privacy Framework.
Some providers listed above act as independent controllers for certain processing activities of their own (for example, Stripe for payment fraud prevention and financial regulatory compliance, and DocuSign for its own compliance record-keeping) — see Sharing of Personal Data below.
For Sub-Processors that process Personal Data on Customer's behalf and related transfer safeguards, see our Sub-Processor List.
What We Do NOT Do
- We do not sell, rent, or trade your personal data to third parties
- We do not share your personal data with third parties for their own marketing or advertising purposes
- We do not serve third-party advertisements in our services
- We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals
AI Data Handling
NeoSpline uses AI model providers to process data for the purpose of delivering AI-assisted design features. For details, see our Data Handling Terms and Sub-Processor List for per-provider details.
Model Change Monitoring
When you have an active AI conversation (at least one message sent) inside NeoSpline, the plugin observes changes you make to the CAD model — such as moving, creating, or modifying objects — and transmits the change metadata (object identifiers, positions, layer assignments, structural changes) to our server. Summary of these changes is included in the context of the next AI agent turn to improve its spatial awareness, providing more relevant assistance.
No such data is transmitted when you are not in an active AI conversation.
Metadata about CAD model changes is classified as Processing Data (as defined in the Terms of Service or Subscription Agreement) — subject to the same data residency, security, retention, and no-training commitments as Customer Content under the Data Handling Terms.
Service Quality Monitoring
To monitor service quality, the Services may automatically capture viewport images at the end of AI agent turns. These images are Customer Content with a reduced retention period; the applicable storage, retention, and no-training commitments are set out in the Data Handling Terms.
Voice Input
NeoSpline offers a Voice Input feature that converts speech to text using a third-party AI provider. Audio is transiently processed for transcription and is not stored, logged, or retained by NeoSpline or the provider, as set out in the Data Handling Terms. The transcribed text is returned to you in the plugin interface. It becomes part of your conversation history only if you choose to send it as a chat message, at which point it is treated as Customer Content.
Voice Input is processed in NeoSpline's capacity as a Data Processor, solely to provide the transcription feature on your behalf. No speaker identification, voiceprinting, or biometric processing is performed — Voice Input is used solely for speech-to-text conversion.
Data Location
The Data Handling Terms describe where NeoSpline stores and processes Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data. The Data Processing Agreement and Sub-Processor List describe transfer safeguards where Personal Data is transferred outside the EEA, the United Kingdom, or another jurisdiction recognized as providing an adequate level of protection.
Customers can request additional data residency commitments via an Enterprise Addendum, available on request from support@neospline.ai.
International Transfers
NeoSpline stores and processes data in the EEA by default. Some processing involves transfers to countries outside the EEA. Where Personal Data is transferred outside the EEA, NeoSpline relies on one or more of the following safeguards:
- EU-U.S. Data Privacy Framework (DPF) — where the recipient is self-certified under the DPF
- EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914
- UK International Data Transfer Addendum — for UK Personal Data, where applicable
For Sub-Processors that process Personal Data on Customer's behalf, transfer safeguards are detailed in the Sub-Processor List. For NeoSpline's controller-side service providers, transfer safeguards are maintained in our internal vendor management records and available on request.
How Long We Keep Your Data
We retain personal data only as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements.
| Data category | Retention period |
|---|---|
| Product Account Data | Duration of account or Agreement, plus a 30-day deletion period after termination |
| Authentication-provider events, including IP addresses | Up to 12 months (extendable where required for an active security investigation, payment dispute, or legal claim) |
| Application security-event logs containing IP addresses | 30 days (extendable where required for an active security investigation, payment dispute, or legal claim) |
| Website analytics events | Up to 24 months — see the Cookie Policy |
| Product analytics events (Usage Data and Diagnostic Data) | Up to 24 months |
| Voice Input | Not stored (audio processed in memory and discarded). |
| Communication (support, feedback) | Duration of the relationship or as required to resolve the matter |
| Website pre-sales chat (visitor records in Intercom) | Kept no longer than needed to answer the enquiry, in line with Intercom's documented retention periods for inactive visitor records. Conversations with a visitor who gives us their details follow the retention of the "Business contact and CRM data" row |
| Business contact and CRM data | Duration of the business relationship, plus up to 3 years |
| Internal team chat messages with CRM contact data | Deleted automatically on a fixed schedule |
| Internal business documents and contracts | Duration of the relationship, plus up to 5 years where required by applicable law |
| Call recordings and transcripts | While needed for follow-up; deleted when no longer needed |
| Payment / billing records | As required by applicable tax and accounting law (typically 5 years); includes per-use cost and usage records that form part of billing records |
Where specific records are needed for an active payment dispute, chargeback, or other legal claim, we retain those records until the dispute or claim is finally resolved, and then delete them or return them to the standard retention period above.
For full details including Customer Content retention, see our Data Handling Terms.
Sharing of Personal Data
We may share data with:
- Sub-Processors that process Personal Data on Customer's behalf under the Data Processing Agreement — see our Sub-Processor List
- Service providers that process NeoSpline Controller Data on our behalf, such as authentication, analytics, CRM, marketing, billing, email, support, project management, document storage, internal documentation, and logging providers
- Third-party service providers that, for certain processing activities, act as independent controllers under their own privacy policies — for example, Stripe (payment fraud prevention, anti-money laundering, and financial regulatory compliance) and DocuSign (its own compliance record-keeping)
- Payment providers, card networks, and issuing banks — if you or your bank dispute a charge (for example through a chargeback), we may share records of your account activity (login events, timestamps, IP addresses, and feature-usage metadata) and billing records with our payment provider (Stripe) and, through it, with the card network and the issuing bank, to show that the charge was valid and the Services were provided and used
- Legal authorities if required by law or to protect our rights
- Business successors in connection with a merger or acquisition
We select service providers based on their security certifications and data protection commitments. For Sub-Processors and transfer safeguards, see our Sub-Processor List.
Your Rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate or incomplete information
- Erase your personal data ("right to be forgotten")
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured format
- Object to processing based on legitimate interests
- Object to direct marketing at any time
- Withdraw consent at any time (without affecting the lawfulness of prior processing)
To exercise your rights: privacy@neospline.ai
We will respond within one month. Complex requests may take up to two additional months.
California Residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), provides you with additional rights:
- Right to know — you may request the categories and specific pieces of personal information we have collected about you
- Right to correct — you may request that we correct inaccurate personal information we hold about you
- Right to delete — you may request that we delete your personal information
- Right to opt out of sale — we do not sell your personal information
- Right to limit use of sensitive personal information — you may direct us to limit our use of your sensitive personal information to what is necessary to provide the services
- Right to non-discrimination — we will not discriminate against you for exercising your rights
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
To exercise your CCPA rights: privacy@neospline.ai
Cookies
We use cookies and similar technologies on our website and, as far as the support chat needs them, on our web platform. Details are available in our Cookie Policy.
Links to Other Websites
Our website may contain links to other websites. We are not responsible for the privacy practices of other websites. We encourage you to read the privacy policies of any website you visit.
Security
We implement appropriate technical and organizational measures to protect your data. Details of our security measures are described in the Data Processing Agreement for Personal Data and in the Data Handling Terms for Customer Content, Processing Data, Product Account Data, Voice Input, and Service Data.
Children
Our services are designed for professional use and are not intended for children.
We do not knowingly collect personal data from anyone under the age of 16. If we become aware that we have collected personal data from a person under 16, we will take steps to delete that data promptly.
Complaints
If you wish to complain about our processing of your personal data, contact us at privacy@neospline.ai.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet): https://www.datatilsynet.dk (opens in a new tab)
Contact
NeoSpline ApS — see our Imprint for full company details.