Privacy Policy – Neuro Avatar

Privacy Policy (UK GDPR)

Effective date: 25 September 2025

Data Controller: WORLDWIDE DECISION LTD

Registered office: 20 Preston St, Liverpool, United Kingdom, L1 6DQ

1. Who we are and how to contact us

WORLDWIDE DECISION LTD (“we”, “us”, “our”) operates neuro-avatar.com (the “Site”). We are the data controller for personal data processed in connection with your use of the Site and purchases of our AI-generated avatar images (the “Digital Content”). If you have questions, contact us at info@neuro-avatar.com.

2. Scope of this Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit the Site, create an account, communicate with us, or purchase Digital Content. It applies to individuals located in the UK and elsewhere, subject to local laws.

3. The data we collect

We collect and process the following categories of personal data:

Account data: name or display name, email address, password (hashed), country/region, account settings.
Order and fulfilment data: products purchased, prices, currency, transaction identifiers, download history, invoice details, and applicable tax records.
Support communications: messages you send us (including metadata such as timestamps), and information you provide to resolve issues.
Uploads and prompts: any content you submit to generate or personalise avatars (e.g., text prompts or reference images). Do not upload content you are not entitled to share.
Device and usage data: IP address, device identifiers, browser type, operating system, pages viewed, links clicked, and general interaction data collected via cookies or similar technologies.
Marketing preferences: your choices about receiving marketing communications and your consent records.

4. Children and age limits

The Site is not intended for children. Account holders must be at least 16 years old; purchases may be made by adults (18+) or by 16–17-year-old users with parental or guardian consent in line with our Terms. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data, please contact us so we can delete it.

5. Why we use your data (purposes) and our legal bases

We use personal data for the following purposes under the legal bases indicated:

Account registration and administration; processing your orders; providing Digital Content and downloads — Legal basis: performance of a contract.
Customer support, troubleshooting, and service notices — Legal basis: performance of a contract and/or legitimate interests in operating the Site.
Operating, securing, and improving the Site, including preventing abuse or unauthorised activity and generating aggregated analytics to understand usage — Legal basis: legitimate interests.
Sending direct marketing where you opt in; recording and honouring your marketing preferences — Legal basis: consent.
Record-keeping for tax, accounting, and legal compliance — Legal basis: legal obligation.
Defending legal claims and enforcing our Terms — Legal basis: legitimate interests.

6. Special categories and sensitive data

We do not seek to collect special category data. If you choose to upload photos or content that may incidentally include sensitive information (e.g., a likeness of a person), it is processed solely to provide the requested Digital Content and is not used to identify individuals. Please avoid uploading sensitive data.

7. Cookies and similar technologies

We use cookies and similar technologies to operate the Site (e.g., session and security), measure performance, and remember your preferences. Where required, we will request your consent. For details, see our Cookie Policy, which explains types of cookies, purposes, and how to change your choices.

8. Disclosures and international transfers

We share personal data with trusted service providers acting on our instructions (“processors”) to help us operate the Site and fulfil orders. Typical categories include:

Payment processing and fraud/abuse prevention (processor-agnostic).
Website hosting, storage, and content delivery network services.
Email delivery and customer support tooling.
Analytics and performance measurement tools.

We may also disclose data to professional advisers (legal, accounting), authorities where required by law, and to third parties involved in a business reorganisation (e.g., merger or acquisition).

Some recipients may be located outside the UK. Where we transfer data internationally, we rely on one or more of the following safeguards: the UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or Addendum to the EU Standard Contractual Clauses, and/or other appropriate protections.

9. How long we keep your data (retention)

Account data: retained while your account is active and for up to 24 months after last activity; basic records relating to purchases are retained for up to 6 years for tax and accounting.
Order and fulfilment data: typically 6 years from the end of the financial year of the transaction.
Support communications: typically 24 months after resolution.
Device and usage logs: typically 12 months, unless needed longer for security or legal reasons.
Marketing preferences: retained while your consent remains in effect and for a limited period thereafter to maintain suppression lists.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including account authentication controls, access limitation, and encryption in transit where appropriate. No system can be completely secure; you are responsible for keeping your password confidential and using updated software and devices.

11. Your rights

Under UK data protection law, you have the following rights, subject to conditions and exemptions:

Access: request a copy of your personal data we hold.
Rectification: request correction of inaccurate data.
Erasure: request deletion of your data where we no longer need it or where you withdraw consent (if applicable).
Restriction: request we limit how we use your data in certain circumstances.
Portability: request we transfer your data to you or another provider in a structured, commonly used, machine-readable format (where technically feasible).
Objection: object to processing based on our legitimate interests, including profiling related to those interests; you may also object to direct marketing at any time.
Withdraw consent: where we rely on consent (e.g., marketing or non-essential cookies), you can withdraw it at any time.

To exercise your rights, contact us at info@neuro-avatar.com. We may need to verify your identity before fulfilling your request. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk.

12. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal or similarly significant effects about you. We may use limited profiling (e.g., basic analytics and preferences) to improve the Site or tailor content, but not in a way that has a significant impact on you.

13. Third-party links

The Site may link to third-party websites or services. Their privacy practices are governed by their own policies, and we are not responsible for those practices.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Site with a new effective date. Material changes will be highlighted where appropriate.

15. Contact

If you have questions or concerns about this Policy or our data practices, contact us at info@neuro-avatar.com.