Privacy Policy

1. Who processes the data

The data is processed by the Neon Ecosystem team — the same one that develops and supports the service: the website, the personal account, Neon Hub and Neon X. You can reach us about any data question on Telegram: @Neon_X_Admin.

It is important to tell the two roles apart. When it comes to your account and the work of the service, we make the decisions about the data. When you enter the data of your models, employees and fans into the CRM, you make the decisions, and we process that data on your instructions (see section 3).

2. What data we collect

Account and profile

Email, first and last name, display name, username, avatar. Sign-in works through the Clerk authentication service — the password is stored there and we do not know it. When you sign in with Telegram, we receive the identifier, the name and the profile photo.

In your profile you can also add: country, date of birth, occupation, level of English, platforms, links to your website and social networks, a description. That is your decision — these fields are optional, and you can set who sees them.

Organization and team

Organization name, time zone, logo, description, services, country, Telegram contact, team members and roles. For employees the owner can set pay terms (rate, percentage, bonus) — only those whose role allows it can see them.

Payments

Amount, date, status, invoice identifier and the blockchain transaction hash, and also a wallet address — yours, if we are sending you a payout (for example, under the partner program). We do not accept and do not store bank card numbers.

Identity verification

If you start profile verification yourself, it goes through the Didit service. Only the result comes back to us: the status, the date and the identifier of the verification session. We do not receive or store documents, selfies or other verification material.

What you create in the service

Messages and attachments, groups and communities, marketplace listings and deals, Academy courses, lessons and certificates, applications to join an agency, notes, reviews and reputation, partner earnings.

Data of models, employees and fans

In Neon Hub you work with fan cards: name and handle on the platform, a link to the profile, notes, the history of purchases and subscriptions, and also the fields your team fills in — age, city, occupation, interests. We store them and show them only to you and your team, within the limits of their roles. The grounds and the lawfulness of collecting this data are on your side.

Sessions of connected platform accounts and proxy passwords are stored separately, in encrypted form (AES-256-GCM), so that an account can be opened without giving the password to employees.

Technical data

• Sign-in log. IP address, browser or app, device label, time of the first and the last sign-in. You can see this log in your personal account and end sessions you do not need.
• Action log. For actions that matter for security and for investigations (including actions by administrators), we keep who did what and when, with the IP address.
• Website visit counter. Our own, with no third-party systems. It does not store your IP address: the address together with the browser description is turned into an irreversible fingerprint, which is used to count unique visits per day. Along with it we keep the browser time zone, the landing page, the referring address and campaign tags (utm), if the link had them.

Data from the apps

• Neon Hub sends our server what the CRM needs to work: platform accounts, access details, proxies, automations, revenue statistics and AI requests. Appearance settings, message templates and the internal diagnostic log stay on your computer.
• Neon X keeps accounts, settings and statistics on your computer; browser profiles and cookies live in AdsPower, not with us. What goes to the license server is the computer fingerprint (an irreversible hash of hardware identifiers), the machine name, the platform, the app version and the license key, and also a summary of your X accounts: name, handle, status, number of groups and daily activity statistics.

3. Why we process data

• So that the service works. Signing in to your account, the work of your personal account and the apps, roles and access rights, licenses and payments, support. Without this data the service cannot be provided.
• So that it is secure. The sign-in and action logs, limiting the rate of requests, blocking suspicious activity, sorting out disputed situations.
• So that we meet our obligations. Confirming payments and payouts, earnings under the partner program.
• So that we understand what happens on the website. The anonymous visit counter: how many people came and from where, without tracking any particular person.
• So that we can tell you what matters. Emails with sign-in codes and notices about the work of the service. Marketing emails only if you asked for them yourself.

If your law requires a basis for processing, it is the performance of the contract with you, our legitimate interest in the security and the development of the service, your consent (where we ask for it) and the requirements of the law.

4. Who we share data with

We do not sell data and we do not share it for someone else's advertising. The data is seen only by the contractors the service cannot work without — each in their own part:

We also share data if the law requires it or if it is needed to protect rights — ours, yours or those of other users.

5. Third-party services in your personal account

The home page of your personal account has small widgets — weather, currency and crypto rates. Requests to them go straight from your browser, and we do not store them:

• city detection — BigDataCloud (by the IP address of the request; if you allow geolocation, the browser coordinates are used instead);
• weather — Open-Meteo (rounded coordinates);
• currency rates — ER-API, crypto rates — CoinGecko (no personal data is sent).

Links to Telegram and to the Tronscan blockchain explorer lead to third-party websites — their own rules apply there.

6. AI features

In Neon Hub the text you send to an AI suggestion or translation goes through our server to Google. In Neon X requests go straight from your computer to the provider you chose in the settings (for example, OpenAI with your key); we do not see these requests. The provider's processing terms are its own. Do not send to AI what should not leave your computer.

7. Cookies and browser storage

Our code does not set cookies of its own and does not use advertising or analytics cookies. Strictly necessary cookies are set by the Clerk sign-in service, and we use browser storage for small things like the language you chose. The detailed list is in the Cookie Policy.

8. How long we keep data

• Account and organization data and the content you created — as long as the account exists, and a reasonable time after deletion (backups).
• Records of payments and payouts — as long as they are needed to confirm settlements and sort out disputes.
• Confirmation codes from emails — 10 minutes, and only as a hash.
• Sessions — 12 hours for the website and up to 30 days for the apps; invitations to an organization — 7 days; automation events — 30 days; shared links to traffic reports — no longer than 180 days.

Honestly about what is not done yet: the sign-in log, the action log, the anonymous visit counter, messages and uploaded files currently have no automatic deletion period. We are limiting these periods and will state them here as soon as it is in the code. Until then you can always ask us to delete your data sooner — we will do it.

9. How we protect data

• Everything is sent over an encrypted connection (HTTPS), and so is the link between the apps and the server.
• Platform sessions and proxy passwords are stored encrypted (AES-256-GCM), and the encryption key is kept separately from the database.
• We do not have the passwords to your Neon account: the sign-in service manages them.
• Access inside an organization is limited by roles, and administrators' actions are recorded.
• Backups of the database are made so that the service can be restored.

There is no absolute protection. If there is a leak that could harm you, we will tell the people affected, and we will do it without delay.

10. Your rights

You can:

• view and change your profile and organization data right in your personal account;
• view the sign-in log and end sessions you do not need;
• unlink sign-in through Telegram;
• request a copy of your data, its correction or its deletion;
• withdraw consent where processing is based on it (for example, refuse optional emails);
• object to processing or ask us to restrict it;
• complain to us — see the Complaints Procedure — and to the supervisory authority of your country.

There is no “delete account” button in your personal account yet: write to support, and we will delete the account and the data connected to it. Some information we are required to keep — for example, records of payments and of violations; we will explain what exactly is left and why.

If you work in someone else's organization, a request about data that the employer entered (for example, fan cards) is settled together with them: in that part they decide what happens to the data.

11. Transfers to other countries

The servers of the service and the contractors listed above are in different countries, including outside your own. We work only with those who provide an acceptable level of protection and use the data strictly for their function.

12. Children

The service is meant for adults. We do not knowingly collect data about people under 18. If such data has reached us, write to us — we will delete it.

13. Changes to this policy

This policy will change along with the service. A new version is published here with a version number and a date; we announce material changes in your personal account or by email.

14. Contacts

Questions about data, requests for access, correction and deletion — Telegram: @Neon_X_Admin. We reply in Russian and English.