Privacy Policy

NeuroBeatx, Inc. ("NeuroBeatX," "we," "us," or "our"), a Delaware corporation, provides a subscription wellness and focus music and audio streaming service through our website at https://www.neurobeatx.com and our iOS and Android applications (together, the "Service"). This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to visitors, account holders, and subscribers worldwide. Please note that NeuroBeatX is a music and audio streaming product. It is not a medical, health, therapy, diagnostic, or wellness-treatment service, and it is not intended to diagnose, treat, cure, or prevent any condition. The "Vibe Match" feature described below is about your music preferences and the activity or vibe you want a soundtrack for — for example "studying," "working out," or "winding down." It is not about your health or mental state, and we do not collect health, medical, mental-health, biometric, genetic, or other special or sensitive categories of data through it or through any other part of the Service. At a glance • We collect the information you give us to run your account (like your username and email), your subscription and payment status (but never your full card number), how you use the Service, and your listening and Vibe Match preferences. • We use it to run the Service, personalize music recommendations, keep the Service secure, provide support, and — with your consent where required — measure advertising and send you marketing. • We do not collect health, medical, biometric, genetic, or other special-category data. Any earlier version of this policy that suggested otherwise was incorrect and is replaced by this one. • We do not sell your personal information for money. We honor the Global Privacy Control (GPC) signal as an opt-out of "sale," "sharing," and targeted advertising under U.S. state laws. • We use trusted providers such as Stripe, Apple, Google, Amazon Web Services, and Resend to help operate the Service. Your data is stored in the United States, with safeguards for international transfers. • You have rights to access, export, correct, and delete your data. You can use the in-app "Download my data" and "Delete account" features, or email privacy@neurobeatx.com.

Controller. For users in the European Economic Area (EEA), the United Kingdom (UK), Switzerland, and other regions with similar laws, the data controller responsible for your personal information is NeuroBeatx, Inc. How to reach us. You can contact us about privacy at any time: • Email: privacy@neurobeatx.com • General support: support@neurobeatx.com • Contact form: https://www.neurobeatx.com/contact EU and UK representatives. We are a U.S. company and have not yet appointed a representative in the European Union or the United Kingdom under Article 27 of the EU/UK GDPR. Until we do, users in the EEA and the UK can contact us directly at privacy@neurobeatx.com and we will handle requests ourselves within the timeframes the law requires. We will update this section when a representative is appointed.

We collect the following categories of personal information. Account and profile information. Your username, email address, and password. Passwords are never stored in readable form — we store only a salted bcrypt hash of your password. If you sign in using Google or Apple, we receive a Firebase user ID, your email address, and your profile photo URL from that provider. Subscription and payment information. We offer subscriptions through Stripe (on the web) and through the Apple App Store and Google Play (for in-app purchases). We store your subscription status, transaction identifiers, and customer identifiers. We do not store your full payment card number; card and payment details are handled directly by Stripe, Apple, or Google. Device and usage information. Your IP address, browser and user-agent string, device type, operating system, approximate country (derived from your IP address), language and locale, the pages and screens you view, and your in-app activity. Cookies and similar technologies. A first-party analytics cookie (lasting about 30 days), Google Analytics cookies, and advertising click identifiers (such as Google's "gclid" and Meta's "fbclid") kept for up to approximately 90 days to measure advertising campaigns. See Section 6 for details and your choices. Listening and preferences. Your listening history, likes, streaks, and the activity or vibe choices you make in Vibe Match and during onboarding. If you optionally type free text into Vibe Match, that text is used only to select music for you and is not stored as a lasting record beyond generating your recommendation. Communications. When you write to us through the contact form or by email, we collect your name, email address, the content of your message, and the IP address and user-agent used to send it. Records of consent. We keep records of your acceptance of our Terms and this Policy, including the version accepted, the timestamp, and the IP address and user-agent used, as proof of consent. We do not collect health, medical, mental-health, biometric, genetic, precise geolocation, racial or ethnic, political, religious, sexual-orientation, sex-life, or other special or sensitive categories of personal information.

We use personal information for the purposes below. For users protected by the EU/UK GDPR, we identify the lawful basis under Article 6 that we rely on for each purpose. To provide and operate the Service and your account. Creating and maintaining your account, authenticating you, delivering audio streams, and providing core features. Lawful basis: performance of a contract with you. To process subscriptions and payments. Managing your subscription, processing purchases and renewals, and preventing payment fraud. Lawful basis: performance of a contract; and legal obligation for tax and accounting records. To personalize music recommendations (Vibe Match). Matching music to the activity or vibe you choose or describe. Lawful basis: performance of a contract for the core recommendation feature; and, where you provide optional free text that we send to an AI provider, your consent. To analyze and improve the product. Understanding how the Service is used so we can improve it. Lawful basis: our legitimate interests in operating and improving the Service (basic, privacy-respectful analytics); and your consent where non-essential analytics cookies are used in regions that require it. For security and fraud prevention. Protecting the Service, our users, and our systems against abuse, bots, and unauthorized access. Lawful basis: our legitimate interests in keeping the Service secure; and legal obligation where applicable. To provide customer support. Responding to your questions and resolving issues. Lawful basis: performance of a contract; and our legitimate interests in supporting our users. For marketing. Sending you marketing communications and measuring advertising, where you have consented or where otherwise permitted by law. Lawful basis: your consent; and, for limited communications to existing customers where permitted, our legitimate interests. For legal compliance. Meeting our legal obligations, including tax and accounting duties and responding to lawful requests from authorities. Lawful basis: legal obligation; and our legitimate interests in establishing, exercising, or defending legal claims. We do not rely on any special-category (Article 9) processing, because we do not collect special-category data. Where we rely on legitimate interests, you have the right to object as described in Section 10.

Vibe Match lets you pick — or optionally type — an activity or vibe (for example, "studying," "working out," or "winding down"), and our AI selects music to match it. To do this, we send your chosen activity or vibe (and, if you type free text, that text) to Google's Gemini (Generative Language API) to return a music recommendation. We use a business or enterprise tier of this service, and it is our commitment that we do not permit this input to be used to train Google's models. Any optional free text you type is used only to generate your recommendation and is not retained by us as a lasting record. This personalization is an automated process, but it has no legal or similarly significant effect on you. It simply recommends music. It is not the kind of solely automated decision-making with legal or similarly significant effects that is restricted by Article 22 of the GDPR.

We do not sell your personal information for money. We share personal information only with the categories of recipients below, and only as needed for the purposes described in this Policy. Service providers (processors) that help us operate the Service: • Stripe — payment processing. • Apple App Store and Google Play — in-app purchase billing. • Google (Firebase) — sign-in and authentication. • Google (Gemini / Generative Language API) — the AI that matches your chosen activity or vibe to music, as described in Section 4. • Google Analytics and Google Ads — analytics and advertising measurement. • Resend — sending transactional and support emails. • Amazon Web Services (AWS) — cloud hosting and storage, in the United States. Legal and safety recipients. We may disclose information to courts, regulators, law enforcement, or other authorities when we believe in good faith that disclosure is required by law or necessary to protect the rights, property, or safety of NeuroBeatX, our users, or others. Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will require any successor to honor this Policy or provide notice of any material change. U.S. "sale" and "sharing." We do not sell personal information for money. However, our use of advertising and analytics technologies (such as Google Analytics and Google Ads and advertising click identifiers) may be considered a "sale" or "sharing" for cross-context behavioral advertising under certain U.S. state privacy laws. You can opt out of this at any time, including by using the Global Privacy Control signal, as described in Sections 6 and 12.

We use cookies and similar technologies to run the Service, remember your choices, measure usage, and support advertising. What we use. A first-party analytics cookie (about 30 days); Google Analytics 4 for analytics; Google Ads for advertising measurement; and advertising click identifiers such as Google's "gclid" and Meta's "fbclid," kept for up to approximately 90 days. Consent in the EEA, UK, and Switzerland. If you are in the EEA, UK, or Switzerland, we ask for your consent through a consent banner before setting non-essential (analytics and advertising) cookies. Essential cookies needed to run the Service are always set. You can change your choices at any time through the banner or your cookie settings. Global Privacy Control (GPC). We honor the Global Privacy Control browser signal. For U.S. state-law purposes, we treat a valid GPC signal as a request to opt out of the "sale" and "sharing" of your personal information and of targeted advertising. Your advertising choices / Do Not Sell or Share My Personal Information. You can opt out of targeted advertising and of any "sale" or "sharing" of your personal information by: (a) enabling the Global Privacy Control in a supported browser; (b) adjusting your cookie choices via our consent banner where available; and (c) emailing privacy@neurobeatx.com. You can also control advertising cookies through your browser settings and through industry opt-out tools. Opting out will not affect your ability to use the Service.

Your personal information is stored and processed in the United States, primarily on Amazon Web Services infrastructure in the us-east-1 region. If you are located in the EEA, UK, or Switzerland, transfers of your personal information to the United States and other countries rely on appropriate safeguards, including the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, the EU-U.S. Data Privacy Framework, together with supplementary measures where needed. You may request a copy of the relevant safeguards by contacting us at privacy@neurobeatx.com.

We keep personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Our general retention schedule is: Account data. For the life of your account. Deleted within approximately 30 days of account deletion, with residual copies in encrypted backups purged within approximately 90 days. Payment and transaction records. Retained as required by tax and accounting law, typically up to 7 years. Analytics and usage data. Up to 24 months, after which it is deleted or anonymized. Advertising identifiers. Up to approximately 90 days. Vibe Match free text. Not retained as a stored record beyond generating your recommendation. Marketing preferences. Kept until you opt out. Support messages. Kept as long as needed to resolve your issue and for our records.

We take reasonable and appropriate technical and organizational measures to protect your personal information, including: • Encryption of data in transit using TLS. • Encryption of data at rest. • Salted bcrypt hashing of passwords (we never store passwords in readable form). • Tokenized payments — we do not store payment card numbers. • Access controls that limit who can access personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities as required by applicable law.

Depending on where you live, you may have some or all of the following rights: to access your personal information; to receive a portable copy or export of it; to correct inaccurate information; to delete or erase your information; to restrict or object to certain processing; to withdraw consent at any time (without affecting processing already carried out); to opt out of targeted advertising and of any "sale" or "sharing" of your information; and not to be discriminated against for exercising your rights. How to exercise your rights. The easiest way is to use the in-app features: • "Download my data" to export your information. • "Delete account" to delete your account and associated data. You can also email us at privacy@neurobeatx.com or use the contact form at https://www.neurobeatx.com/contact. Verification and timing. We will take reasonable steps to verify your identity before acting on a request, and we may ask for information to do so. We respond within the timeframes required by law — generally within one month under the GDPR (extendable where permitted) and within 45 days under the CCPA (extendable by an additional 45 days where permitted). Authorized agents. You may use an authorized agent to submit a request on your behalf where the law allows; we may require proof of the agent's authority and verification of your identity. Appeals. Where your state or country's law provides a right to appeal a decision we make about your request, you may appeal by emailing privacy@neurobeatx.com with the subject line "Privacy Appeal." We will respond as required by applicable law.

EEA, United Kingdom, and Switzerland (GDPR / UK GDPR / Swiss FADP). The data controller is NeuroBeatx, Inc. We process your personal information on the lawful bases set out in Section 3, and we do not process special-category data. You have the rights described in Section 10, including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. International transfers are handled as described in Section 7. You also have the right to lodge a complaint with your local Data Protection Authority — in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); and in the EEA, your national supervisory authority. Our EU and UK representatives under Article 27 are identified in Section 1. California (CCPA / CPRA). In the past 12 months, we have collected the following categories of personal information: identifiers (such as username, email, IP address, and device identifiers); commercial information (such as subscription and transaction records); internet or other electronic network activity (such as usage and interaction with the Service); geolocation data (coarse, country-level only, derived from IP address); audio, electronic, or visual information (only if you send it to us when you contact us, such as a profile photo or the content of a message); and inferences drawn to personalize music recommendations. We collect this information for the business and commercial purposes described in Section 3, and we share it with the categories of recipients described in Section 5. We do not sell your personal information for money. We may "share" personal information for cross-context behavioral advertising through analytics and advertising technologies; you can opt out as described in Sections 6 and 12, and we honor the Global Privacy Control signal. We do not collect or process "sensitive personal information" as defined under the CPRA, so there is nothing to limit; the "right to limit the use of sensitive personal information" does not apply because we do not collect it. You have the rights to know, access, delete, and correct your personal information, to opt out of "sale"/"sharing," and to be free from discrimination for exercising your rights. You may use an authorized agent and may appeal a denial. To exercise these rights, use the methods in Section 10. Other U.S. states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana). If you are a resident of a U.S. state with a comprehensive privacy law, you have rights that generally include: to confirm whether we process your personal information and to access it; to correct inaccuracies; to delete your personal information; to obtain a portable copy; and to opt out of targeted advertising, the "sale" of personal information, and certain profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in profiling that produces legal or similarly significant effects. To exercise these rights, use the methods in Section 10. Where your state's law provides a right to appeal, you may appeal a denial as described in Section 10. Canada (PIPEDA and Quebec Law 25). We collect, use, and disclose personal information with your consent (express or implied, as appropriate) and for the purposes described in this Policy. You have the right to access and correct your personal information. You may direct questions or complaints to us and, if unsatisfied, to the Office of the Privacy Commissioner of Canada (OPC) or, for Quebec residents, the Commission d'accès à l'information du Québec (CAI). Brazil (LGPD). We process personal data on the legal bases permitted by the LGPD, including performance of a contract, legitimate interests, consent, and compliance with legal obligations. You have rights to confirmation and access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. You may contact us regarding personal-data matters (our data protection contact / encarregado) at privacy@neurobeatx.com. Australia (Privacy Act and Australian Privacy Principles). You may request access to, and correction of, the personal information we hold about you. If you have a complaint about how we handle your personal information, you may contact us and, if unresolved, the Office of the Australian Information Commissioner (OAIC). Other regions. You may have similar rights under your local law. Contact us at privacy@neurobeatx.com to exercise them, and we will respond as required by applicable law.

We do not sell your personal information for money. To opt out of any "sale" or "sharing" of your personal information for cross-context behavioral or targeted advertising: enable the Global Privacy Control in a supported browser (which we honor automatically), adjust your cookie choices through our consent banner where available, or email privacy@neurobeatx.com with the subject line "Do Not Sell or Share." Your choice will not affect your ability to use the Service.

The Service is not directed to, or intended for, anyone under 18 years of age, consistent with our Terms, which require users to be at least 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. If you believe a person under 18 has provided us with personal information, please contact us at privacy@neurobeatx.com.

We use automated personalization to recommend music through Vibe Match, as described in Section 4. This processing has no legal or similarly significant effect on you and is not the kind of solely automated decision-making restricted by Article 22 of the GDPR. If you have questions about it, contact us at privacy@neurobeatx.com.

We may update this Privacy Policy from time to time. When we do, we will post the updated version and change the "Effective date" and "Version" at the top. If the changes are material, we will provide additional notice, such as a prominent notice on the Service or by email, before the changes take effect where required by law. Your continued use of the Service after an update takes effect means you accept the revised Policy, except where your consent is required.

If you have questions, requests, or complaints about this Policy or your personal information, contact us at: • Email: privacy@neurobeatx.com • Support: support@neurobeatx.com • Contact form: https://www.neurobeatx.com/contact