Privacy Policy

NeuPortal · Beta testing edition of 03.11.2026 · Contact: [email protected]

Section 1. Data collection and the data controller

1.1. The controller of personal data on the Platform is the NeuPortal project; email for user requests: [email protected]. Once a legal entity is registered, its name and details will be stated in this Policy (see also Section 3 of the Terms & Conditions).

1.2. The Platform collects only the data needed to run beta testing, sign users in to their account, carry out operations and meet security requirements:

account data: email, username, password hash (the password itself is not stored), two-factor authentication settings, phone number (if the User provided it), sign-in identifier from an external service (Google, Apple, Web3 wallet — if used), language and time zone, record of acceptance of the documents with the date;
technical data: IP address, browser and device information, logs of sign-ins and account actions, technical logs of interaction with the AI terminals;
financial data: balances, deposits, withdrawals, internal transfers, placements in plans, credits and fees; deposit and withdrawal wallet addresses, transaction hashes;
programme data: referral code, who invited the User and whom the User invited, VIP rank;
correspondence: support requests; messages to the assistant "Nova" (to produce a reply, the message is sent to the AI model provider);
verification data — only if the User goes through KYC (Section 2).

1.3. The Platform does not collect bank card or bank account numbers.

1.4. Sign-in with Google. If the User signs in with Google, the Platform receives from Google only the email address, the name and the identifier of the User's Google account. This data is used only to sign the User in and to link the Google account to the User's NeuPortal account; it is stored together with the account data, is not transferred to third parties and is not used for advertising. The Platform gets no access to the User's mail, contacts, files or any other Google data. The link can be removed in "Settings → Security". The Platform's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Section 2. Verification data and the Didit integration

2.1. Identity verification (KYC) is not required to register or for basic use; it is needed to lift withdrawal limits or when the Administration requests it on risk signals (AML/KYC Policy).

2.2. Verification is carried out by the independent provider Didit (in a Didit window or page). Didit collects and checks images of the identity document, a photo of the face and liveness frames, matches the face to the document and screens the User against sanctions lists, politically exposed persons (PEP) lists and adverse media. Didit processes this data under its contract with the Platform and in accordance with its own Privacy Policy (didit.me/terms/privacy-policy).

2.3. What the Platform stores. The Platform receives from Didit the verification decision (approved / declined / under review), the verification level and the AML status of wallet addresses, and — where the User has given separate consent to the processing of biometric data — stores a copy of the provider's decision: data read from the document (full name, date of birth, nationality, document number and expiry date and other information contained in the document), the results of the checks, and images of the document and the face (no video recordings). The copy is kept to meet anti-money-laundering requirements and to prevent fraud (including detecting repeat registration by the same person).

2.4. How the copy is protected. The copy is stored encrypted under a separate encryption key not used for any other data; the records are protected against modification; only authorised compliance staff have access, and every access is recorded in the audit log. No copy is kept for persons refused verification on grounds of age, except in case of a sanctions match. KYC data is not disclosed to third parties without a lawful basis.

2.5. The User may withdraw consent to the processing of biometric data by writing to [email protected]. Withdrawal does not affect the lawfulness of processing before it; data that anti-money-laundering law requires to be kept may be retained for the period that law sets.

Section 3. Purposes and legal bases

Data is processed for: registration and sign-in; deposits, withdrawals, transfers and the operation of plans; programme credits; security and prevention of fraud and abuse; AML/KYC checks and sanctions screening; user support; technical debugging of the beta; service notifications; marketing emails — only with the User's consent and with the option to unsubscribe. Legal bases: performance of the Terms, the Administration's legitimate interests (security, fraud prevention), legal obligations, consent (biometrics, marketing, non-essential cookies).

Section 4. Recipients

Data is shared only to the extent needed for a specific purpose:

Didit — identity verification and wallet address screening (AML);
the hosting provider and Cloudflare — hosting, attack protection (including Cloudflare Turnstile), content delivery;
the email provider — sending service emails;
the AI model provider (Anthropic) — the User's messages to the assistant "Nova" to produce a reply;
the error-monitoring service (Sentry) — error logs from which personal data is removed;
Google — the advertising tag on the landing page (see the Cookie Policy);
blockchain networks — addresses and transaction amounts are public by the nature of the blockchain;
competent authorities — upon lawful request;
a successor — on a transfer of rights under Section 3 of the Terms & Conditions, with notice to Users.

To operate the Platform, data may be transferred to the following categories of recipients: server hosting providers in the European Union and other countries; a cloud storage provider for encrypted backups in the EU; a website attack-protection and content-delivery provider; email sending and mailbox providers; a technical error-monitoring service; and the identity verification provider Didit. The full list of processors is available on request at [email protected]. Some providers are located outside the User's country (including in the US); such transfers rely on contractual and other safeguards permitted by applicable law.

Section 5. Retention

Data is kept while the account is open and as long as needed for the purposes of processing. After the account is closed, personal data is deleted or anonymised, except: records of operations (the ledger) — 5 years; KYC/AML data — 5 years after the account is closed; data needed for a dispute or investigation — until it is concluded.

Section 6. User rights

The User has the right to: obtain information about their data and a copy of it; rectify inaccurate data; request erasure or restriction of processing; object to processing based on legitimate interest; withdraw consent; receive their data in a machine-readable format; lodge a complaint with the data protection authority of their country. Requests are sent to [email protected]; we reply within 30 days. On erasure, records of financial operations and AML/KYC data are kept in anonymised or restricted form where the law requires their retention.

Section 7. Security

We use encryption of connections and sensitive data, password hashing, two-factor authentication, an anti-phishing code in emails, restricted and logged staff access, and protection against automated attacks. No system is absolutely secure; the Administration notifies Users and, where required, the supervisory authority of material incidents affecting Users' rights.

Section 8. Age

The Platform is intended only for persons aged 18 or over. We do not knowingly collect data of minors; if found, such an account is closed and the data deleted, except where the law requires its retention.

Section 9. Changes and contact

The Administration announces changes to this Policy on the site and notifies material changes by email. If any provision of this Policy is invalid under applicable law, the remaining provisions are not affected. Questions and requests: [email protected].