NEUACO Privacy Policy

1. Personal data controllers

The controllers of your personal data submitted via the NEUACO service are joint controllers: Dominik Gawenda and Piotr Dańszczyk, acting jointly under the unregistered trading name Neution Studio.

Correspondence address: Wiertnicza 36, 40-304 Katowice.

For all matters relating to personal-data protection (including exercising your rights) you may contact us by email at hello@neuaco.com.

Essence of the joint-controller arrangement (Art. 26 GDPR): Dominik Gawenda and Piotr Dańszczyk jointly determine the purposes and means of processing data in the NEUACO service and jointly ensure your rights. The contact point for data subjects is hello@neuaco.com — a request received by either joint controller is coordinated between them. A detailed division of tasks between the joint controllers is available on request.

2. Scope of processed data

We process data you provide voluntarily in contact forms, during interactions with the AI assistant, and data collected automatically while you use the site. This includes:

• Identification and contact data: name, email address, phone number.
• Business and system data: property type (e.g. hotel, apartment), message content, implementation-related enquiries.
• Interaction data: content of queries and conversations with the virtual assistant (NEO).
• Technical and operational data: IP address, basic server logs, device information; after cookie consent — analytics / advertising identifiers and events.
• Marketing consent: whether the contact / waitlist form button “I want to get news first” was enabled (that button is the marketing consent).

3. Purposes and legal bases of processing

We process your data for the following purposes:

• Handling enquiries and user support (Art. 6(1)(f) GDPR) — our legitimate interest in responding to messages sent via the form and via the AI assistant chat.
• Early Access programme and preparing an offer (Art. 6(1)(b) GDPR) — steps taken at the data subject’s request prior to entering into a possible service agreement.
• Marketing and commercial activities (Art. 6(1)(a) GDPR) — solely on the basis of your separate, voluntary consent. You give consent by clicking (enabling) the form button “I want to get news first” — that button is marketing consent (receiving news and updates about the NEUACO app, e.g. by email). You may turn the button off at any time before submitting the form. Accepting the Early Access Terms and this Policy when clicking “Join” / “Book a call” does not constitute marketing consent. You may also withdraw marketing consent later by writing to hello@neuaco.com.
• Analytics and effectiveness measurement (cookies) (Art. 6(1)(a) GDPR) — only after accepting cookies in the site banner (analytics and ad-measurement tools, if enabled — after clicking Accept in the banner; closing the banner (×) ends the choice without that analytics).
• Security and protection against abuse (Art. 6(1)(f) GDPR) — our legitimate interest in protecting IT infrastructure (including rate-limiting mechanisms).
• Defence against or pursuit of claims (Art. 6(1)(f) GDPR) — the controller’s legitimate interest.

4. Recipients of personal data

We respect your privacy — we do not sell your data to third parties.

Your data may be shared only with trusted external parties (processors), to the extent needed to operate the service, under appropriate data-processing agreements (DPAs). These include in particular providers of:

• hosting, CDN and file / media storage,
• database infrastructure,
• web analytics and ad measurement (only after cookie consent),
• email services (sending notifications and form replies),
• artificial-intelligence (LLM) technology supporting the NEO assistant.

An up-to-date list of specific processors is available on request at hello@neuaco.com.

5. Transfers outside the EEA

If we use tools from providers established outside the European Economic Area (EEA) — including hosting, analytics or AI model providers — data transfers rely on appropriate legal safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.

6. Data retention

Retention depends on the purpose:

• Marketing: until you withdraw consent.
• Early Access / commercial enquiries: for the duration of communication and negotiations and, if none, until potential claims become time-barred.
• Contact form and AI chat: for as long as needed to maintain correspondence continuity, analyse support quality and fully handle the enquiry.
• Analytics data (cookies): according to the retention of analytics / advertising tools and until consent is withdrawn / cookies are deleted in the browser (you may also reset local site preferences by clearing site data).

7. Your rights (GDPR)

You have the right to: access your data, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing (including profiling) based on legitimate interest, and withdrawal of marketing or cookie consent at any time — without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us at hello@neuaco.com.

You also have the right to lodge a complaint with a supervisory authority — the President of the Personal Data Protection Office (UODO) in Poland, or your local authority.

8. Cookies, local storage and interactive features

The NEUACO site uses technologies stored in the browser. We distinguish:

• Essential / functional: local preferences (including cookie acceptance, mute, language) needed for the site to work and to remember your choice.
• Analytics and marketing (optional): web analytics and ad / conversion measurement scripts. We load them only after you click “Accept” in the cookie banner. Until then, default consent for this cookie category remains denied.

Interactive experiences: The service offers interface experiences (including a reception bell and sound effects). Sound use depends on your interaction with the site; you may mute preferences at any time with the toggle (the choice is stored locally on your device).

9. Automated decision-making

Except for the AI assistant (described in section 10), your data is not subject to automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

10. Use of artificial intelligence (NEO assistant)

Within the service we provide a virtual support assistant (NEO) whose operation is based on artificial-intelligence algorithms.

By starting an interaction with the assistant in the chat window, you acknowledge that you are communicating with an automated (AI) system and that queries you enter are processed in real time to generate a substantive reply.

Replies generated by artificial intelligence are informational and supportive. The assistant’s automated operation is not used to make any decisions that produce legal effects concerning you.

Please do not enter any sensitive personal data in the NEO assistant chat (e.g. financial data, passwords, health data).

11. Presentational materials on the site

On the NEUACO site (including product sections, the case-study story, screenshot galleries and NEO assistant demos) there may appear sample data that look like personal data — e.g. guest names, contact details, message content or calendar entries.

All such personal data are random / fictional and serve only to illustrate how the product works. They are not data of real third parties and do not come from production customer databases.

The exception is information about the co-creating resort: the owner’s first name, the Oaza Wicie resort name and the resort logo, which refer to a real partner and are published with the knowledge and consent of the entitled persons.

This section does not cover data you submit yourself via contact forms, the waitlist or chat — those data are processed under the other sections of this Policy.

12. SaaS product vs property guest data

This Policy covers data collected by the NEUACO site and forms (landing, early access, contact, NEO demo).

When NEUACO provides services where a property operator enters their guests’ and reservations’ data, we will act as a processor for that operator (controller). The rules for such processing will be set out in a data-processing agreement (DPA) / commercial agreement with the operator — this landing Policy does not replace them.