Privacy Policy

1. Who We Are

Neaj Inc., a Canadian corporation operated by Macleod Jean, is the data controller responsible for your personal information. Our operations are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. If you access our services from the European Union, we also aim to comply with the principles of the General Data Protection Regulation (GDPR) as a matter of good practice.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party services.

Information you provide:

• Account registration details — name, email address, and password
• Profile information you choose to add to your account
• Documents and content you upload to our services
• Payment information — processed securely by Stripe; we do not store full card numbers
• Communications you send to us, including support enquiries

Information collected automatically:

• Log data — IP address, browser type, pages visited, and timestamps
• Device information — operating system, device type, and screen resolution
• Usage data — features used, session duration, and interaction patterns
• Scan and interaction data — where applicable to the specific service being used

Information from third parties:

• Payment status and transaction confirmation from Stripe
• Authentication data if you use a social login provider where available

3. How We Use Your Information

We use your personal information only for the following purposes:

• To provide, operate, and improve our services
• To manage your account and authenticate your identity
• To process payments and manage subscriptions
• To send transactional communications — account confirmations, payment receipts, and service updates
• To respond to support requests and enquiries
• To detect and prevent fraud, abuse, or security incidents
• To comply with legal obligations
• To analyse aggregate usage patterns and improve product performance using anonymised data where possible

We do not sell your personal information to third parties. We do not use your personal information for advertising or share it with advertising networks.

4. AI Processing

Some of our services use AI features powered by third-party providers. When you use AI-powered features, content you submit is sent to the relevant AI provider for processing, the result is returned to you, and we do not retain submitted content beyond the time needed to complete the operation.

Our AI providers process this data in accordance with their own data processing agreements and do not use submitted content to train their models under our agreements with them.

Where a specific service processes sensitive data such as personal health information, additional disclosures are provided within that service at the point of use. You are responsible for ensuring you have the right to submit any documents or content you upload to AI features.

5. Third-Party Services

We use the following third-party services to operate our products. Each has its own privacy policy governing how they handle data:

We only share your information with these providers to the extent necessary to deliver our services. We do not authorise them to use your data for their own purposes beyond what is required to perform services for us.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations:

• Account data — retained for the duration of your account and deleted within 90 days of account closure upon request
• Payment records — we do not store payment records. All payment data including transaction history is held by Stripe in accordance with their data retention policies and applicable regulations
• Uploaded content — retained until you delete it from your account, or your account is closed
• Log data — retained for up to 90 days for security and debugging purposes

7. Cookies and Tracking

Our services use a minimal set of cookies and local storage to operate correctly:

• Session cookies — used to keep you logged in during a session; expire when you close your browser
• Authentication tokens — stored in your browser to maintain your logged-in state between sessions
• Preference storage — where applicable, to remember your settings

We do not use advertising cookies, cross-site tracking, or third-party analytics platforms. We do not build advertising profiles based on your activity.

8. Data Security

We take reasonable technical and organisational measures to protect your personal information, including:

• Encrypted data transmission (TLS/HTTPS) for all services
• Encrypted storage for sensitive data at rest
• Access controls limiting who can access personal data within our operations
• Regular review of security practices

No system is completely secure. In the event of a data breach likely to affect your rights, we will notify affected users and relevant authorities as required by applicable law.

9. Your Rights

Under PIPEDA and applicable privacy law, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your personal information, subject to legal retention requirements
• Withdrawal of consent — withdraw consent to our processing of your data where consent is the legal basis, which may affect your ability to use certain features
• Complaint — lodge a complaint with the applicable privacy regulator if you believe we have mishandled your personal information

To exercise any of these rights, contact us at the address in Section 12. We will respond within 30 days and may need to verify your identity before processing your request.

10. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and notify you by email where we hold your email address.

Your continued use of our services after a policy update constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, requests, or concerns, please contact us: