Website Privacy Notice

This notice covers neurasense.io, the Neurasense company website. It is short because the site does very little with your data.

If you are a customer of one of our products, that product has its own policy. For NSQR, see the NSQR Privacy Policy.

Neurasense (Private) Limited Company registration number: PV 00286247 Incorporated in the Democratic Socialist Republic of Sri Lanka under the Companies Act No. 7 of 2007 Email: hello@neurasense.io

1. What This Site Collects

Nothing you can be identified by, unless you contact us. Browsing neurasense.io does not require an account, and we do not track you across the site or across other sites.

a) When you use the contact form

When you submit the contact or access-request form, we collect:

your name;
your email address and/or phone number — at least one is required so we can reply;
the subject you selected;
any message you write;
the date and time of submission.

That is the complete list for the form. We ask for nothing else and infer nothing else.

b) Visit measurement, if you allow it

If — and only if — you choose Accept on the banner described in Section 2, we count your visit using Vercel Web Analytics. What it records with each page view is:

the page you are on, any query parameters left on it after filtering, and the referring site, if any;
your browser, operating system, and device type, with versions;
your country, region, and city, derived from your IP address.

Your IP address is never stored. Vercel uses it to look up an approximate location and, together with other details of the request, to generate a hash that lets it tell a returning visitor from a new one within a single day. That hash is valid for one day and is then reset, which makes it impossible to link your visits across days or to identify you. The IP address itself is discarded.

Measurement writes nothing to your device — the hash is derived from the request as it arrives, so it needs no cookie and no browser storage. There is no advertising pixel, no cross-site tracking, and no profile.

If you choose Decline, or simply do not answer, no analytics script is loaded at all — not a disabled one, not one held in reserve.

2. Cookies and Your Analytics Choice

This site sets one cookie, and it exists to record what you chose here:

Name	Purpose	Type	Lifetime
`ns-consent`	Your answer to the analytics banner — the word `granted` or `denied`, and nothing else	First-party, strictly necessary	12 months

It is readable only by neurasense.io, it is never sent to a third party, and it holds no identifier: everyone who answers the same way carries an identical cookie. It is set whichever way you answer, because storing a refusal is the only way to honour it. A cookie doing only this is strictly necessary and does not itself require consent.

The site also stores one value in your browser's local storage, which stays on your device and is never transmitted:

ns-theme — whether you chose the light or dark appearance. Set only when you use the theme toggle, and containing nothing but the word light or dark.

You can clear both through your browser's site-data settings.

No other cookies exist here. Nothing is set for advertising, and nothing is set by a third party — the analytics described in Section 1(b) uses no cookie at all.

The analytics banner. Because Vercel Web Analytics sets no cookies and stores no persistent identifier, consent for the measurement itself is not legally required. We ask anyway, and default to off — this notice claims the site measures nothing until you say so, and we would rather that be literally true than nearly true. You can change your answer at any time using the Cookies link in the footer of every page. Withdrawing reloads the page so that measurement stops immediately rather than at your next visit.

3. Why We Use It and On What Basis

We use contact form submissions solely to respond to your enquiry and, where relevant, to continue the conversation about working together. We do not add you to a mailing list, and we do not use your details for marketing unless you separately ask us to.

We use visit measurement solely to understand which pages are read and roughly where readers come from, so we can decide what to write and what to fix. It produces aggregate counts, not records about you.

Where the EU or UK GDPR applies, our lawful basis for contact form submissions is legitimate interests — responding to someone who has deliberately contacted us — and, where your enquiry leads towards an agreement, steps taken at your request prior to entering a contract. For visit measurement our basis is your consent, which you give on the banner and may withdraw at any time from the footer, without affecting measurement carried out before you withdrew. Where Sri Lanka's Personal Data Protection Act No. 9 of 2022 applies, we rely on the corresponding bases under that Act.

4. Who Sees It

Submissions are delivered to Neurasense staff who handle enquiries, through our internal messaging tool and email provider. Those providers process the data on our behalf under confidentiality obligations, and they do not use it for their own purposes.

This site is hosted by Vercel Inc., a United States company, acting as our processor. Hosting means Vercel's servers handle every request to neurasense.io in order to deliver the page to you.

Visit measurement, where you have allowed it, is processed by the same company through Vercel Web Analytics. It sees only what Section 1(b) lists; it does not receive contact form submissions or anything you type on this site.

We do not sell your information, and we do not share it with third parties for their own marketing.

5. How Long We Keep It

Contact enquiries are retained for 24 months from the last message in the thread, then deleted. Where an enquiry becomes a customer relationship, the resulting records are governed by that product's privacy policy instead.

Analytics data is aggregate from the moment it is recorded — there are no individual visit records to delete, because none are created. The hash Vercel uses to recognise a returning visitor within one day is reset every 24 hours, and the visit session behind it is discarded on the same cycle.

6. Where It Goes

Neurasense is established in Sri Lanka and our providers may operate elsewhere, so your enquiry may be stored and processed outside your country. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses.

Hosting and visit measurement both involve Vercel Inc. in the United States. For personal data reaching Vercel from the EEA or the UK, we rely on the Standard Contractual Clauses in our data processing agreement with them, together with the UK International Data Transfer Addendum where UK law applies. What measurement transfers is limited to the list in Section 1(b), and it contains no identifier for you.

7. Your Rights

You can ask us to give you a copy of what we hold, correct it, delete it, restrict how we use it, or object to our using it at all. You can also object at any time to processing based on legitimate interests, and withdraw your consent to visit measurement at any time from the Cookies link in the footer — no email required, and no reason needed.

Email hello@neurasense.io and we will respond within 30 days. You may also complain to a data protection supervisory authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office; in Sri Lanka, the Data Protection Authority established under the Personal Data Protection Act No. 9 of 2022.

8. Security and Breaches

We use encryption in transit and restrict access to enquiry data to staff who need it. If a breach affecting your information occurs, we will notify the relevant authority within 72 hours where the law requires, and tell you directly where the risk to you is high.

9. Children

This site is not directed to anyone under 18, and we do not knowingly collect information from children.

10. Changes

We may update this notice. Material changes will be posted here with a revised "Last updated" date.