Privacy Policy

2.1 Account information

• Full name and email address
• Password (stored as a secure one-way hash - never in plain text)
• Account status, role, and registration date
• Your acceptance of our Terms of Service and this Privacy Policy, including the version accepted, the date and time of acceptance, and the network address from which you accepted

2.2 Trading profile

• Trading experience level and style
• Primary instruments and markets traded
• Account size (approximate, optional)
• Sessions per week and trading schedule
• Trading system name, rules, and risk parameters
• Country of residence (used to localise crisis support line information)

2.3 Voice and session data

• Audio recordings: Your voice is recorded during sessions. Raw audio is stored temporarily in private, access-controlled storage for processing and is permanently deleted after transcription, typically within minutes. Audio is never retained long-term.
• Transcripts: The text of what you say during sessions is stored and retained to provide companion responses and build your behavioural profile.
• Acoustic measurements: Numerical measurements derived from your voice during sessions. These are stored as numbers only - no voice biometric or voice fingerprint is retained, and your voice cannot be reconstructed or identified from these numbers.
• Session metadata: Start time, end time, session duration, and trading system in use.

2.4 Behavioural and companion data

• Behavioural assessment scores and session-state classifications generated by our system
• Companion intervention records (what was said and when)
• Crisis event records (if any crisis signals are detected)
• Pre-session checklist responses (including sleep, nutrition, and hydration where your plan includes these check-ins)
• Habit Pulse check-in responses
• Foundation session voice interview responses

2.5 Programme and content data

• Programme enrolment history, progress, and completion status
• Knowledge Vault articles read and time spent
• Question bank history (which questions were asked and when)
• Session insights and reports generated

2.6 Billing data

• Subscription tier, billing cycle, and subscription status
• Transaction reference numbers from our payment provider
• MyNeuroPod does not store payment card numbers, bank details, or any sensitive payment information. All payment data is handled exclusively by our payment provider.

2.7 Technical data

• IP address (used for country detection and security logging)
• Browser type and version
• Device type and operating system
• Session tokens and authentication logs

2.8 Product usage data

• Which pages and features of the application you use, and how long you spend on them
• This data is collected only if you accept optional usage analytics (see section 9), and is used solely to improve the product. It never includes the content of what you say or type.

2.9 Special personal information (health data)

To deliver the companion service, MyNeuroPod processes information that relates to your emotional and mental state — for example, stress and tension signals inferred from how you speak, behavioural-state classifications, and any language detected by our crisis-safety monitoring. Under POPIA this is treated as "special personal information" concerning your health, and it is given heightened protection.

We process this information only on the basis of your explicit, separate consent, which you give at registration and may withdraw at any time by closing your account. We do not use it for any purpose other than providing and improving the companion service for you, and we never sell it or use it for advertising.

4.1 POPIA (South African users)

Under POPIA, we process your personal information on the following grounds:

• Contractual necessity: Processing required to provide the MyNeuroPod service you have subscribed to.
• Consent: Voice recording, crisis detection, AI processing of your speech, and optional product usage analytics.
• Legitimate interest: Security, fraud prevention, service integrity, and aggregate analytics.
• Legal obligation: Compliance with applicable South African law.

4.2 GDPR (EU/EEA users)

For users in the EU/EEA, we additionally rely on:

• Article 6(1)(b): Performance of a contract.
• Article 6(1)(a): Consent (voice recording, AI processing, and optional usage analytics).
• Article 6(1)(f): Legitimate interests (security and analytics).
• Article 9(2)(a): Explicit consent for the processing of special-category (health) data, as described in section 2.9.

4.3 Special personal information (POPIA sections 26 and 27)

POPIA prohibits the processing of special personal information concerning your health unless a section 27 ground applies. We rely on section 27(1)(a) — your explicit consent, which we obtain as a distinct, purpose-specific confirmation at registration (separate from your general acceptance of these documents) and record with its version, timestamp, and originating network address. You may withdraw this consent at any time by closing your account, after which we stop processing this information and delete it in line with section 5, subject to any retention obligation.

7.1 Under POPIA (South African users)

• Right to access: Request a copy of the personal information we hold about you.
• Right to correction: Request correction of inaccurate personal information.
• Right to deletion: Request deletion of your personal information, subject to retention obligations.
• Right to object: Object to processing of your personal information on grounds of legitimate interest.
• Right to complain: Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

7.2 Under GDPR (EU/EEA users)

In addition to the rights above, EU/EEA users also have:

• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to restrict processing: Request restriction of processing in certain circumstances.
• Right to withdraw consent: Withdraw consent for voice recording and AI processing at any time by closing your account.
• Right to complain to a supervisory authority: Lodge a complaint with your local EU data protection authority.

7.3 Scope of the Right to Correction

The right to correction applies to inaccurate factual personal data - for example, a misspelled name, an incorrect email address, or onboarding details you entered incorrectly.

It does not apply to calculated outputs, scores, or AI-generated assessments. Behavioral discipline scores, session ratings, and AI coaching insights are algorithmically derived results, not stored personal facts. These are not subject to rectification under GDPR Article 16 or POPIA Section 24. This is consistent with industry-standard practice (credit scores, recommendation algorithms, and similar computed outputs are universally excluded from rectification rights).

If you believe a factual input that feeds into your scores was recorded incorrectly (for example, your onboarding risk settings), you may request correction of that underlying data via the form in your account settings.

7.4 Automated processing and decision-making

MyNeuroPod uses automated processing (including behavioural scoring and crisis-signal detection) to generate its companion responses and insights. These outputs are informational and supportive only: they do not produce any legal or similarly significant decision about you, and you remain free to disregard them. We do not make decisions about your access to the service, eligibility, or any external outcome solely by automated means. Under POPIA section 71 and GDPR Article 22 you have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect; if you have concerns about how an automated output was reached, contact legal@myneuropod.com.

7.5 Under US State Privacy Laws (residents of the United States)

If you are a resident of a US state with a comprehensive privacy law (such as California, Virginia, Colorado, Connecticut, or others), you have the right to know what personal information we hold about you, to request access to it, to request its deletion, and to request correction of inaccurate information, subject to the same scope described in section 7.3.

We do not sell your personal information, and we do not “share” it for cross-context behavioural or targeted advertising, as those terms are defined under US state privacy laws. We therefore do not offer a “Do Not Sell or Share My Personal Information” mechanism because there is no such selling or sharing to opt out of. We do not use your voice, transcripts, emotional-state information, or any other data for advertising, and we run no advertising or tracking pixels (see section 9).

Some of the information we process (information relating to your emotional or mental state) may be treated as sensitive personal information under these laws. We process it only to provide the service you have asked for, on the basis of the consent you give at registration, and never for advertising or profiling unrelated to the service.

We will not discriminate against you for exercising any of these rights. You may use an authorised agent to submit a request on your behalf, subject to verification.