Legal

Last updated: June 2026

Privacy Policy

Next Neural Labs ("we", "our", "us") values your privacy. This policy explains what information we collect and how it is used when you access our website and services.

Information We Collect

• Display name
• Email address
• Encrypted / hashed password
• Basic technical logs required for service security and operation
• Media you upload for analysis, video, and any audio, images, or other content contained within it
• Data derived from your uploads, such as transcripts, automatically detected on-screen descriptors, and numerical embeddings
• Your chat history, the messages you send and the answers NINA returns, together with the text transcript derived from a video so a conversation can continue after the upload is gone (the uploaded media itself is never stored)
• Files you upload to LUNA for synthesis, documents, spreadsheets, code, images, audio or video, and the text LUNA derives from them while building your Note (the uploaded files themselves are never stored)
• Your LUNA tasks, the prompt and title you provide and the structured Note LUNA returns
• Your ARIA conversations, the messages you send and ARIA's replies, stored as an event log so a chat can be resumed across devices
• Images and files you send to ARIA, unlike our other tools, these attachments are stored in Cloudflare R2 object storage so they remain visible in your conversation, until you delete them

How We Use Your Information

• To create and manage your account
• To authenticate login sessions
• To maintain platform security
• To improve service performance and reliability

User Content & Media Processing

When you use our analysis tools, you may upload media, including video and any audio, images, or other content contained within it. This section explains how that content is handled.

Uploaded media is processed on infrastructure provided through Hugging Face (including Hugging Face Spaces). Processing steps such as speech recognition (transcription), visual frame analysis, and semantic indexing are performed within this processing environment to produce your results.

• Your media is processed transiently to generate the requested output, such as summaries, timestamps, and search results.
• Raw uploads and files derived from them (for example extracted audio or sampled frames) are held only in temporary storage for the duration of processing.
• Storage in this processing environment is ephemeral: an uploaded file is kept for up to 15 minutes, only so that follow-up questions in the same chat can reuse it without re-uploading, and is then automatically purged (and also when the environment restarts).
• We do not retain your uploaded media as part of your account, and we do not use your uploaded content to train models.

To generate written summaries, short text excerpts derived from your media , such as transcribed speech and automatically detected on-screen descriptors, may be sent to Hugging Face's hosted model inference service. This transmission is encrypted in transit (TLS). According to Hugging Face, the contents of inference requests and responses are not stored and are not used to train models; limited operational logs may be retained for a short period (up to 30 days) for debugging and security. Hugging Face may route inference requests to third-party model providers, who operate under their own security and privacy policies.

Video links. Instead of uploading a file, you may paste a link to a video hosted on a third-party platform (for example YouTube, Facebook, Vimeo, or similar). When you do, we retrieve that video from the third-party platform on your behalf and then handle it exactly like an uploaded file: it is processed transiently, kept in the processing environment for up to 15 minutes, and never stored in your account. We do not store the link's account credentials. You are responsible for ensuring you have the right to download and analyze the linked video and for complying with the source platform's own terms of service; those platforms are independent controllers of any data they hold.

You are responsible for ensuring you have the right to upload, link to, and process any media you submit. Please avoid submitting content that contains highly sensitive personal information or that you are not authorized to share.

Chat History

NINA's chat interface saves your conversations so you can return to them. We store, in our Cloudflare D1 database (EU East region):

• Your conversations and their titles, and the messages within them: both the text you send and the answers NINA returns.
• The text transcript and on-screen descriptors NINA derives from a video, so a conversation can keep working after the uploaded media has been deleted from the processing environment.
• While a reply is being generated: an in-progress draft of NINA's answer and a short-lived reference to the file being processed (a pointer to it in the processing environment, not the media itself). Both are kept only for the duration of that turn (up to 15 minutes) and are cleared once it completes.

We never store the uploaded video, audio, or any media file in your chat history or anywhere in your account. Only text, your messages, NINA's replies, and the derived transcript, is saved. Chat history is kept until you delete it: you can delete an individual conversation at any time from within the app, and deleting your account permanently removes all of your conversations and messages.

When you ask a question, NINA's answer is generated on our servers (Cloudflare Workers) and saved as it is produced, so closing the tab or browser does not interrupt it, the finished reply will be waiting when you return to the chat.

LUNA, File Synthesis

LUNA lets you create a task: you upload up to 100 files of any type - documents, spreadsheets, code, images, audio, and video, and tell LUNA what to build. LUNA reads the files and produces a single structured Note (an agenda, a body, and a Sources section that credits the files it used). This section explains how that content is handled.

• Your files are processed transiently on infrastructure provided through Hugging Face (Hugging Face Spaces). Depending on the file type, processing includes parsing text from documents and spreadsheets, reading images with a vision model (including any text shown in them), and transcribing speech from audio and video.
• Relevant text excerpts derived from your files are sent to Hugging Face's hosted model inference service to assess relevance and write the Note. This transmission is encrypted in transit (TLS); according to Hugging Face, the contents of inference requests and responses are not stored and are not used to train models, though limited operational logs may be retained for a short period (up to 30 days) for debugging and security. Hugging Face may route requests to third-party model providers, who operate under their own policies.
• Uploaded files, and anything derived from them, such as extracted audio, are held only in temporary storage for the duration of the task and are then automatically purged (within about 15 minutes, and whenever the processing environment restarts). We never store your uploaded files in your account.
• Only the generated Note (text), together with the task's prompt and title, is saved, in our Cloudflare D1 database (EU East region). No uploaded files are stored there.
• To limit cost and abuse, each account may create up to 3 LUNA tasks per day.

Your tasks are kept until you delete them: you can delete an individual task at any time from within the app, and deleting your account permanently removes all of your LUNA tasks and their Notes. You are responsible for ensuring you have the right to upload and process the files you submit; please avoid submitting content that contains highly sensitive personal information or that you are not authorized to share. LUNA's output is generated automatically and may contain mistakes, verify important facts.

ARIA, Conversational Agent

ARIA is a Messenger-style conversational agent. You exchange messages and may send images and files; ARIA replies in natural, multi-part messages. This section explains how that content is handled, and how it differs from our other tools.

• Your conversation, the messages you send and ARIA's replies, is saved as an event log in our Cloudflare D1 database (EU East region) so you can return to it and continue it across devices.
• Images and files you send to ARIA are stored. Unlike NINA and LUNA, where uploads are transient, ARIA keeps your attachments in Cloudflare R2 object storage so they stay visible in the conversation. They are retained until you delete the conversation or your account.
• To generate replies, ARIA sends your recent messages and - for attachments - short-lived, signed access links to its processing environment on Hugging Face (Hugging Face Spaces), where a vision-and-language model interprets the content. This transmission is encrypted in transit (TLS). According to Hugging Face, the contents of inference requests and responses are not stored and are not used to train models; limited operational logs may be retained for a short period (up to 30 days) for debugging and security. Hugging Face may route requests to third-party model providers, who operate under their own policies.
• The signed access links are time-limited and exist only so the processing environment can read a specific attachment for a single turn.
• To limit cost and abuse, each account may send up to 20 messages to ARIA per rolling 5-hour window.
• A small number of authorised NNL administrators can read ARIA conversations. Access is restricted to named administrator accounts, protected by a separate password on top of the ordinary sign-in, and is read-only - an administrator cannot write in your conversation or alter it. It exists so we can operate, debug and safeguard ARIA while it is in early development, and it is used for that purpose only. We rely on Article 6(1)(f) GDPR, our legitimate interest in keeping the service working and safe. If you would rather this did not apply to your conversations, delete them in the app or contact us.

Your ARIA conversations and their attachments are kept until you delete them: you can delete an individual conversation at any time from within the app, and deleting your account permanently removes all of your ARIA conversations, messages, and stored attachments. You are responsible for ensuring you have the right to send and process any image or file you submit; please avoid sending content that contains highly sensitive personal information or that you are not authorized to share. ARIA's output is generated automatically and may contain mistakes - verify important facts.

Password Security

Passwords are never stored in plain text. All passwords are securely hashed before storage.

Data Storage

Account data, such as your display name, email address, and hashed password, is securely processed and stored using infrastructure provided through Cloudflare services and related platform tools required for operation. Cloudflare maintains industry-standard security practices and privacy protections.

Uploaded media and the data derived from it are processed on infrastructure provided through Hugging Face. Storage in this processing environment is ephemeral and is not used for long-term retention of your uploads. See "User Content & Media Processing" above for details.

Your chat history, conversations, messages, and the derived text transcript , is stored in Cloudflare's D1 database (EU East region) as text only. No uploaded media is stored there. See "Chat History" above.

Your ARIA conversations (messages, ARIA's replies, and the event log) are stored in Cloudflare's D1 database (EU East region). Images and files you send to ARIA are stored as objects in Cloudflare R2. These attachments are retained until you delete the conversation or your account. See "ARIA, Conversational Agent" above.

Data Sharing

We do not sell, rent, or trade personal information to third parties. Data is only processed when required for infrastructure operation, legal compliance, or security protection.

To provide media analysis, derived text excerpts may be transmitted to Hugging Face's model inference service and, where applicable, to the third-party model providers it routes to. These providers process the data solely to return a result and operate under their own security and privacy policies.

Security Measures

To protect accounts from unauthorised access, we log failed login attempts by IP address. Records of failed attempts are retained for up to one hour and are used solely for rate-limiting purposes. A maximum of five failed attempts per IP address per hour is permitted; after that threshold is reached the IP is temporarily blocked from login attempts.

Data Retention

Account data is retained for as long as your account is active or as long as necessary to provide the service. Specific retention periods:

• Unverified accounts not confirmed within 15 minutes of registration are automatically and permanently deleted
• Email verification codes expire after 15 minutes and are deleted upon successful verification
• Session cookies expire after 30 days and are deleted on logout
• Password reset tokens expire after 1 hour and are deleted after use
• Failed login records are retained for up to 1 hour for rate-limiting purposes
• Uploaded media in the processing environment is kept for up to 15 minutes (to allow follow-up questions in the same chat) and is then automatically purged; it is never stored in your account
• Chat history (conversations, messages, and derived transcripts) is retained until you delete it, per conversation in the app, or entirely by deleting your account; no uploaded media is ever stored
• Files uploaded to LUNA are kept in the processing environment only for the duration of the task and are then automatically purged (within about 15 minutes, and on restart); they are never stored in your account
• LUNA tasks (the prompt, title, and generated Note, text only) are retained until you delete them, per task in the app, or entirely by deleting your account; no uploaded files are ever stored
• ARIA conversations (messages, replies, and the event log) and the images and files you send to ARIA (stored in Cloudflare R2) are retained until you delete them, per conversation in the app, or entirely by deleting your account

Data Protection (RODO / GDPR)

Next Neural Labs acts as the data controller within the meaning of Regulation (EU) 2016/679 (GDPR), known in Poland as RODO. This section describes our obligations and your rights under that regulation.

Data Controller

Next Neural Labs (NNL)
Contact: patryk@nnlabs.pl

Legal Basis for Processing

• Account data (name, email, hashed password), processed on the basis of Article 6(1)(b) GDPR: performance of a contract (providing you access to the NNL service)
• Security logs and failed login records, processed on the basis of Article 6(1)(f) GDPR: our legitimate interest in protecting platform security against unauthorised access
• Uploaded media and derived data, processed on the basis of Article 6(1)(b) GDPR: performance of the analysis service you have requested
• Chat history (conversations, messages, derived transcripts, never the media), processed on the basis of Article 6(1)(b) GDPR: providing the chat feature you use, and retained until you delete it
• LUNA tasks (uploaded files processed transiently, plus the stored prompt, title and generated Note, never the files), processed on the basis of Article 6(1)(b) GDPR: performance of the file-synthesis service you have requested, and retained until you delete it
• ARIA conversations (messages, replies, the event log, and the images and files you send, which, for ARIA, are stored in Cloudflare R2), processed on the basis of Article 6(1)(b) GDPR: performance of the conversational service you have requested, and retained until you delete it
• Administrator review of ARIA conversations, restricted to named administrator accounts and read-only, processed on the basis of Article 6(1)(f) GDPR: our legitimate interest in operating, debugging and safeguarding the conversational service during its early development. See "ARIA, Conversational Agent" above.

Data Processors

We use the following sub-processors who handle personal data on our behalf:

• Cloudflare, Inc., edge infrastructure, DDoS protection, DNS, database (D1) stored in the EU East region, and object storage (R2) used to hold the images and files you send to ARIA
• Resend, Inc., transactional email delivery (verification codes and password resets). Email addresses are transmitted to Resend solely to deliver these messages.
• Hugging Face, Inc., media and file processing infrastructure for the analysis (NINA), file-synthesis (LUNA) and conversational (ARIA) tools. Derived text excerpts, and for ARIA the images and files you send, may be routed to model inference services operated by Hugging Face or its partners.

Your Rights Under RODO

You have the following rights regarding your personal data. To exercise them, contact us at patryk@nnlabs.pl, we will respond within 30 days.

• Right of access (Art. 15), request a copy of the personal data we hold about you
• Right to rectification (Art. 16), request correction of inaccurate or incomplete data
• Right to erasure (Art. 17), request deletion of your account and all associated personal data
• Right to restriction of processing (Art. 18), request that we limit how we use your data in certain circumstances
• Right to data portability (Art. 20), request your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21), object to processing carried out on the basis of legitimate interests (Art. 6(1)(f))

Right to Lodge a Complaint

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland - uodo.gov.pl.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Cookies

We use a single session cookie, nnl_session, set by app.nnlabs.pl when you log in to your account. This cookie is used exclusively for authentication, it identifies your active session so you remain logged in between page visits.

• Name: nnl_session
• Purpose: Session authentication only, no tracking, no advertising
• Duration: 30 days from login, or until you log out
• Scope: app.nnlabs.pl only (not set on nnlabs.pl)
• Security: HttpOnly (not accessible to JavaScript), Secure (HTTPS only), SameSite=Lax
• Storage: Session tokens are stored in Cloudflare D1 (EU East region) and deleted on logout or expiry

We do not use tracking cookies, advertising cookies, or any third-party cookies. No cookies are set on the main nnlabs.pl domain.

Terms of Service

By creating an account or using this website, you agree to these terms.

Account Responsibility

You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account.

Acceptable Use

You agree not to:

• Attempt unauthorized access
• Disrupt or abuse platform services
• Reverse engineer or exploit vulnerabilities
• Use the platform for unlawful activity
• Upload or process media you do not own or have permission to use

User Content & Ownership

You retain ownership of the media you upload. By submitting content, you grant us a limited, temporary license to process it solely for the purpose of providing the requested analysis and returning results to you. We do not claim ownership of your content and do not use it to train models.

Service Availability

The service is provided "as is" without guarantees of uninterrupted availability, accuracy, or error-free operation.

Intellectual Property

All original code, design systems, branding, animations, interface assets, and content remain the property of Next Neural Labs unless otherwise stated.

Limitation of Liability

To the fullest extent permitted by law, Next Neural Labs shall not be liable for indirect, incidental, or consequential damages resulting from use of the service.

Changes

These terms may be updated periodically. Continued use of the service after updates constitutes acceptance of revised terms.

Contact

For privacy or legal requests:
patryk@nnlabs.pl
kris@nnlabs.pl