Privacy Policy

Neural Arc, Inc. is a Delaware corporation trading as ModelBeat. For the data described in this policy, we are the controller: we decide what is collected and why.

Privacy questions, and any request to exercise the rights below, go to hello@neuralarc.ai. Put the word privacy in the subject line and it reaches the right people faster.

ModelBeat sits in two different relationships to data, and they are governed differently.

Account data

Who you are, how you pay, and how you use the service. We decide what to collect and why, so we are the controller. That is what this policy covers.

Prompt content

What you send through the gateway and what comes back. You decide what goes in it; we only process it to serve the request. There we are your processor, and the Data Processing Agreement governs it rather than this policy.

If you need a DPA in place before routing personal data through us, ours is published in full at modelbeat.ai/dpa. It takes effect with these terms rather than needing to be requested.

Account and identity

Your name, email address, the organisation you belong to, and the identifiers your sign in method gives us.

Billing

Your Stripe customer identifier, your plan, your credit balance and your transaction history. We never receive card numbers. Stripe handles the payment and we see the result, not the instrument.

Usage metadata

Request counts, token counts, cost, which model was selected, which provider served it, latency and timestamps. This is what your bill and your audit trail are built from. It is not the content of your requests.

Security and audit logs

IP address, user agent, authentication events, and a record of privileged actions taken on your account: who acted, on what, and whether it went through.

Things you send us

Anything in an email, a support request, a waitlist form or a sales enquiry.

Website

Very little. See the cookies section below.

This is the question we are asked most often, so it has a section of its own.

• We do not train models on your content. There is no setting that enables it and no plan tier where it changes.
• Prompt and completion content is processed to serve your request and is not retained by default.
• We log metadata about each call rather than its contents, so token counts and costs are recorded and the text is not.
• Content is passed to the provider that serves the request, and that provider's own terms apply to what it does with it. Which providers we use is on our sub-processor list.
• In a licensed deployment running inside your own environment, the traffic never reaches us at all.

Where the GDPR or a similar law applies, these are our lawful bases.

To provide the service

Performance of our contract with you. Account data, billing and usage metadata all sit here.

To keep it secure

Our legitimate interest in preventing fraud and abuse, protecting the platform, and being able to reconstruct what happened after an incident.

To improve it

Our legitimate interest in understanding aggregate usage. This works on metadata, not content.

To meet legal obligations

Financial records, tax, and responding to lawful requests.

Analytics and marketing on our website

Your consent, given through the cookie banner and withdrawable at any time.

• We do not sell personal data, and we do not share it for cross context behavioural advertising.
• We do not train models on your content.
• We do not read your prompts. Support cannot pull up the text of your requests, because it is not retained.
• We do not use your data to build a profile of you beyond what running the service requires.

We share personal data with sub-processors who help us run the service, and with nobody else except where the law requires it. Every sub-processor is bound by a contract with obligations equivalent to ours.

Cloud infrastructure

Hosting, storage and networking for the managed service.

Stripe

Payments and billing. Stripe receives your card details directly; we never do.

Model providers

The upstream provider that serves each routed request.

Operational tooling

Email delivery, error monitoring and support, under the same contractual terms.

The current sub-processor list is published, and we give 30 days' notice before adding one that materially affects you. We may also disclose data where we are legally compelled, and where necessary to protect our rights or someone's safety. If our business is acquired, data may transfer with it, and this policy will continue to apply until you are told otherwise.

We operate from the United States and India, and our sub-processors operate in several countries. Where personal data leaves the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or another valid transfer mechanism, together with the technical measures described below.

If where inference physically happens matters to you, that is a routing question as much as a legal one. Residency rules can be enforced before a request is routed, and a licensed deployment keeps the whole thing inside your own perimeter.

Prompt and completion content

Not retained by default.

Account data

For as long as your account is open, and then for the period we need to close it out properly.

Billing and ledger records

For as long as financial and tax law requires us to keep them. The credit ledger is append only, so entries are not deleted.

Audit log

Kept for the life of the account. It is append only by design, so entries are added and never edited.

Security logs

For a limited operational period, then deleted.

Correspondence

For as long as needed to deal with the matter and any follow up.

Where a legal obligation requires us to keep something, an erasure request cannot reach it. We will tell you when that applies.

• Encryption in transit, and encryption at rest backed by managed keys.
• The API keys we issue you are stored as a one way hash. We can check a key is valid, we cannot read it back, and it is never written to logs.
• Access is scoped to the authenticated credential, so one tenant's request cannot reach another tenant's data.
• Privileged actions are written to an append only audit log.
• Access to production is limited to the people who need it and is reviewed.

We are working towards SOC 2 Type 2 and aligning with GDPR, the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework. We do not hold those certifications today and we will not claim otherwise. What we can show you now is the architecture, the audit trail, and a deployment mode where the data never leaves your control.

No system is perfectly secure. If we suffer a breach affecting your personal data, we will notify you and the relevant authority without undue delay and within the time the law requires.

Depending on where you live, you have some or all of these rights over the personal data we hold about you.

• Access a copy of it.
• Correct it where it is wrong.
• Have it erased, where no legal obligation requires us to keep it.
• Restrict or object to how we process it, including processing based on legitimate interest.
• Receive it in a portable format, or have it sent to another provider.
• Withdraw consent at any time, without affecting what was done before you withdrew it.
• Not be subject to a decision with legal or similarly significant effect made solely by automated means.

Use the privacy controls in the console where they exist, or write to hello@neuralarc.ai. We respond within thirty days, and we will tell you if a request will take longer. We do not charge for this and we will not treat you differently for asking.

If we get it wrong, you can complain to your local data protection authority. We would rather you came to us first so we have a chance to fix it.

Our marketing site sets no cookies unless you allow them. Nothing analytical or advertising related loads until you say so, and your choice is stored in your own browser. The detail is in the Cookie Policy.

ModelBeat is a product for businesses and developers. It is not directed at children, and we do not knowingly collect personal data from anyone under sixteen. If you believe a child has given us data, tell us and we will delete it.

We will update this policy as the service changes. Where a change materially affects how we handle your data, we will tell you before it takes effect rather than quietly revising the page. The date at the top is when it last changed.