Privacy Policy

NeuroBridgeEDU is a local-first desktop application. By default, transcript text and summaries stay on your device. If you opt into Pro cloud AI, the app sends transcript text to your chosen provider for summaries, and your question plus recent chat history and meeting context for Study Sage chat. Recordings and audio never leave your device. Release builds make an automatic update check and, only if a Pro licence key is stored, a Lemon Squeezy licence check. Neither sends recording, transcript, or audio content.

This page describes what data we touch, how we touch it, and the rights you have under the EU General Data Protection Regulation (GDPR). It applies to both the desktop application and to the marketing website at neurobridgeedu.eu.

The data controller is Emanuel Covasa, trading as NeuroBridgeEDU. You can contact the controller at contact@neurobridgeedu.eu.

Desktop app: what stays on your device

The following are stored locally in a SQLite database in your OS application support directory and are never sent to us:

• Audio recordings you make (saved as WAV files alongside the database).
• Transcripts generated by the on-device Whisper model.
• Summaries generated by on-device Built-in AI models (Mistral / EuroLLM) on macOS, Windows, and Linux. Ollama and opt-in Pro cloud are optional alternative providers.
• Your settings, including chosen models, language, and reading-style preferences.
• Local database files and recordings are plaintext on your machine.
• API keys for cloud providers are protected by the operating system keychain.

Desktop app - automatic connections

• Update check: the app asks GitHub (api.github.com) whether a newer version exists. It checks about five seconds after launch, every 24 hours, on reconnect, and retries about 30 minutes after a failed check. The request carries the app version and normal web metadata, such as your IP address, but no account or app content. Licence validation: if a Pro licence key is stored, the app validates it with Lemon Squeezy (api.lemonsqueezy.com) at most once per launch, unless a recent validation is cached. It sends your licence key and, once activated, its Lemon Squeezy instance id. A hashed device id is sent only when you activate a licence, not during routine checks. No recording, transcript, or audio is sent. Free installs with no licence key make no such call.
• Connectivity probes: off by default. If you switch on background connectivity checks in Settings then Diagnostics, the app sends a small reachability request to Cloudflare (1.1.1.1), falling back to connectivity-check.ubuntu.com, five seconds after start and then every 300 seconds, so it can drop to a local model instead of waiting on a cloud provider it cannot reach. The request carries normal web metadata such as your IP address and nothing else of yours.

Desktop app: error reports stay on your device

Anonymous error reporting is off by default, and switching it on does not send us anything. It writes the error summary, the app version, and your platform into the app's own log file. There is no NeuroBridgeEDU error-tracking server for them to reach. Those lines come to us only if you choose to attach the diagnostic report to a bug report and send it. They never contain your audio, transcripts, or summaries.

Website: what we log

The marketing site uses Vercel Web Analytics, which is part of our hosting. Your browser loads it on every page and reports the page view to Vercel. Vercel publishes the list of what a data point may carry: the event timestamp, the URL and its dynamic path, the referrer, filtered query parameters, geolocation to city level, the device operating system and browser with their versions, the device type, and the version of the analytics script. It does not carry your name, your email, or anything you type. Vercel says it uses no third-party cookies, identifies a visitor instead by a hash created from the incoming request, and discards the visitor session after 24 hours. We are repeating Vercel there, not adding a promise of our own; its statement is at vercel.com/docs/analytics/privacy-policy.

Contact form / Pro access form

If you submit the contact form or the Pro access form we receive the fields you typed: your name, email, role, and (optionally) institution. We use this only to reply to you about your request.

The data we receive is used for these purposes only:

• Replying to your message. If you wrote to us, we reply.
• Replying to Pro access requests. If you ask about Pro or institutional access, we reply to that request.
• Diagnosing crashes. If you attach the diagnostic report to a bug report and send it, the log lines in it help us fix the bug.
• Understanding website traffic. Aggregate analytics tell us which pages are useful and where to focus.

We do not use your data for advertising, do not sell or rent it to anyone, and do not use it to train AI models.

Under the GDPR you have the following rights with respect to data we hold about you:

• Right of access: ask us what data we have about you and we'll send you a copy.
• Right to rectification: ask us to correct any data that's wrong.
• Right to erasure: ask us to delete your data (the "right to be forgotten").
• Right to restrict processing: ask us to pause processing your data while a question is being resolved.
• Right to data portability: get a machine-readable copy of your data.
• Right to object: object to specific processing activities, including marketing.
• Right to lodge a complaint with the Irish Data Protection Commission (or your local supervisory authority) if you believe we've handled your data improperly.

To exercise any of these rights, email contact@neurobridgeedu.eu. We respond within 30 days.

We are based in Ireland. The website is hosted by Vercel, with its server-side functions pinned to Vercel's Dublin region, which is set in this site's own configuration. The automation server that receives the forms, n8n.emmi.zone, is a separate machine hosted with Hostinger in Paris, France. Where Vercel stores the analytics and request logs it collects on our behalf is governed by Vercel's terms and its subprocessor list, not by this notice.

If you use Pro cloud AI providers (Mistral, OpenAI, or Anthropic), the content you send goes directly from your device to that provider. We don't intercept or proxy it. Ollama is a separate local provider by default; if you point it at a remote host, that host is your own configuration. Previously saved Gemini API keys are still covered by the app's erase-all-data flow and are redacted from data exports. Gemini is no longer available as a provider. Each provider has its own privacy policy and data-residency story; please review the one(s) you opt into.

Services we rely on

• Vercel - hosts the marketing website and provides its Web Analytics.
• Mistral AI - optional cloud AI provider, bring-your-own-key (Pro only).
• Lemon Squeezy - processes Pro licence purchases and licence validation.
• GitHub - hosts the automatic app update check.
• Hugging Face - hosts the Whisper and AI model downloads.

A managed, keyless cloud option is planned, but unscheduled.

The marketing website does not set tracking cookies. We use one functional cookie for the theme preference (light / dark / system) which is stored locally in your browser and not transmitted to us.

The desktop app does not use cookies (it's not a browser application).

For any privacy-related question, complaint, or rights request, email contact@neurobridgeedu.eu. Please mention "Privacy" in the subject line so we can route it appropriately.

If you're not satisfied with our response, you can lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.