Privacy policy

NeoBot is run by AAR Ventures Limited, a company registered in England and Wales (company number 15570583), registered office 57 The Wickets, Luton, England, LU2 7JB, trading as "NeoBot by Northvis" ("we", "us").

For questions about this policy or your data, email neobot@northvis.com. You can also reach us on WhatsApp or through the form on our home page.

• We are the controller for data about our own customers and visitors: agency owners and users, people who contact us, and visitors to this website.
• We are a processor for the data agencies put into NeoBot about their own business: their clients, teams, suppliers and the marketplace orders in their files (which can include buyers' names). The agency is the controller of that data and decides how it is used; we only process it to provide NeoBot to them.

• Account details (name, email, password stored only as a secure hash, agency name, role): to provide your account and keep it secure. Legal basis: our contract with you.
• Agency business data (marketplace reports and statements, costs, invoices, profit splits, payments, client and team contact details): to produce your closes and reports. We process it for the agency under our contract with them.
• Buyers' names from marketplace reports: kept only to match supplier invoices to orders, shown only to the agency owner and the order's team, and deleted 2 years after the order. Buyers' addresses are not stored.
• Card and bank statements uploaded for the AI cost audit: read to list the card payments; the file itself is not kept.
• Billing: Stripe handles payments. We receive your billing status, invoices and a card fingerprint from Stripe, never full card details. Legal basis: contract, and our legal duty to keep financial records.
• Questions to Ask NeoBot inside the app (the question, the answer, your role and the page you were on, not the figures on screen): to answer you and improve the user guide. Deleted after 12 months.
• Interest forms and website chats (name, agency, country, number of stores, WhatsApp or email, the conversation): to answer you and improve our answers. Legal basis: steps you ask for before a contract, and our legitimate interest in answering enquiries. Chats are deleted after 12 months.
• Fraud prevention: to keep the free offer to one per business, we keep one-way fingerprints (not the readable values) of the sign-up internet address, email, phone, agency name, card and marketplace seller names. Legal basis: our legitimate interest in preventing misuse. Kept for 3 years.
• Security logs (sign-ins, administrative actions): to keep the service secure and accountable.

We use only the cookies needed to keep you signed in and to protect forms. We do not use advertising or tracking cookies, so there is no cookie banner.

We never sell personal data. We use these service providers, each bound by a data processing agreement:

• Hosting: our private server provider (Contabo), with encrypted nightly backups stored in Google Drive.
• Payments: Stripe.
• AI: Anthropic (Claude), to read uploaded statements, answer website and in-app questions, and polish wording. Under Anthropic's commercial terms, the data we send is not used to train its models.
• Exchange rates: the European Central Bank's public rates (no personal data is sent).

We may disclose data if the law requires it. Where data is processed outside the UK or EEA, we rely on adequacy decisions or standard contractual clauses.

• Agency accounts: while the account is active; after cancelling, summaries stay readable for 12 months, then the account is closed and its data deleted within a further 3 months (backups roll off within 90 days).
• Buyers' names: 2 years after the order. Website chats: 12 months. Fraud-prevention fingerprints: 3 years.
• Our own billing records: 6 years, as UK law requires.

Data travels over HTTPS, each agency's data is separated from every other agency's in the database itself, passwords are hashed, access is limited by role, and backups are encrypted. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. For data an agency put into NeoBot, please contact that agency first; we will help them answer. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

NeoBot is a business service and is not meant for anyone under 18.

We will post any change here with a new date, and tell account owners about important changes before they apply.