Privacy Policy

1. Who We Are

The data controller for this website is neuralboot, the source-available project and organization behind Trapetum. The site is accessible at https://neuralboot.com/trapetum and is served via Amazon CloudFront backed by Amazon S3.

For any privacy-related enquiry, please contact us at privacy@neuralboot.com. This same address is used to reach the person responsible for the protection of personal information under all applicable frameworks referenced in this policy.

The Trapetum software itself is source available under the Business Source License 1.1 (BSL 1.1), with the terms available at https://github.com/neuralboot/trapetum/blob/main/LICENSE. This privacy policy relates solely to the landing-page website, not to the software.

2. What Data We Collect

A. Server logs and IP addresses (CloudFront)

When you visit this site, Amazon CloudFront automatically records standard access-log data, including your IP address, the URL requested, HTTP status code, browser user-agent string, and timestamps. This data is processed by Amazon Web Services on our behalf and is used solely for security and operational purposes.

B. Analytics (Google Analytics 4, only after consent)

We use Google Analytics 4 (Measurement ID: G-KW7XS6QPKY), loaded via Google Tag Manager (GTM-M8VLW9HR). We operate Google Consent Mode v2 with all storage defaulted to "denied". No analytics cookie is placed and no analytics hit is sent to Google unless you explicitly grant consent through our consent banner. If you consent, Google Analytics may collect your IP address (anonymised by Google), browser and device attributes, and browsing behaviour on this site (pages visited, session duration, referral source).

C. Newsletter subscription (double opt-in)

If you choose to subscribe to our newsletter, we collect your email address only. We use a double opt-in process: you will receive a confirmation email before your address is added to our list. Your email address is stored on our own AWS infrastructure (AWS Lambda plus DynamoDB, region eu-west-1, Ireland) and we use Amazon SES to send emails. We do not share your email address with any third-party marketing platform.

D. Commercial license activation (software)

The Trapetum server software is source available and, in its free and local tier, sends nothing over the network: it runs entirely on your machine. The separate commercial license tier includes a one-time activation step to validate your license. Activation occurs only when a commercial license key is configured and you have explicitly ticked the activation-consent box in the admin settings. When it runs, it records your license key, IP address, timestamp, software version and operating system. This data is stored on our own AWS infrastructure (AWS Lambda plus DynamoDB, region eu-west-1, Ireland), kept for 24 months and then automatically deleted. The legal basis is performance of the commercial licence contract and our legitimate interest in preventing unlicensed use. The free and local build never performs this step.

E. Data we do NOT collect

We do not collect names, postal addresses, payment information, or any special categories of sensitive data. We do not run advertising, sell data, profile visitors for commercial purposes, or use cross-site tracking. The free and local Trapetum software transmits no usage, prompt, or telemetry data; the only software-originated network activity described in this policy is the consent-gated commercial-license activation in Section 2D.

3. Purposes and Legal Bases

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. In each case, the processing is limited to what is necessary and you retain the right to object (see Section 7).

4. Retention Periods

5. Sub-processors

We do not use any advertising networks, data brokers, or social media tracking pixels.

6. International Transfers

Our primary newsletter infrastructure is located in AWS eu-west-1 (Ireland) and does not involve a transfer outside the EEA for that data.

When you grant consent to Google Analytics, data is transferred to Google LLC in the United States. Google relies on Standard Contractual Clauses (SCCs) adopted by the European Commission and, where applicable, participation in the EU-US Data Privacy Framework (DPF) as the legal mechanism for this transfer. You can review Google's transfer safeguards at privacy.google.com/businesses/gdprcontrollerterms.

CloudFront access logs may be temporarily cached at edge locations globally; these are treated as operational metadata and retained for 90 days.

For residents of jurisdictions with transfer restrictions (including Japan and Quebec), the above transfer mechanisms are relied upon to ensure an adequate level of protection. If you have questions about specific safeguards, contact privacy@neuralboot.com.

7. EU/EEA and UK Rights (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data. You have the following rights:

How to exercise your rights

Email privacy@neuralboot.com with the subject line "Data Subject Request" and describe your request. We will respond within one month (extendable by two further months for complex requests). We may ask you to verify your identity before acting on your request.

To withdraw consent for analytics cookies, use the Your Privacy Choices control at the bottom of any page or see the Cookie Policy. To unsubscribe from the newsletter, use the unsubscribe link in any email we send you.

8. California Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights with respect to your personal information.

Categories of personal information collected

• Identifiers (e.g., IP address, cookie identifiers) — collected via server logs and, after consent, Google Analytics.
• Internet or other electronic network activity (e.g., browsing history on this site) — collected only after consent via Google Analytics.
• Email address — collected only if you voluntarily subscribe to the newsletter.

Your rights under CCPA / CPRA

• Right to Know: You have the right to know what categories and specific pieces of personal information we collect, use, disclose, and sell or share.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. Because we do not sell or share personal information, there is no opt-out needed, but you may signal your preference through the Your Privacy Choices control on this site.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined under the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA / CPRA rights.

How to exercise your California rights

Submit a verifiable consumer request to privacy@neuralboot.com with the subject line "California Privacy Request". We will respond within 45 days (extendable once by a further 45 days with notice). You may designate an authorised agent to make a request on your behalf; the agent must provide written authorisation signed by you.

9. Quebec Rights (Law 25 / Loi 25)

For residents of Quebec, Canada, Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25) applies to our collection and use of personal information.

We collect personal information only for the explicit purposes described in Section 2 above. We obtain your consent before collecting information for non-essential purposes (such as analytics). Where personal information is transmitted to a third party located outside Quebec (such as Google in connection with Google Analytics), we carry out a privacy impact assessment and rely on adequate contractual safeguards before any such disclosure.

Your rights under Law 25

• Right of access: Request a copy of the personal information we hold about you and information about how it has been used or communicated.
• Right to rectification: Request that inaccurate, incomplete, or ambiguous information be corrected.
• Right to portability: Request that computerised personal information provided to us be communicated to you in a structured, commonly used technological format.
• Right to withdrawal of consent: Withdraw consent to the collection, use, or communication of your personal information, subject to legal or contractual restrictions.
• Right to de-indexation / cessation of dissemination: In applicable circumstances, request that hyperlinks attaching your name to information be de-indexed.

Person responsible for the protection of personal information

The person in charge of the protection of personal information for this site can be reached at privacy@neuralboot.com. Requests will be handled within 30 days.

10. Canada Federal (PIPEDA)

For residents of Canada outside Quebec, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, together with any substantially similar provincial legislation.

• Accountability: neuralboot is responsible for all personal information under its control. The designated person responsible for privacy compliance is reachable at privacy@neuralboot.com.
• Identifying purposes: Purposes for collection are identified in Section 2 and Section 3 of this policy, at or before the time of collection.
• Consent: We obtain meaningful consent before collecting, using, or disclosing personal information beyond what is strictly necessary for service delivery. Consent may be withdrawn at any time (see Section 3).
• Limiting collection: We collect only what is necessary for the identified purposes.
• Accuracy: We take reasonable steps to keep personal information accurate, complete, and up to date.
• Access and correction: You may request access to your personal information and request correction of any inaccuracies by contacting us at privacy@neuralboot.com. We will respond within 30 days.

11. Japan (APPI)

For visitors in Japan, the Act on the Protection of Personal Information (APPI) and its 2022 amendments apply to our handling of your personal information (kojin joho).

• Purpose limitation: We use personal information only for the purposes stated in this policy. If we need to use personal information for a materially different purpose, we will obtain your prior consent.
• Consent for third-party provision and foreign transfer: Where we provide personal information to a third party, including Google LLC in the United States, we rely on your consent (obtained via the consent banner for analytics) or on an opt-out mechanism. By enabling analytics, you acknowledge that your data will be transferred to Google in the United States. The United States is not designated as having an equivalent level of protection to Japan; Google LLC relies on contractual safeguards. You may withdraw consent at any time using the Your Privacy Choices control.
• Disclosure requests: You may request disclosure of the personal information we hold about you, correction, addition, or deletion, as well as suspension of use or third-party provision, by contacting privacy@neuralboot.com. We will respond to verifiable requests within a reasonable period, generally within 30 days.
• Complaints: Complaints may also be directed to the Personal Information Protection Commission (PPC) of Japan.

12. Other Regions

Wherever you are located, including under Brazil's Lei Geral de Proteção de Dados (LGPD), Australia's Privacy Act, South Korea's PIPA, or any other applicable data protection law, we commit to offering you the same core rights: the right to know what we collect, to access your data, to correct inaccuracies, to request deletion, to withdraw consent, and to lodge a complaint with the relevant authority. Please contact privacy@neuralboot.com to exercise any of these rights.

13. Children

This site is not directed to children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe we have collected information from a child under 16, please contact us at privacy@neuralboot.com and we will delete that information promptly.

14. Security

We implement reasonable technical and organisational measures to protect your personal information. These include serving the site exclusively over HTTPS via CloudFront, storing newsletter data in isolated AWS infrastructure with access controls and encryption at rest, and applying the principle of data minimisation throughout. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected individuals and, where required by law, the relevant supervisory authority.

15. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide a more prominent notice (such as an email to newsletter subscribers). We encourage you to review this policy periodically. Continued use of the site after any changes constitutes acceptance of the updated policy to the extent permitted by law.

16. Contact