Privacy Policy

Effective Date: May 14, 2026
Last Updated: May 14, 2026

This Privacy Policy explains how Neyo, LLC ("Neyo," "we," "us," or "our"), a California limited liability company, collects, uses, shares, and protects personal information in connection with our website at neyo.ai and the Neyo platform and services (collectively, the "Services"). It also describes the rights you have in relation to that information and how to exercise them.

Neyo is headquartered in California, United States, and operates the Services from California with cloud infrastructure located in Canada. Our practices are designed to meet the requirements of leading data protection regimes, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and its implementing regulations; the U.S. state comprehensive privacy laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Indiana, Delaware, New Jersey, and other states with comparable laws; the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation; Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), and equivalent provincial privacy laws; Brazil's Lei Geral de Proteção de Dados (LGPD); and other applicable privacy and data protection laws.

1. About Neyo and the Scope of This Policy

Neyo, LLC is an AI-native commercial automation platform that delivers marketing strategy, creative production, multi-channel advertising execution, and performance measurement to businesses ("Clients"). In delivering the Services, Neyo handles personal information in two distinct capacities:

• As a business / controller, with respect to information about visitors to neyo.ai, individuals who request demonstrations or otherwise contact us, prospective clients, individuals associated with our Clients, and personnel of our service providers. We determine the purposes and means of processing this information.
• As a service provider / processor, with respect to information that our Clients submit to or generate within the Services in the course of operating their own marketing activities — including customer lists, audience data, marketing performance data, and conversion records. In this capacity we process personal information only on documented instructions from the relevant Client and in accordance with our agreement with that Client. We do not retain, use, or disclose personal information processed in this capacity for any purpose other than the business purposes specified in our agreement with the Client, or as otherwise permitted by applicable law.

This Privacy Policy describes our practices in both capacities. Where we act as a service provider or processor, our Clients are the businesses or controllers of that information, and individuals exercising rights in relation to that information should generally direct their requests to the relevant Client. We will support our Clients in responding to such requests.

By using neyo.ai or the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Information from Website Visitors

When you visit neyo.ai, we automatically collect:

• Technical information: IP address, browser type and version, operating system, device type, screen resolution, language preferences
• Usage information: pages visited, time on page, click paths, referring URL, exit pages, session duration
• Approximate location: derived from IP address at the city or region level
• Cookie identifiers and similar technologies: as described in Section 7

2.2 Information from Demo Requests, Inquiries, and Sales Communications

When you contact us, request a demonstration, subscribe to communications, or engage with our sales team, we collect:

• Identifying information: name, work email address, company name, role or title
• Business context: industry, company size, region, current marketing stack, stated objectives
• Communications content: information you voluntarily provide in your message or share during a call
• Engagement history: meeting attendance, materials reviewed, follow-up activity

2.3 Information About Our Clients and Their Personnel

In the course of providing the Services to a Client, we collect information about the individuals at the Client organization who interact with Neyo, including:

• Account information: name, business email, role, access credentials, multi-factor authentication settings
• Activity information: actions taken in the platform, content submitted, approvals issued, communications sent through the platform
• Billing and commercial information: contracting party, billing contact, financial transaction history

2.4 Information Processed on Behalf of Clients ("Client Data")

To deliver the Services, our Clients submit to or generate within the platform information that may include personal information about their customers, prospects, employees, or other individuals ("Client Data"). Client Data may include:

• Customer and prospect records: names, email addresses, phone numbers, mailing addresses, job titles, employer, industry, demographic attributes, and other fields typical of customer relationship management (CRM) systems
• Engagement and conversion data: form submissions, transaction records, service appointments, lead status, purchase history
• Identifiers from first-party tracking: hashed identifiers, click identifiers from advertising platforms, anonymous visitor identifiers, and similar information captured through Neyo's first-party tracking technology installed on Client websites
• Marketing performance data: impressions, clicks, conversions, revenue, attribution data from advertising platforms

Neyo processes Client Data solely to provide the Services to the relevant Client and in accordance with that Client's instructions and our Data Processing Addendum.

2.5 Information from Third-Party Sources

We may receive information about you from:

• Advertising platforms: aggregate and de-identified campaign reporting on Client campaigns
• Customer relationship management and business systems: data integrations established by Clients
• Publicly available sources: business information from public registries, professional networking sites, and similar sources, used for sales and account research
• Service providers and integration partners: information necessary to deliver the Services

2.6 Sensitive Personal Information

We do not deliberately collect or process sensitive personal information as defined under the CCPA/CPRA (including Social Security or government identifiers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of mail, email, or text messages other than to the intended recipient, genetic data, biometric information processed to uniquely identify, health information, or information concerning sex life or sexual orientation) or under equivalent provisions of other applicable laws. We instruct our Clients not to submit such information to the Services and we do not transmit such information to advertising platforms. Where any sensitive personal information is inadvertently submitted, we will work with the affected Client to delete it.

3. How We Use Personal Information

3.1 As a Business / Controller

When we act as a business or controller, we use personal information to:

• Operate, maintain, secure, and improve the Services and neyo.ai
• Respond to demonstration requests, inquiries, and support communications
• Conduct sales and marketing activities, including following up on demonstration requests, sending materials you have requested, and (with appropriate consent or legitimate interest where permitted) sending product updates and marketing communications
• Understand how visitors and prospects interact with our website and content, on an aggregated and de-identified basis where reasonably possible
• Manage our business operations, accounting, vendor relationships, and finance
• Comply with applicable law, respond to lawful requests from regulators, courts, and other authorities, and enforce our agreements
• Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity
• Establish, exercise, or defend legal claims

3.2 As a Service Provider / Processor

When we act as a service provider or processor on behalf of a Client, we use Client Data solely to:

• Provide the Services to the Client as set out in our agreement with that Client
• Generate marketing strategy, audience definitions, creative assets, campaigns, reports, and other outputs the Client has instructed us to produce
• Transmit audience data, conversion data, and related information to the advertising and marketing platforms the Client has designated, under appropriate technical safeguards
• Support the Client in fulfilling its obligations as a business or controller, including responding to requests from individuals
• Maintain backups, monitor performance, ensure security, and otherwise operate the Services
• Comply with applicable law

We do not use Client Data to:

• Provide services to other Clients
• Build, train, or improve general-purpose machine learning or artificial intelligence models that operate outside the specific Client's instance of the Services
• Sell, rent, lease, or otherwise commercialize Client Data
• Make Client Data available to any data broker, information reseller, or similar service
• Combine Client Data with personal information received from or on behalf of any other source, except as necessary to provide the Services to the same Client

3.3 Lawful Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies to our processing of personal information as a controller, we rely on the following lawful bases:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms and have concluded they are not. You may object to processing based on legitimate interests as described in Section 12.

When we act as a processor, the lawful basis for processing Client Data is determined by the relevant Client as controller, not by Neyo.

4. Automated Decision-Making and Artificial Intelligence

Neyo's Services use artificial intelligence and automated processing in substantial ways. Specifically, we use AI and automation to:

• Segment audiences from Client CRM data
• Generate creative assets, including images, video, copy, and ad variants
• Recommend campaign structure, budget allocation, and bidding strategies
• Optimize campaigns against the metrics our Clients designate
• Generate reports, summaries, and insights from marketing performance data

No solely automated decisions with legal or similarly significant effects on individuals. The Services are not designed to make solely automated decisions that produce legal effects or similarly significantly affect individuals (such as decisions about employment, credit, housing, insurance, healthcare, education, or access to essential goods or services). Decisions our Services support — such as which audience to target, what creative to display, or how to allocate advertising budget — are commercial marketing decisions that do not produce legal effects on the individuals shown the resulting advertisements. Where a Client uses the Services in a context that could involve such decisions, the Client is responsible for ensuring appropriate human review, notices, and safeguards (including under the California Privacy Protection Agency's ADMT regulations and equivalent state and international rules).

Meaningful information about the logic. Where required by applicable law, including the CCPA/CPRA, the California Privacy Protection Agency's regulations governing Automated Decision-Making Technology, Article 22 of the GDPR, and Article 12.1 of Quebec's Law 25, we provide the following information about the logic involved in our automated processing:

• Inputs: structured marketing data submitted by our Clients (customer records, conversion events, campaign performance), publicly available creative references, brand guidelines, and operator instructions
• Method: a combination of large language models accessed from third-party providers under contract, classical machine learning techniques, rules-based logic, and human review at designated steps
• Outputs: marketing strategy recommendations, audience definitions, creative concepts and assets, campaign configurations, optimization actions, and reports
• Human oversight: human reviewers (whether at Neyo or at the Client) approve material campaign actions before they are executed against the Client's accounts

Right to human intervention. If you believe an automated decision concerning you has produced legal or similarly significant effects, you have the right to request human intervention, to express your point of view, and to contest the decision. Contact us at privacy@neyo.ai. Where the relevant decision was made by or on behalf of a Client, we will support that Client in responding.

Third-party AI providers. We use third-party providers of large language models and related AI infrastructure under contractual safeguards that, among other things, prohibit those providers from using Client Data to train their general-purpose models. Categories of these providers are described in Section 5.1.

5. Sharing of Personal Information and Sub-Processors

We share personal information only as described in this Privacy Policy. We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding twelve months, and we do not have actual knowledge of selling or sharing personal information of consumers under 16 years of age.

5.1 Categories of Recipients

We share personal information with the following categories of recipients:

• Cloud infrastructure and storage providers that host the Services and Client Data
• AI model and inference providers that supply the underlying language model and machine learning capabilities used by the Services
• Advertising and marketing platforms to which we transmit audience data, conversion data, and campaign configurations on behalf of our Clients (including major search, social, video, professional networking, programmatic, retail-media, and connected-TV platforms)
• Customer relationship management, e-commerce, and service management integrations that enable the Services to read and write data on behalf of our Clients, at the Client's direction
• Payment processing providers that handle billing and subscription transactions
• Communications providers that deliver transactional and marketing email, SMS, and similar messages
• Analytics, observability, and error monitoring providers that help us operate, secure, and improve the Services
• Customer support, business productivity, and identity providers that support our internal operations
• Professional advisors including legal counsel, accountants, and auditors, where bound by appropriate duties of confidentiality
• Acquirers or successors in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality and to your rights under applicable law
• Government, regulatory, and law enforcement bodies where required by law or compelled by valid legal process

5.2 Sub-Processor List and Notice of Changes

When we act as a service provider or processor on behalf of a Client, we engage sub-processors to perform certain processing activities. A current list of sub-processor categories, the corresponding entities engaged, and their locations is maintained and made available to Clients on request through our Data Processing Addendum. We notify Clients of material changes to our sub-processors in advance of those changes taking effect, and we provide Clients a reasonable opportunity to object on reasonable data-protection grounds, in accordance with our agreement.

Each sub-processor is bound by contractual obligations no less protective than those that apply to Neyo, including with respect to security, confidentiality, sub-processing, international transfers, breach notification, and assistance with data subject rights.

5.3 Restrictions

We do not:

• Sell personal information
• Share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA
• Lease or rent personal information
• Provide personal information to data brokers, information resellers, or list compilers
• Combine Client Data with data from other Clients or other sources to create cross-Client profiles or directories
• Use personal information obtained through advertising platform APIs to enrich, supplement, verify, or append to user profiles or to create derivative datasets
• Permit any sub-processor to do any of the above

6. Advertising Platform Data Handling

Service-provider disclosure. A core function of the Services is to operate marketing and advertising activities on behalf of our Clients. In delivering this function, we share customer information (including hashed contact identifiers and conversion data) with third-party advertising and marketing platforms that perform services on the Client's behalf — including audience matching, ad delivery, conversion measurement, and reporting. This disclosure is provided in satisfaction of disclosure requirements under the policies of major advertising platforms, including those governing customer-list and audience-matching programs.

The following practices apply to all such processing, in line with the requirements of the advertising platforms with which we integrate:

6.1 Hashed Identifiers Only

Where personally identifiable contact information (email address, phone number, mailing address, or similar identifier) is transmitted to an advertising platform for audience matching, conversion measurement, or similar purposes, we hash that information using SHA-256 (or a substantially equivalent algorithm specified by the platform) before transmission. We do not transmit raw, unhashed personally identifiable contact information to advertising platforms except where the platform explicitly accepts only raw values and Neyo performs the hashing on the platform's behalf as part of the transmission flow.

6.2 First-Party Data Only

We transmit to advertising platforms only data that has been collected by the Client in a first-party context — for example, information provided by the individual directly to the Client through the Client's website, app, point of sale, customer relationship management system, or other Client-controlled channel. We do not transmit purchased lists, scraped data, or data acquired from third parties for the purpose of advertising platform matching.

6.3 Consent Signals

Where advertising platforms require consent signals to be passed alongside transmitted data — for example, under the EU User Consent Policy, the California Privacy Protection Agency's opt-out preference signal framework, or equivalent — Neyo passes through the consent signals that the relevant Client has captured from the data subject. Neyo does not generate or assume consent on the Client's behalf. Our Clients are responsible for obtaining and managing consents in accordance with applicable law.

6.4 Sensitive Categories and Prohibited Information

We do not knowingly transmit, and instruct our Clients not to transmit, data that would constitute "prohibited information," "sensitive categories," "restricted categories," "sensitive interest categories," or equivalent designations under any advertising platform's terms or personalized-advertising policies. This includes information relating to health conditions, mental health, financial hardship, sexual orientation, immigration status, political beliefs, religion, and other categories specifically restricted by the relevant platform.

6.5 Member Data and Platform-Provided Data

Where an advertising platform provides Neyo with data about that platform's members or users (for example, conversion attribution data, lead form responses, member identifiers, or campaign reporting), Neyo handles such data strictly in accordance with the platform's API terms and developer policies. Specifically, Neyo does not:

• Export, transfer, or distribute such data to any third party (including to Clients), except as expressly permitted by the platform's terms (for example, lead form response data delivered to the Client for whom the lead was captured)
• Create a database of such data drawn from multiple unaffiliated platform accounts
• Commingle or combine such data with any other personal information, including for the purpose of supplementing, verifying, appending to, or enriching user profiles, leads, or any portions thereof
• Commercialize, sell, lease, or otherwise make available such data to any data broker, information reseller, information broker, data monetization service, or similar service
• Use such data for any purpose other than operating the specific advertising campaigns, reporting, or related activities for which it was collected
• Display such data within the Services to any Client other than the Client on whose behalf it was collected

Where an advertising platform's terms require that data from that platform be presented to Clients separately from data from other platforms or channels, we ensure the Services support that separation, and we do not mark up, repackage, or attribute platform-charged costs in a manner that obscures the platform's underlying costs from the Client.

6.6 Audience Lists

Custom audience lists, lookalike audience definitions, and similar audience constructs created within an advertising platform on behalf of a Client are the Client's audiences. Neyo does not sell, transfer, or share such audiences with any third party, and does not authorize any third party to do so. Audience lists are refreshed and deleted in accordance with the Client's instructions and the relevant platform's retention rules.

6.7 Compliance Reviews

Advertising platforms reserve the right to review our practices for compliance with their terms at any time. We cooperate with reasonable compliance reviews, audits, and inquiries from those platforms, including by providing requested information about our Services and our handling of platform-provided data.

7. Cookies, Pixels, and Similar Technologies

7.1 Cookies on neyo.ai

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary: required for the site to function (e.g., session management, security, form submission)
• Functional: remember your preferences (e.g., language, region, accessibility settings)
• Analytics: help us understand how visitors interact with the site, on an aggregated basis
• Marketing: support our own marketing and remarketing activities, where you have consented

We recognize and honor opt-out preference signals such as the Global Privacy Control (GPC) as required under the CCPA/CPRA and equivalent laws. Where required by applicable law (including in the European Economic Area, the United Kingdom, California, Colorado, Connecticut, and Quebec), we obtain consent or honor opt-out signals before placing non-essential cookies through a consent management interface. You can withdraw consent or change your preferences at any time through the cookie preferences control available on the website.

You can also control cookies through your browser settings. Disabling certain cookies may affect site functionality.

7.2 Neyo Tag Manager and Client Website Technologies

Separately from cookies on neyo.ai, Neyo provides Clients with a first-party tag, "Neyo Tag Manager," that Clients may install on their own websites and apps to capture marketing-relevant events, click identifiers, and conversion signals. Use of the Neyo Tag Manager on a Client's property is governed by that Client's privacy notice and consent management, not by this Privacy Policy. Clients are responsible for disclosing the technology to their users and obtaining any consents required by applicable law (including the EU ePrivacy framework, the CCPA/CPRA, and equivalent rules).

8. Data Retention

We retain personal information only for as long as necessary for the purposes set out in this Privacy Policy, taking into account the nature of the information, the purposes for which it is processed, and applicable legal, accounting, and security requirements.

Where retention periods conflict with a more specific contractual obligation or with the Client's documented instructions in our capacity as service provider or processor, the more specific obligation governs.

9. International Data Transfers

Neyo, LLC is headquartered in California, United States, and operates the Services from California. Our primary cloud infrastructure is located in Canada (AWS ca-central-1 region). Some of our service providers, sub-processors, and integration partners are located in the United States, Canada, the European Union, the United Kingdom, and other jurisdictions. As a result, personal information may be transferred across international borders in the course of providing the Services, including routinely between the United States and Canada for operational purposes.

For Clients and individuals located in jurisdictions outside the United States:

• From the European Economic Area, United Kingdom, or Switzerland to the United States or other non-adequate jurisdictions, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum or UK International Data Transfer Agreement, supplemented by appropriate technical and organizational measures, including encryption in transit and at rest, access controls, and pseudonymization where appropriate. We complete transfer impact assessments where required.
• From Canada to the United States, we apply contractual safeguards consistent with PIPEDA's accountability principle. For transfers of personal information from Quebec, we conduct Privacy Impact Assessments where required by Law 25 and apply contractual and technical safeguards consistent with that requirement.
• From other jurisdictions, we apply the cross-border transfer mechanisms required by applicable law.

We make available, on request to privacy@neyo.ai, information about the safeguards in place for international transfers relevant to your personal information.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. Our security program is aligned with industry-standard frameworks and includes:

• Encryption of personal information in transit and at rest
• Role-based access controls, least-privilege provisioning, and multi-factor authentication for administrative access
• Logging, monitoring, and alerting for security-relevant events
• Vulnerability management, including regular scanning and timely patching
• Secure software development practices
• Personnel security measures, including background checks where permitted by law, confidentiality obligations, and security training
• Vendor security reviews and contractual security obligations
• Incident response procedures
• Periodic review and update of security controls

No method of transmission or storage is perfectly secure. While we work hard to protect personal information, we cannot guarantee absolute security.

11. Data Breach Notification

If we become aware of a personal information breach that affects information for which we are responsible, we will:

• Promptly investigate and contain the incident
• Notify affected Clients without undue delay, and in any event within the time period set out in our agreement with the relevant Client (default: 72 hours after confirmation of a reportable incident), so that the Client can fulfill its own notification obligations
• Where we are the business or controller, notify regulators and affected individuals where required by applicable law, including:
  • California Civil Code § 1798.82 and California Attorney General notification requirements
  • State data breach notification laws of every U.S. state where affected individuals reside
  • GDPR Article 33 (within 72 hours of awareness to the lead supervisory authority)
  • PIPEDA breach reporting to the Office of the Privacy Commissioner of Canada and notification to affected individuals
  • Quebec Law 25 notification to the Commission d'accès à l'information du Québec and affected individuals
• Maintain a register of security incidents involving personal information, as required by Quebec Law 25 and equivalent obligations
• Cooperate with our Clients, regulators, and law enforcement as required

12. Your Rights

Subject to applicable law, you may have the following rights with respect to personal information for which Neyo is the business or controller. These rights are not absolute, and may be subject to limitations, exceptions, and verification requirements.

12.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the categories of sources from which we collect it, the business or commercial purposes for which we use it, the categories of recipients to whom we disclose it, and the specific pieces of personal information we have collected about you
• Receive a copy of the specific pieces of personal information we have collected about you, in a portable and (where technically feasible) readily usable format
• Delete personal information we have collected about you, subject to permitted exceptions
• Correct inaccurate personal information we maintain about you
• Limit the use or disclosure of sensitive personal information to what is necessary to perform the Services or as otherwise permitted by law
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. Neyo does not sell or share personal information as those terms are defined under the CCPA/CPRA, and so this right is satisfied by default. We honor opt-out preference signals such as the Global Privacy Control (GPC).
• Opt out of automated decision-making technology as set out in CPPA regulations (see Section 4 above regarding the limited use of ADMT in our Services)
• Be free from retaliation for exercising these rights

To exercise these rights, contact us at privacy@neyo.ai or use the request mechanisms on our website. You may also designate an authorized agent to make a request on your behalf, subject to verification requirements. Requests are responded to within 45 days, extendable by an additional 45 days where reasonably necessary, with notice to you.

Notice at collection: The categories of personal information we collect, the purposes for which we use it, and the categories of recipients are set out in Sections 2, 3, and 5 above. We retain personal information for the periods described in Section 8.

12.2 Other U.S. States with Comprehensive Privacy Laws

If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Indiana, Delaware, New Jersey, or another state with a comprehensive consumer privacy law in effect, you may have rights similar to those described above, including rights of access, correction, deletion, portability, opt-out of targeted advertising, and (in some jurisdictions) opt-out of profiling for consequential decisions. To exercise these rights, contact us at privacy@neyo.ai. We will respond within the time period required by the law of your state (typically 45 days).

12.3 Residents of the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If the GDPR or UK GDPR applies to your information, you have the right to:

• Access, rectification, erasure, restriction of processing, data portability, and objection (Articles 15–21)
• Withdraw consent at any time where processing is based on consent
• Not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you (Article 22; see Section 4 above)
• Lodge a complaint with a supervisory authority. In the European Union, a list of supervisory authorities is available from the European Data Protection Board. In the United Kingdom, contact the Information Commissioner's Office at ico.org.uk.

12.4 Residents of Canada (PIPEDA) and Quebec (Law 25)

If you are a resident of Canada or Quebec, you have rights including:

• Access to your personal information and information about how it has been used and to whom it has been disclosed
• Correction of inaccurate personal information
• Withdrawal of consent where consent is the basis for processing
• A right to be informed about and contest decisions based exclusively on automated processing
• A right to data portability (computerized personal information collected in Quebec)
• A right to file a complaint with the Office of the Privacy Commissioner of Canada (PIPEDA) or the Commission d'accès à l'information du Québec (Law 25)

12.5 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@neyo.ai. We may request information reasonably necessary to verify your identity. We will respond within the time period required by applicable law.

If you are exercising a right with respect to information that Neyo processes on behalf of a Client (for example, your information appearing in a Client's CRM), please contact the relevant Client. We will support that Client in responding to your request.

13. Children's Privacy

The Services are intended for use by businesses, not individuals under the age of 18 (or the equivalent age of majority in the relevant jurisdiction). We do not knowingly collect personal information from children. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. If we become aware that we have collected information from a child without verified parental consent, we will delete it promptly. If you believe we may have collected information from a child, please contact privacy@neyo.ai.

14. Marketing Communications

Where you have requested information from us or opted in to marketing communications, we may send you product updates, event invitations, and similar communications. You can unsubscribe at any time using the link provided in any marketing email, or by contacting privacy@neyo.ai. We will continue to send service-related (non-marketing) communications necessary to deliver the Services.

We comply with applicable anti-spam laws, including the U.S. CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), the Telephone Consumer Protection Act (TCPA) where applicable, the GDPR and ePrivacy framework (EU/UK), and equivalents.

15. Privacy Officer and Data Protection Contact

Neyo has designated a Privacy Officer responsible for compliance with applicable privacy laws, including the CCPA/CPRA, PIPEDA, and Quebec Law 25. The Privacy Officer can be reached at:

Privacy Officer
Neyo, LLC
209 Emerystone Terrace
San Rafael, CA 94903
United States
Email: privacy@neyo.ai

For Clients that require a designated point of contact for data protection matters relating to their use of the Services, this contact serves that role.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide notice through the Services or by email. Where required by applicable law, we will obtain renewed consent.

We encourage you to review this Privacy Policy periodically.

17. Contact Us

For questions about this Privacy Policy, our privacy practices, or to exercise any of the rights described above, contact:

Neyo, LLC
209 Emerystone Terrace
San Rafael, CA 94903
United States
Email: privacy@neyo.ai

For Clients, additional contact channels and obligations are set out in our Master Services Agreement and Data Processing Addendum.

This Privacy Policy is provided in good faith and represents Neyo's privacy practices as of the effective date. It is not legal advice. We recommend that organizations with specific compliance questions consult qualified privacy counsel. Where any provision of this Privacy Policy is inconsistent with applicable law, the requirements of applicable law govern.