Privacy Policy

Who we are

The trader who operates NDPMV is the controller for personal data that NDPMV processes. Registered trade name: NeuralDrift.

We operate from the Netherlands. Use the contact form, or email info@ndpmv.org for a privacy request.

The Dutch supervisory authority is Autoriteit Persoonsgegevens.

• DBA: NDPMV, Neural Drift
• Billing name: NDPMV
• Email: info@ndpmv.org
• Phone: +31 85 333 4565

Scope

This policy applies to the ndpmv.org hub, products we publish, paid access, and related support. The effective date is September 3, 2026.

The hub holds account, billing, and license data. Products store a user id and the data they need to run. They do not hold a second copy of your billing identity.

Mollie B.V. has its own privacy statement for payment data that you submit to Mollie.

This policy does not cover third-party sites that we link to, or host applications such as After Effects or Resolume.

Hub data

When you create an account, we process the email, the WorkOS user id, plan, payment status, entitlements, license keys, activations, and invoices.

When you use the contact form, we store the email, subject, and message, plus a hash of the network address and browser string, so we can answer you and limit abuse. Resend then sends a notice to us and a short receipt to you.

We use this data to sign you in, grant access across products, charge renewals, send transactional mail, and keep tax records.

A product asks the hub what you may do. It does not receive your payment-method details.

Product hosts

A product can run on its own host. After you sign in, that host can set its own session cookie.

Products process the data needed for that tool, such as project files, local settings, and uploads that you start.

• Neural Drift: https://neuraldrift.app

When you use Neural Drift

Neural Drift stores a working copy of console settings, scenes, media, MIDI maps, and cache in your browser, including IndexedDB.

Live analysis of a file, a microphone, or a line-in stays on your device. That live stream does not upload.

Paid plans can upload media assets and store projects in your cloud library. When you upload, we receive media files, filenames, scenes, custom looks, and project settings.

That can include shader source inside a custom look. We use that copy to supply the console on this device or another device. We do not sell your media.

A cloud copy is not a backup promise. Free use does not include a cloud asset library.

Neural Drift asks for microphone, MIDI, or screen access only after you select that feature. We do not receive the contents of those streams.

Identity

WorkOS AuthKit handles login on login.ndpmv.org. WorkOS processes the email and authentication events needed to sign you in.

The hub stores the WorkOS user id and treats that as the identity root.

See the WorkOS privacy statement in the processor list.

Payments

When you buy paid access, Mollie B.V. processes the payment on pay.ndpmv.org.

Mollie receives the payment method, amount, currency, and the data that the selected method requires.

We receive payment status, method type, amount, currency, and a transaction identifier. We do not store full card numbers, CVC codes, or iDEAL session secrets.

We use this data to confirm paid access, handle refunds, prevent fraud, and keep tax records.

See Mollie's privacy statement at https://www.mollie.com/privacy.

Mail

Resend sends transactional mail from ndpmv.org. That includes login mail, invoices, SEPA pre-notification, dunning, transaction-lookup links, and contact-form notices.

Do not treat transactional mail as optional product mail. Optional product mail, if we offer it, needs your consent.

Analytics

A product may measure use only after you consent. Neural Drift uses PostHog in that way. We disable automatic capture and session recording there.

We send event names and limited data, such as counts, status codes, time ranges, browser family, and GPU backend.

We do not send media, prompts, filenames, URLs, or free-form text. We do not build advertising profiles.

You can reject analytics or change your choice at any time. Do Not Track in your browser also blocks analytics.

Errors and security

A product may record software errors and limited performance data so we can keep the service stable. Neural Drift uses Sentry for that.

We remove request bodies, local filenames, media data, prompts, shader source, and full URLs where our filters catch them.

We do not use error tools for advertising.

AI features

Some products can send a prompt to a model provider to generate or edit a look. On Neural Drift, AI Look Studio is off unless we enable it for your account.

Do not put personal data, secrets, or other people's private media into a prompt. We treat provider logs as processor data for that feature.

Processors and recipients

We use service providers to host the hub, run login, store data, process payments, send mail, measure product use, and review errors.

They process data only for those tasks, under a contract where GDPR requires one, except where a provider is an independent controller for its own legal duties.

Mollie B.V. acts as a payment service provider. Card networks and banks in your payment method can also receive the data they need to complete the payment.

• Vercel Inc.: hosting and content delivery for the hub and product sites we host there. Region: the United States and the European Union.
• WorkOS, Inc.: login, multi-factor authentication, and the hub session. Region: the United States and the European Union.
• Neon, Inc.: database that holds hub accounts, entitlements, licenses, and invoices. Region: the United States and the European Union.
• Resend, Inc.: transactional email from ndpmv.org. Region: the United States and the European Union.
• Mollie B.V.: payment processing for paid access. Region: the European Union.
• PostHog Inc.: product analytics on Neural Drift after you consent. Region: the European Union.
• Functional Software, Inc. (Sentry): error and performance monitoring on Neural Drift. Region: the United States and the European Union.
• BunnyWay d.o.o. (Bunny.net): cloud library file storage for Neural Drift. Region: the European Union.
• xAI: AI Look Studio on Neural Drift when that feature is on. Region: the United States.

International transfers

Some processors are in the United States or other countries outside the EEA.

Where GDPR applies, we rely on an adequacy decision or on standard contractual clauses, plus the provider's extra measures.

PostHog for Neural Drift uses the EU ingest host. Mollie processes payments in the European Union.

Cookies and similar storage

The hub and each product host use cookies and similar storage that the service needs, plus optional analytics storage after you consent.

Your browser can hold local project data. That storage is not a tracking cookie.

Each host that sets a cookie can show its own consent control. This policy is the single privacy text for those controls.

• wos-session: essential hub cookie on .ndpmv.org that keeps you signed in.
• Product session cookie: essential cookie on a product host after you complete the sign-in handoff.
• ndpmv-analytics-consent: essential local record of your analytics choice on the hub, when analytics is on.
• PostHog storage: optional on Neural Drift, only after you allow analytics.
• Sentry storage: error monitoring needed to operate Neural Drift, not used for ads.
• IndexedDB and local cache: your scenes, prefs, media, and MIDI maps on the Neural Drift device.

Legal bases

Where GDPR applies, we use the bases below. You can ask us which basis applies to a specific record.

• Contract: the account, paid access, entitlements, license keys, the cloud library, refunds, and support that you request.
• Consent: product analytics, and optional product mail beyond the messages needed to run the service.
• Legitimate interest: error monitoring, security, fraud prevention, and service improvement that does not override your rights.
• Legal obligation: invoices, tax records, and accounting retention in the Netherlands.

Retention

Contact-form records stay until we close the request, then for a short period for abuse review.

Account, entitlement, and license data stay for the life of the account, then for a short period after the account ends.

After that period we delete product uploads, except where law requires a record.

Payment and invoice records stay as long as Dutch tax law requires. That period is usually seven years.

A GDPR deletion request starts at the hub user row, then the WorkOS user. Products store a user id and must drop that row when the hub deletes the account.

Analytics events follow the product analytics retention. Error events follow the product error-tool retention.

Local browser or app data stays until you clear it.

Your rights

If GDPR or UK GDPR applies to you, you can use the rights below. We may need to confirm your identity first.

The rights are not absolute. Law can limit them, for example for tax records that we must keep.

Send a request through the contact form, or email info@ndpmv.org.

• Access a copy of your personal data.
• Rectify inaccurate data.
• Erase data where the law allows.
• Restrict processing in the cases the law sets.
• Receive data you gave us, in a portable form, where the law allows.
• Object to processing based on legitimate interest.
• Withdraw consent for analytics or optional mail. Withdrawal does not affect prior processing.
• Complain to Autoriteit Persoonsgegevens or to your local supervisory authority.

Children

NDPMV is for people who can enter a contract. Do not use the paid service if you are under 18.

We do not aim the product at children under 16. If you believe we hold data of a child under 16, contact us so we can delete it.

Your choices

You can reject analytics or change your choice at any time through the analytics control on the site that offers it.

You can clear local site data in your browser or app. Export a project backup first if you do not have a cloud copy.

You can revoke microphone, MIDI, or screen permission in the browser.

You can ask us to delete uploaded files or an account email, subject to legal retention for payments.

Complaints

Contact us first so we can try to fix the issue.

You can also complain to Autoriteit Persoonsgegevens at https://www.autoriteitpersoonsgegevens.nl.

If you live in another EEA country or in the United Kingdom, you can complain to your local authority instead.

Changes

We can change this policy. The new version applies after we publish it on this page with a new date.

If a change is material, we also give notice in the product or by email when we have an account email.

If a product starts to process a new class of data, we add a section here. We do not publish a second privacy policy for that product.