Last updated: October 17, 2026
1. Who are we?
HydraLabs provides the services described in this policy and acts as the data controller for its own data processing activities.
You can contact us at support@hydralabs.ai for privacy, account, and personal data requests, and at contact@hydralabs.ai for general inquiries.
2. Local content and cloud processing in Neurion
Your conversation history, coding work, tool outputs, reports, and files you create in the Neurion desktop application are stored on your device. Signing in to another computer with the same account does not automatically transfer this local history to that computer.
When you use AI and connected online features, the content needed to carry out the operation is processed in the cloud. This content may include your message, the relevant conversation context, the necessary parts of documents or images you select, and tool results related to the task.
Account, subscription, usage, and security information is also processed on the server side. Local conversation history therefore does not mean that the service operates entirely offline or that no data leaves your device.
3. Types of information we process
Account and profile information
When you create an account or manage your profile, we process your email address, user identifier, profile information you provide, verification status, and workspaces associated with your account.
When you sign in through a service such as Google, we receive the account information shared as part of that provider's sign-in flow. Using social sign-in does not mean that you grant access to all your files or messages on that service.
Subscription and payment information
We process your selected plan, subscription status, billing period, transaction identifiers, payment results, discount eligibility, and cancellation, refund, and plan change records.
You enter your card details on the payment service's own screen. HydraLabs uses transaction results and the related subscription records to manage your subscription.
Usage and transaction information
We process the features used, request and task identifiers, usage amounts, processing times, success and error states, reserved allowance, and actual usage records.
These records help calculate your allowance correctly, distinguish duplicate transactions, and determine the status of interrupted operations.
Task content
Messages and instructions you submit, documents and images you attach, project context used for a task, and tool results may be processed.
The presence of a file on your computer does not mean that the entire file is sent automatically. The content processed depends on the features you use, the permissions you grant, and the task being performed.
Device and security information
Your IP address, browser or application version, operating system, device and session identifiers, connection times, authentication events, and technical error information may be processed.
Support communications
We process messages you send us, your contact information, and files you choose to attach to your support request. When sending screenshots or diagnostic logs, we recommend removing personal information that is not needed for support.
4. How do we collect information?
We obtain information from the following sources:
- Directly from you when you create an account, send a message, attach a file, or submit a support request.
- Technical transaction and security records generated during your use of the service.
- The sign-in provider you select.
- Transaction notifications from the payment and subscription service.
- Task-related results from tools you enable and integrations you connect.
If you do not provide requested information, the relevant feature may not work. For example, account services may not be available without account verification, and subscription transactions may not be completed without the necessary payment information.
5. Purposes and legal bases for processing
We process your information for the following purposes:
- Purpose: Creating accounts, signing in, and providing service features; Applicable legal basis: Entering into or performing a contract.
- Purpose: Managing subscriptions, payments, billing, and related records; Applicable legal basis: Performance of a contract and legal obligations.
- Purpose: Security, preventing abuse, and investigating technical issues; Applicable legal basis: Our legitimate interests, balanced against your rights and freedoms; legal obligations where necessary.
- Purpose: Responding to support and data rights requests; Applicable legal basis: Performance of a contract or legal obligations, depending on the nature of the request.
- Purpose: Assessing legal claims and protecting rights; Applicable legal basis: Establishing, exercising, or defending a legal right.
- Purpose: Optional processing that requires consent; Applicable legal basis: Consent given for the relevant processing.
These bases apply subject to the requirements of the laws applicable to you. Reading this policy or using the service does not mean that you give unrestricted consent to all data processing activities.
You may withdraw your consent where processing is based on consent. This does not affect the lawfulness of processing carried out before withdrawal.
6. Tools and connected services
When you use file, terminal, browser, or security tools in Neurion, the relevant tool may process the data required by the task. Depending on the permissions you grant, file contents, command results, or information displayed on a web page may be included in the task context.
When you connect an MCP server or another plugin, that service may process information sent to it on its own infrastructure. The independent data practices of these services are governed by their own privacy notices.
Removing a connection does not automatically delete information previously transferred to that service from the service's systems.
7. Sharing information
Information necessary for account, payment, and infrastructure services and for the online operations you request is shared with the relevant service providers.
- Service: Clerk; Purpose of use: Registration, sign-in, authentication, and account session management.
- Service: Cloudflare; Purpose of use: Web and API infrastructure, data storage, content delivery, and network security.
- Service: Creem; Purpose of use: Payments, subscriptions, billing, refunds, and related financial transactions.
When you use search or connected tool features, information necessary for the relevant query or operation may be sent to that service.
Service providers' data protection roles vary according to the service they provide. Some process information on our behalf, while others may also act as data controllers for their own legal obligations.
Where necessary to meet legal obligations or protect legal rights, relevant information may also be shared with competent authorities and necessary professional advisers.
8. International data processing
The infrastructure and connected services we use may operate in different countries. Your information may therefore be processed outside the country where you are located.
You can contact support@hydralabs.ai to request information about the services and countries to which data is transferred and the transfer safeguards under applicable data protection regulations.
A service provider being located in another country does not, by itself, expand the purposes of use described in this policy.
9. Cookies and browser storage
Cookies are small records stored by your browser. Local storage and session storage are other technologies that allow a website to retain certain information in your browser.
Our website uses these technologies for session management, security, continuity of transactions, and the operation of interactive features you use.
Session and security cookies
- Technology: Clerk session cookies — records such as __session and __client_uat; Purpose: Verifying sign-in status and managing session validity.; Retention approach: Depends on the relevant cookie's validity period and session settings; it may be renewed during use.
- Technology: Cloudflare verification cookie — cf_clearance; Purpose: Remembering that a security check has been passed and reducing unnecessary repetition of the same check.; Retention approach: Depends on the validity period of the security verification; it may be renewed following a new verification.
- Technology: Cloudflare bot protection cookie — __cf_bm; Purpose: Helping distinguish automated and harmful traffic on connections where bot protection is used.; Retention approach: Expires after 30 continuous minutes of user inactivity.
The creation of security cookies depends on the security checks applied during a visit; the same cookies may not be present for every visitor.
Transaction continuity records
In payment or plan change flows, browser local storage may retain information such as the transaction identifier, selected plan, and the transaction's known status. These records support checking an existing transaction when the page is reopened and help prevent a transaction with an uncertain outcome from being started again by mistake.
Persistent local storage records are not deleted simply by closing a tab. They may remain until you clear the browser's site data or the application changes the relevant record.
Game and interactive demonstration records
When you use games, your language preference, game settings, progress, and save slots may be stored in your browser. These records allow a game to continue where you left off or remember your preferences.
The high score for the game on the 404 page is held in storage tied to the tab session. Other games' persistent records may remain until the relevant record is deleted or overwritten, or browser data is cleared.
Storage on a separate game address is separate from the main website's account storage.
Advertising and preference management
No advertising targeting pixel or integration for building cross-site advertising profiles has been added to the current website. Usage indicators on the account screen are not the same as advertising tracking.
You can view, delete, or restrict cookies and site data through your browser settings. Blocking necessary session and security records may affect sign-in or the operation of certain features. Clearing site data may also remove your local game saves and transaction continuity information.
When you move to another service's screen, such as signing in with Google or paying through Creem, that service's own cookie and privacy practices also apply.
10. How do we determine retention periods?
Data retention is assessed with regard to the operation of the relevant feature, verification of transactions, security, and legal obligations.
- Data type: Local conversations, reports, and files; Criteria determining retention: Application and file management on your device. Account deletion does not remotely remove these copies.
- Data type: Account and workspace information; Criteria determining retention: Operating the account, closing access, and cleanup processes within the account lifecycle.
- Data type: Temporary image and search content; Criteria determining retention: Continuation of the relevant task, session, or processing authorization. When these conditions end, the content is included in background cleanup processes.
- Data type: Payment and usage records; Criteria determining retention: Transaction accuracy, payment disputes, financial obligations, and protection of legal rights.
- Data type: Security and error records; Criteria determining retention: The need to investigate incidents, prevent abuse, and resolve technical issues.
- Data type: Support correspondence; Criteria determining retention: Resolving the request, follow-up actions, and relevant disputes or legal obligations.
- Data type: Backups; Criteria determining retention: The lifecycle of the relevant backup system and applicable retention requirements.
Content becoming eligible for deletion and completion of its physical cleanup may not occur at the same time. Background processes and backups may complete at different times.
After temporary content is removed, records separate from that content, such as transaction identifiers, usage amounts, or payment evidence, may continue to be retained.
11. Accessing your data and deleting your account
The export feature in your account allows you to download the supported server records for your selected workspace. This file is not a backup of all conversations or files on your device.
The temporary download link created during export is removed when the operation is canceled, the relevant context changes, or the screen is closed. The copy of the downloaded file on your device is under your control.
Account deletion closes access to your account and starts the related cleanup processes. Some records that must be retained for payments, transaction integrity, security, or legal obligations may remain.
Deleting your account does not remotely delete your local files or independent accounts with third-party services. Uninstalling the application and canceling a subscription are also different from deleting an account.
12. Your personal data rights
Subject to the requirements of the laws applicable to you:
- You may find out whether your data is being processed and request access to it.
- You may request correction of inaccurate or incomplete information.
- Where the relevant conditions are met, you may request deletion of data or restriction of processing, or object to processing.
- You may request appropriate data in a structured, machine-readable format.
- You may withdraw your consent to processing that is based on consent.
- You may exercise your rights concerning outcomes arising from wholly automated processing where the law provides protection.
- You may contact the competent data protection authority.
You can send your requests to support@hydralabs.ai. We may carry out necessary and proportionate identity verification to prevent information about your account from being disclosed to another person.
We assess your requests within the applicable legal time limits. If a request cannot be fulfilled in whole or in part, we explain the relevant reason.
13. Security
We apply measures such as authentication, access restrictions, separation of users and workspaces, secure connections, and transaction verification to protect data.
The security of your account and device is also important. We recommend that you do not share your sign-in details, keep your device up to date, and review the permissions you grant to third-party tools.
No system can provide absolute security. If a personal data breach occurs, the necessary investigation and notification processes are carried out according to the nature of the incident and applicable laws.
14. Children's privacy
Neurion is not designed as a service specifically for children. Use of the service is subject to applicable age and contractual capacity rules.
If you believe that a child's data has been processed inappropriately, you can notify support@hydralabs.ai. The report is assessed in light of the relevant data and applicable rules.
15. Policy changes and contact
We may update this policy as product features, service providers, or data practices change. The current text is published on this page together with its last updated date.
For significant changes, additional information is provided as appropriate to the nature of the change and applicable laws. A change that requires consent is not implemented on the assumption that updating the text alone means you have given your consent.
Privacy, account, and support: support@hydralabs.ai
General inquiries: contact@hydralabs.ai