1. Who is responsible?
Neptox Management SL, a company under Spanish law, is the controller for Neptox Select. For privacy questions, contact info@neptox.com or call +34 644 28 04 37.
2. Requests through the advice form
When you send a request, we store your name, email address, optional phone number, interest, budget category, message, source page, campaign and the time of your consent. The request is first saved in a Cloudflare D1 database. Cloudflare Email Service then sends a notification from leads@neptox.com to info@neptox.com with the details you entered and a technical request ID, so we can reply to you.
To stop spam and abuse, the form uses Cloudflare Turnstile, which receives your IP address for that check. Requests are also rate limited using a hashed version of your IP address. Your IP address is not stored with your request.
3. Partner clicks
A marked partner link first passes through a Neptox redirect. We store a click ID, the partner, source page, campaign, source, medium, button placement, landing page and time. We do not store your name, email address or IP address with the click. The redirect sets a cookie named np_click with the click ID for 30 days. Your browser also keeps a short local list of your last partner clicks on this site, which stays on your device. The Provider you visit then applies its own privacy terms and cookies.
4. Purchases and Stripe
Payments are processed by Stripe, which handles payment, billing and fraud prevention data under its own terms. Neptox does not store full card details. For an order we store the order ID, product, amount, status, Stripe payment references, Stripe fee and net amount, and the email address confirmed by Stripe. That email address gets a deletion date 395 days after payment.
Paid files are kept in private Cloudflare R2 storage and are delivered through a time-limited download link. Short-lived, strictly necessary cookies keep the checkout status (one hour) and a download (15 minutes) secure.
5. Subscriptions and member sign-in
For a subscription we store a customer reference, the Stripe customer ID, the plan, the status and billing periods, and a record of the terms, renewal notice and, where given, the consent to immediate delivery and acknowledgement of losing the right of withdrawal, with the time of acceptance. You manage or cancel your subscription in the Stripe customer portal.
Members sign in with a link sent by email from leads@neptox.com through Cloudflare Email Service. To find your account we use a keyed hash of your email address instead of storing the address in plain text in the account tables. After sign-in, a secure session cookie keeps you signed in. Sign-in requests are rate limited using hashed values of your IP address and email address.
6. Purposes and legal bases
We use this data to handle and follow up your request (steps at your request and your consent), to deliver orders, subscriptions and downloads (performance of the contract), to keep accounting records (legal obligation), and to protect the site against misuse and to measure partner clicks (legitimate interest). We do not sell data as an address list.
7. Who processes data for us
Cloudflare hosts the website and provides the D1 database, R2 file storage, Email Service, Turnstile and rate limiting. Stripe processes payments and the customer portal. These providers may process data outside the European Economic Area under the safeguards for international transfers that they offer.
8. How long we keep data
The email address stored with an order gets a deletion date 395 days after payment. Request data is kept for as long as needed to handle and follow up your request. Records we must keep by law, such as accounting records, are kept for the statutory period. You can ask us to delete data earlier where the law allows.
9. Cookies and local storage
We do not use marketing or analytics cookies on this site. The cookies we set are the ones described above: np_click for partner clicks, and strictly necessary cookies for checkout, downloads and member sessions. Local storage remembers that you closed the cookie notice and keeps the local click list mentioned in section 3.
10. Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, portability or object to processing. Where processing is based on consent, you can withdraw it at any time. Send your request to info@neptox.com; we may ask you to verify your identity. You can also lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.
11. Security
Secrets stay on the server, connections use HTTPS, cookies are HttpOnly and Secure, and access to data is limited to what is needed for the purposes above.