Privacy information
This page explains what happens to data when you visit this website. It covers only the technical processing involved in serving these pages — there is no product, no account and no form here.
This notice applies only to the limited technical processing required to deliver and protect the Neo-Invest.AI informational website. Interactive forms, marketing sign-ups and product accounts are not active. We do not profile website visitors, and no decision producing legal or similarly significant effects is made about them by automated means.
Who is responsible
- Controller
- NEO-INVEST.AI LTD (registered in England and Wales, company number 17358165) is the controller for the personal data processed through this website. Control transferred from the founder, who previously acted in his personal capacity, on 2026-07-23.
- Registered office
- 128 City Road, London, United Kingdom, EC1V 2NX
- Contact
- hello@neo-invest.ai
- Controller history
- NEO-INVEST.AI LTD became the controller for this website on 23 July 2026. Before that date, limited operational information relating to the pre-incorporation website was processed by the founder for the same purposes. Relevant records were made available to the company for continuity, security and accountability and remain subject to the retention periods and rights described in this notice.
What is processed, and why
Serving a web page is never zero-processing. Below is every active source of data on our infrastructure, verified against the running production server on 2026-07-20.
Caddy operational logs (journald)
Does not record website visits
- Data
- Timestamp · Log level · Certificate/domain names · ACME renewal windows
- Purpose
- Keeping HTTPS certificates valid and diagnosing TLS failures.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Operating a functioning, correctly encrypted website.
- Full IP stored
- No
- Where
- systemd journal, EC2 instance, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only; no log analytics service in use)
- Transfers
- AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
- Kept for
- Capped at 14 days and 200 MB (see journald configuration).
- Who can access
- Server administrator via SSH only.
- Deletion
- Automatic journald rotation on age and size limits.
- Minimisation
- Contains no visitor identifiers. Retention capped from unlimited to 14 days.
Next.js application logs (journald)
Does not record website visits
- Data
- Timestamp · Process start/stop · Framework version · Bind address and port
- Purpose
- Confirming the application started and diagnosing crashes.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Keeping the website available.
- Full IP stored
- No
- Where
- systemd journal, EC2 instance, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only)
- Transfers
- AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
- Kept for
- Capped at 14 days and 200 MB.
- Who can access
- Server administrator via SSH only.
- Deletion
- Automatic journald rotation.
- Minimisation
- Application code writes no request URLs, query strings, form values or e-mail addresses to logs.
In-memory rate limiting (pseudonymised identifier)
- Data
- Pseudonymised online identifier: HMAC-SHA-256 of the client IP under a per-process CSPRNG secret — this REMAINS PERSONAL DATA (UK GDPR Art. 4(5)), not anonymous data · Request count · Window expiry
- Purpose
- Preventing automated abuse of form endpoints.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Protecting the service from automated abuse and spam.
- Full IP stored
- No
- Where
- Process memory only. Never written to disk, logs or analytics.
- Processor
- None.
- Transfers
- None — the identifier never leaves process memory.
- Kept for
- Actively pruned when the rate-limit window expires; also cleared on every restart, and the keying secret is regenerated then, severing linkage across deployments.
- Who can access
- None. Not readable by any interface; the secret is never logged.
- Deletion
- Pruned on window expiry; discarded with process memory on restart.
- Minimisation
- Keyed HMAC rather than a plain salted hash: whoever lacks the process secret cannot re-derive the mapping, and the secret exists only in memory. Classified as pseudonymised, not anonymous, because the controller could in principle re-derive it while the process lives.
SSH authentication records (journald)
Does not record website visits
- Data
- Source IP address · Timestamp · Username attempted · Success or failure
- Purpose
- Detecting unauthorised access attempts to the server.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Securing the infrastructure against intrusion.
- Full IP stored
- Yes
- Where
- systemd journal (persistent), EC2 instance, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only)
- Transfers
- AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
- Kept for
- journald: verified MaxRetentionSec=14day, SystemMaxUse=200M via systemd-analyze cat-config; oldest retained entry 17 Jul 2026 (instance creation, inside the cap).
- Who can access
- Server administrator via SSH only.
- Deletion
- journald time/size rotation.
- Minimisation
- Concerns administrative access to the server, not website visitors. Browsing this website creates no entry here.
Login accounting (/var/log/btmp, /var/log/wtmp)
Does not record website visits
- Data
- Source IP of failed logins (btmp) · Successful login sessions (wtmp) · Timestamps · Usernames
- Purpose
- OS login accounting; investigating unauthorised access attempts.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Securing the infrastructure against intrusion.
- Full IP stored
- Yes
- Where
- EC2 instance, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only)
- Transfers
- AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
- Kept for
- NOT the journald 14-day cap: monthly logrotate with one archive, bounding records to roughly two months — except wtmp, which only rotates above 1 MB and may retain administrator-login records longer while small.
- Who can access
- Server administrator via SSH only (btmp is mode 660; wtmp world-readable per OS default).
- Deletion
- logrotate monthly cycle.
- Minimisation
- Records SSH/administrative logins only; website visits create no entry. Retention documented per-file rather than assumed uniform.
auditd system audit log
Does not record website visits
- Data
- System call events · Authentication events · Source IP for remote logins
- Purpose
- OS-level security auditing.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Detecting compromise of the server.
- Full IP stored
- Yes
- Where
- EC2 instance, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only)
- Transfers
- None.
- Kept for
- NOT the journald 14-day cap: size-based rotation (8 MB × 5 files, ~40 MB bound). At current volume records persist beyond 14 days until the size limit cycles them out.
- Who can access
- Server administrator via SSH only (log mode 600, root).
- Deletion
- auditd ROTATE on size; oldest file overwritten at num_logs.
- Minimisation
- Records administrative and system activity, not website visits. No web request produces an entry.
Deployment and smoke-test logs
Does not record website visits
- Data
- Framework startup output · Local bind address (127.0.0.1)
- Purpose
- Verifying a release boots before it receives traffic.
- Lawful basis
- Legitimate interests (Article 6(1)(f) UK GDPR) — Releasing changes without breaking the live site.
- Full IP stored
- No
- Where
- EC2 instance /tmp, eu-west-2 (London)
- Processor
- Amazon Web Services (hosting only)
- Transfers
- AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
- Kept for
- Cleared on instance restart; pruned with old releases.
- Who can access
- Server administrator via SSH only.
- Deletion
- Automatic /tmp clearing and release pruning.
- Minimisation
- Contains no visitor data.
What we deliberately do not do
- Caddy access logs — not enabled. No `log` directive in /etc/caddy/Caddyfile; /var/log/caddy does not exist; zero request-level lines in the journal over a two-hour window.
- AWS CloudWatch — not enabled. amazon-cloudwatch-agent is not installed and not running on the instance.
- fail2ban / intrusion prevention — not enabled. Package not installed; service not active.
- Load balancer / WAF logs — not enabled. No load balancer or WAF is in the request path. Caddy on the instance terminates TLS and serves traffic directly.
There are no analytics, advertising, heatmap, session-replay or social tracking technologies on this site, and no cookies of any kind are set. There is no cookie banner because there is nothing optional to consent to.
What we cannot verify from here
Some logging is configured outside the server we control. We list these rather than imply they are switched off, because we have not been able to confirm either way.
- VPC Flow Logs — Account/VPC-level. The instance has NO IAM role attached (verified via IMDS) and no local credentials, so this cannot be checked from the host — absence of a local agent proves nothing about an account-level service. If enabled: Would record source and destination IP addresses, ports and packet counts for network flows, including website visitors.
- Route 53 / DNS query logs — Configured at the DNS provider for neo-invest.ai, outside this host. If enabled: Would record resolver IP addresses and queried hostnames.
- CloudTrail — Account-level; requires console access. Records API/management activity, not website visits. If enabled: Would record AWS API calls by the account, including administrator identity and source IPs.
- CloudWatch log groups — The instance agent is verifiably absent, but account-level log groups fed by other services cannot be ruled out from the host. If enabled: Depends entirely on what feeds them.
- GuardDuty / WAF — Account-level security services; require console access to confirm. If enabled: GuardDuty analyses flow/DNS telemetry including visitor IPs; WAF would log inspected requests.
- EBS snapshots / AMIs / backup policies / cross-region replication — Account-level; require console access. If enabled: A snapshot copies the disk, including every log above, and inherits none of their retention rules; cross-region copies would move that data out of eu-west-2.
- EC2 serial-console and platform logs; AWS support access — AWS-internal; not visible to customers. If enabled: Governed by the AWS customer agreement, DPA and UK GDPR addendum.
Where data is hosted, and transfers
Website hosting (EC2) is in AWS Europe (London), eu-west-2; email infrastructure (WorkMail/SES) is in AWS Europe (Ireland), eu-west-1. AWS acts as processor under the AWS Data Processing Addendum and UK GDPR Addendum incorporated through the AWS Service Terms. Processing or operational access outside the UK may occur through AWS and relevant subprocessors; applicable contractual safeguards are the AWS UK GDPR Addendum and its incorporated transfer mechanisms. Relevant subprocessors depend on the selected regions and AWS services. This assessment is reviewed annually and after any service, region or subprocessor change.
We do not claim that no international transfer occurs, nor that processing is UK-only: choosing a UK region pins stored content, not operational access or account-level copies. This assessment was completed on 2026-07-21. Reviewed annually and after any service, region or subprocessor change.
Legitimate-interests reliance (Article 6(1)(f) UK GDPR) is recorded per processing activity in the tables above. Consolidated legitimate-interests assessments — website security and abuse prevention, business correspondence, and the pre-incorporation controller transition — were completed on 24 July 2026 and are held internally.
Privacy-rights contact
- Address
- hello@neo-invest.ai
- Use
- Receiving and answering privacy and data-rights enquiries, and permitted general operational contact.
- Lawful basis
- Legal obligation (responding to data-subject rights requests, UK GDPR Arts. 12–23); legitimate interests for enquiries that are not formal rights requests.
- Retention
- Enquiry threads retained for 12 months after resolution, then deleted; identity-verification artefacts deleted on verification.
- Boundaries
- Senders are never added to marketing lists · Message content is never exposed to analytics · Message content and sender addresses are never written to application logs · Not a newsletter, beta or marketing sign-up route
Your rights
Under UK data protection law you have the right to ask what personal data is held about you, to have it corrected or erased, to restrict or object to its processing, and to data portability. In practice, the records described above are keyed to IP addresses and short retention windows, so we may not be able to identify which entries relate to you without additional information from you.
You can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk/make-a-complaint. You may do this at any time, and you do not need to contact us first.
Your right to object
Where we rely on legitimate interests (Article 6(1)(f) UK GDPR), you have the right to object at any time, on grounds relating to your particular situation, by writing to the contact address in this notice. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
Data protection complaints
You may make a data protection complaint by emailing hello@neo-invest.ai and using ‘Data protection complaint’ in the subject line.
We will acknowledge receipt of your complaint within 30 days. We will investigate it without undue delay, keep you informed where appropriate, and tell you the outcome without undue delay.
You may also complain to the Information Commissioner's Office. We encourage you to contact us first so that we have an opportunity to address your concerns.
- Version:
- 1.2-effective
- Effective date:
- 24 July 2026
- Inventory verified:
- 2026-07-20
- Status:
- Incorporated controller (NEO-INVEST.AI LTD, 17358165)