NeoInvest is a mobile app for UK self-directed investors — coming soon.

See how it works

Privacy information

This page explains what happens to data when you visit this website. It covers only the technical processing involved in serving these pages — there is no product, no account and no form here.

This notice applies only to the limited technical processing required to deliver and protect the Neo-Invest.AI informational website. Interactive forms, marketing sign-ups and product accounts are not active. We do not profile website visitors, and no decision producing legal or similarly significant effects is made about them by automated means.

Who is responsible

Controller
NEO-INVEST.AI LTD (registered in England and Wales, company number 17358165) is the controller for the personal data processed through this website. Control transferred from the founder, who previously acted in his personal capacity, on 2026-07-23.
Registered office
128 City Road, London, United Kingdom, EC1V 2NX
Controller history
NEO-INVEST.AI LTD became the controller for this website on 23 July 2026. Before that date, limited operational information relating to the pre-incorporation website was processed by the founder for the same purposes. Relevant records were made available to the company for continuity, security and accountability and remain subject to the retention periods and rights described in this notice.

What is processed, and why

Serving a web page is never zero-processing. Below is every active source of data on our infrastructure, verified against the running production server on 2026-07-20.

Caddy operational logs (journald)

Does not record website visits

Data
Timestamp · Log level · Certificate/domain names · ACME renewal windows
Purpose
Keeping HTTPS certificates valid and diagnosing TLS failures.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Operating a functioning, correctly encrypted website.
Full IP stored
No
Where
systemd journal, EC2 instance, eu-west-2 (London)
Processor
Amazon Web Services (hosting only; no log analytics service in use)
Transfers
AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
Kept for
Capped at 14 days and 200 MB (see journald configuration).
Who can access
Server administrator via SSH only.
Deletion
Automatic journald rotation on age and size limits.
Minimisation
Contains no visitor identifiers. Retention capped from unlimited to 14 days.

Next.js application logs (journald)

Does not record website visits

Data
Timestamp · Process start/stop · Framework version · Bind address and port
Purpose
Confirming the application started and diagnosing crashes.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Keeping the website available.
Full IP stored
No
Where
systemd journal, EC2 instance, eu-west-2 (London)
Processor
Amazon Web Services (hosting only)
Transfers
AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
Kept for
Capped at 14 days and 200 MB.
Who can access
Server administrator via SSH only.
Deletion
Automatic journald rotation.
Minimisation
Application code writes no request URLs, query strings, form values or e-mail addresses to logs.

In-memory rate limiting (pseudonymised identifier)

Data
Pseudonymised online identifier: HMAC-SHA-256 of the client IP under a per-process CSPRNG secret — this REMAINS PERSONAL DATA (UK GDPR Art. 4(5)), not anonymous data · Request count · Window expiry
Purpose
Preventing automated abuse of form endpoints.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Protecting the service from automated abuse and spam.
Full IP stored
No
Where
Process memory only. Never written to disk, logs or analytics.
Processor
None.
Transfers
None — the identifier never leaves process memory.
Kept for
Actively pruned when the rate-limit window expires; also cleared on every restart, and the keying secret is regenerated then, severing linkage across deployments.
Who can access
None. Not readable by any interface; the secret is never logged.
Deletion
Pruned on window expiry; discarded with process memory on restart.
Minimisation
Keyed HMAC rather than a plain salted hash: whoever lacks the process secret cannot re-derive the mapping, and the secret exists only in memory. Classified as pseudonymised, not anonymous, because the controller could in principle re-derive it while the process lives.

SSH authentication records (journald)

Does not record website visits

Data
Source IP address · Timestamp · Username attempted · Success or failure
Purpose
Detecting unauthorised access attempts to the server.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Securing the infrastructure against intrusion.
Full IP stored
Yes
Where
systemd journal (persistent), EC2 instance, eu-west-2 (London)
Processor
Amazon Web Services (hosting only)
Transfers
AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
Kept for
journald: verified MaxRetentionSec=14day, SystemMaxUse=200M via systemd-analyze cat-config; oldest retained entry 17 Jul 2026 (instance creation, inside the cap).
Who can access
Server administrator via SSH only.
Deletion
journald time/size rotation.
Minimisation
Concerns administrative access to the server, not website visitors. Browsing this website creates no entry here.

Login accounting (/var/log/btmp, /var/log/wtmp)

Does not record website visits

Data
Source IP of failed logins (btmp) · Successful login sessions (wtmp) · Timestamps · Usernames
Purpose
OS login accounting; investigating unauthorised access attempts.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Securing the infrastructure against intrusion.
Full IP stored
Yes
Where
EC2 instance, eu-west-2 (London)
Processor
Amazon Web Services (hosting only)
Transfers
AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
Kept for
NOT the journald 14-day cap: monthly logrotate with one archive, bounding records to roughly two months — except wtmp, which only rotates above 1 MB and may retain administrator-login records longer while small.
Who can access
Server administrator via SSH only (btmp is mode 660; wtmp world-readable per OS default).
Deletion
logrotate monthly cycle.
Minimisation
Records SSH/administrative logins only; website visits create no entry. Retention documented per-file rather than assumed uniform.

auditd system audit log

Does not record website visits

Data
System call events · Authentication events · Source IP for remote logins
Purpose
OS-level security auditing.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Detecting compromise of the server.
Full IP stored
Yes
Where
EC2 instance, eu-west-2 (London)
Processor
Amazon Web Services (hosting only)
Transfers
None.
Kept for
NOT the journald 14-day cap: size-based rotation (8 MB × 5 files, ~40 MB bound). At current volume records persist beyond 14 days until the size limit cycles them out.
Who can access
Server administrator via SSH only (log mode 600, root).
Deletion
auditd ROTATE on size; oldest file overwritten at num_logs.
Minimisation
Records administrative and system activity, not website visits. No web request produces an entry.

Deployment and smoke-test logs

Does not record website visits

Data
Framework startup output · Local bind address (127.0.0.1)
Purpose
Verifying a release boots before it receives traffic.
Lawful basis
Legitimate interests (Article 6(1)(f) UK GDPR) — Releasing changes without breaking the live site.
Full IP stored
No
Where
EC2 instance /tmp, eu-west-2 (London)
Processor
Amazon Web Services (hosting only)
Transfers
AWS processor, eu-west-2 (London); safeguarded by the AWS UK GDPR Addendum. See the completed transfer assessment.
Kept for
Cleared on instance restart; pruned with old releases.
Who can access
Server administrator via SSH only.
Deletion
Automatic /tmp clearing and release pruning.
Minimisation
Contains no visitor data.

What we deliberately do not do

  • Caddy access logs — not enabled. No `log` directive in /etc/caddy/Caddyfile; /var/log/caddy does not exist; zero request-level lines in the journal over a two-hour window.
  • AWS CloudWatch — not enabled. amazon-cloudwatch-agent is not installed and not running on the instance.
  • fail2ban / intrusion prevention — not enabled. Package not installed; service not active.
  • Load balancer / WAF logs — not enabled. No load balancer or WAF is in the request path. Caddy on the instance terminates TLS and serves traffic directly.

There are no analytics, advertising, heatmap, session-replay or social tracking technologies on this site, and no cookies of any kind are set. There is no cookie banner because there is nothing optional to consent to.

What we cannot verify from here

Some logging is configured outside the server we control. We list these rather than imply they are switched off, because we have not been able to confirm either way.

  • VPC Flow LogsAccount/VPC-level. The instance has NO IAM role attached (verified via IMDS) and no local credentials, so this cannot be checked from the host — absence of a local agent proves nothing about an account-level service. If enabled: Would record source and destination IP addresses, ports and packet counts for network flows, including website visitors.
  • Route 53 / DNS query logsConfigured at the DNS provider for neo-invest.ai, outside this host. If enabled: Would record resolver IP addresses and queried hostnames.
  • CloudTrailAccount-level; requires console access. Records API/management activity, not website visits. If enabled: Would record AWS API calls by the account, including administrator identity and source IPs.
  • CloudWatch log groupsThe instance agent is verifiably absent, but account-level log groups fed by other services cannot be ruled out from the host. If enabled: Depends entirely on what feeds them.
  • GuardDuty / WAFAccount-level security services; require console access to confirm. If enabled: GuardDuty analyses flow/DNS telemetry including visitor IPs; WAF would log inspected requests.
  • EBS snapshots / AMIs / backup policies / cross-region replicationAccount-level; require console access. If enabled: A snapshot copies the disk, including every log above, and inherits none of their retention rules; cross-region copies would move that data out of eu-west-2.
  • EC2 serial-console and platform logs; AWS support accessAWS-internal; not visible to customers. If enabled: Governed by the AWS customer agreement, DPA and UK GDPR addendum.

Where data is hosted, and transfers

Website hosting (EC2) is in AWS Europe (London), eu-west-2; email infrastructure (WorkMail/SES) is in AWS Europe (Ireland), eu-west-1. AWS acts as processor under the AWS Data Processing Addendum and UK GDPR Addendum incorporated through the AWS Service Terms. Processing or operational access outside the UK may occur through AWS and relevant subprocessors; applicable contractual safeguards are the AWS UK GDPR Addendum and its incorporated transfer mechanisms. Relevant subprocessors depend on the selected regions and AWS services. This assessment is reviewed annually and after any service, region or subprocessor change.

We do not claim that no international transfer occurs, nor that processing is UK-only: choosing a UK region pins stored content, not operational access or account-level copies. This assessment was completed on 2026-07-21. Reviewed annually and after any service, region or subprocessor change.

Legitimate-interests reliance (Article 6(1)(f) UK GDPR) is recorded per processing activity in the tables above. Consolidated legitimate-interests assessments — website security and abuse prevention, business correspondence, and the pre-incorporation controller transition — were completed on 24 July 2026 and are held internally.

Privacy-rights contact

Use
Receiving and answering privacy and data-rights enquiries, and permitted general operational contact.
Lawful basis
Legal obligation (responding to data-subject rights requests, UK GDPR Arts. 12–23); legitimate interests for enquiries that are not formal rights requests.
Retention
Enquiry threads retained for 12 months after resolution, then deleted; identity-verification artefacts deleted on verification.
Boundaries
Senders are never added to marketing lists · Message content is never exposed to analytics · Message content and sender addresses are never written to application logs · Not a newsletter, beta or marketing sign-up route

Your rights

Under UK data protection law you have the right to ask what personal data is held about you, to have it corrected or erased, to restrict or object to its processing, and to data portability. In practice, the records described above are keyed to IP addresses and short retention windows, so we may not be able to identify which entries relate to you without additional information from you.

You can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk/make-a-complaint. You may do this at any time, and you do not need to contact us first.

Your right to object

Where we rely on legitimate interests (Article 6(1)(f) UK GDPR), you have the right to object at any time, on grounds relating to your particular situation, by writing to the contact address in this notice. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Data protection complaints

You may make a data protection complaint by emailing hello@neo-invest.ai and using ‘Data protection complaint’ in the subject line.

We will acknowledge receipt of your complaint within 30 days. We will investigate it without undue delay, keep you informed where appropriate, and tell you the outcome without undue delay.

You may also complain to the Information Commissioner's Office. We encourage you to contact us first so that we have an opportunity to address your concerns.

Version:
1.2-effective
Effective date:
24 July 2026
Inventory verified:
2026-07-20
Status:
Incorporated controller (NEO-INVEST.AI LTD, 17358165)

Back to NeoInvest