Your information should work for you—not travel farther than it needs to.

Who is responsible

NeuroCity is operated by NeuroEdge Investments CC. Business address: Erf 119, corner of Rendsburger and Nordland Street, Lafrenz, Windhoek, Namibia. Postal address: PO Box 70176, Khomasdal, Windhoek, Namibia. Questions and privacy requests can be sent to sergejwitbooi@gmail.com.

Information we collect

Depending on how you use NeuroCity, we process account and contact details; saved stores, wishlists and addresses; orders, bookings, messages and fulfilment details; payment status and customer-uploaded proof of payment; merchant application, representative, business and verification documents; and limited technical and security records.

NeuroCity does not store your raw password. Passwords are one-way hashed. Card or wallet credentials entered on a payment provider's hosted service are handled by that provider, not stored by NeuroCity.

Selma and shop demand

Selma records item terms, shopping filters, search outcomes and products returned to help participating merchants understand demand. Demand counts represent search requests and product impressions, not unique shoppers. These request records do not include a customer account ID or uploaded image. This operational recording is separate from optional conversation memory on your device. Public city demand shows aggregated requirements with at least five matching requests. When you explicitly save a WhatsApp stock alert, we link that requirement to your account and verified WhatsApp number, record your consent, and share the alert text with our WhatsApp provider for delivery. Watches expire after 30 days. Stop and remove them in your account, or reply STOP ALERTS to pause all your stock alerts. Login and order messages remain independent.

Cookies and device storage

NeuroCity uses essential cookies for signed-in sessions, Google sign-in state and security. Browser storage keeps requested features such as application drafts, guest chat and optional Selma memory on your device. Google Analytics loads only after you accept analytics in the privacy-choice banner. You can reject analytics and continue using the platform.

Why we use it and our legal bases

• Contract: to create accounts and operate carts, orders, bookings, payments and merchant services you request.
• Legitimate interests: to secure the platform, prevent fraud, improve reliability and answer support enquiries, after considering the effect on your rights.
• Legal obligations: to keep records required for accounting, tax, disputes, security incidents and lawful requests.
• Consent: for optional personalisation such as persistent Selma memory and any direct marketing. You can withdraw consent without affecting earlier lawful processing.

Who receives it

We disclose only what is needed to the relevant merchant for an order, booking or enquiry. We also use infrastructure, private file storage, email, security, artificial-intelligence and payment service providers to run NeuroCity. When you choose Selma's visual search, your selected image is sent to OpenAI to identify the item and produce catalogue search terms. NeuroCity does not save that image to your account or chat history. Avoid uploading images containing people, identity documents or other sensitive information. We do not sell personal information.

International transfers

Some providers may process information outside Namibia or the country where you live. Where GDPR applies, NeuroCity must use a recognised transfer mechanism, such as an adequacy decision or approved contractual safeguards, and assess supplementary security measures where required. You may contact us for information about the safeguards relevant to your data.

Retention

Account, cart and preference data is kept while the account is active and removed or de-identified after an approved deletion request, unless a longer period is required. Merchant verification records, orders, payment records, disputes, security logs and incident records are retained only for documented fraud-prevention, accounting, tax, contractual or legal periods. NeuroCity must maintain a written retention schedule with a named owner and review dates; where no legal or operational reason remains, information is deleted or de-identified.

Your choices and rights

Where applicable, you may ask to access, correct, export, restrict or delete your personal information; object to processing based on legitimate interests; and withdraw optional consent. You may also complain to the data-protection authority where you live, work, or believe an infringement occurred. Some records cannot be deleted immediately where they are needed for a transaction, legal obligation, fraud prevention or dispute. Signed-in customers can download an account copy from Account → Privacy. You can also use the public account deletion page to start a deletion request from the web.

Security

NeuroCity uses encrypted HTTPS transport, private object storage with short-lived document links, hashed passwords and session tokens, role-based access, restricted file types and sizes, and browser security controls. No online system can promise absolute security; please use a unique password and report suspicious activity promptly.

Personal data breaches

NeuroCity records and investigates personal-data incidents. Where GDPR applies, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach that is likely to create a risk to people. Where a breach is likely to create a high risk, we contact affected people without undue delay in clear language, describing what happened, likely consequences, measures taken and how to contact us.

Children and changes

Shopper accounts are for people aged 13 or older. Shoppers aged 13–17 must confirm they have permission from a parent or guardian. Merchant representatives must be 18 or older. Before new account details are submitted, we ask for an age group and, where required, guardian permission. We record the declared age group and confirmation timestamps, without collecting a date of birth or a guardian’s identity. These are user declarations, not identity or parental verification. Children under 13 cannot create accounts; a parent or guardian can shop using their own account. If you believe a child has supplied information contrary to this policy, contact privacy support so we can investigate and remove it where appropriate. We will update this page and its version date when the notice materially changes.