Privacy notices, data rights and audit export

This page explains how Neurico selects the applicable privacy notice, records legal acknowledgements and supports audit exports.

1. Which privacy notice applies?

Before checkout, the account owner selects where the business is legally based:

• Organizations based in Turkey review the Turkey-specific disclosure notice
• Organizations outside Turkey review the Global Privacy Notice
• Every account separately accepts the Terms of Service

The selected legal region is saved to the account so the same notice is used consistently in later sessions.

2. Where are privacy settings?

Use Data & privacy in account settings to:

• Review acknowledgement and agreement history
• Pick an account-activity date range and download CSV or JSON

Account deletion is managed separately under Account.

3. How are legal records stored?

Neurico uses an append-only record for each acknowledged notice and accepted agreement. Each record includes:

• User identity
• Legal region and policy version
• Record type
• Timestamp
• Technical context for the audit trail

When a policy changes, the account owner is asked to review the current version. Earlier records remain available in the history.

4. How does audit export work?

The audit export route is GET /api/audit/export. It can be called from the browser with a session cookie or from an API client with a bearer key.

Required query parameters

• format=csv or format=json
• from=YYYY-MM-DD
• to=YYYY-MM-DD

Optional query parameter

• event_type

Example CSV export

curl "https://neurico.ai/api/audit/export?format=csv&from=2026-05-01&to=2026-05-31" \
  -H "Authorization: Bearer nrc_xxxxx.yyyyy"

Example JSON export

curl "https://neurico.ai/api/audit/export?format=json&from=2026-05-01&to=2026-05-31&event_type=endpoint.created" \
  -H "Authorization: Bearer nrc_xxxxx.yyyyy"

5. Audit export limits

• A single request supports a date range of at most 90 days
• There is a limit of 5 exports per hour per user
• Responses use Cache-Control: no-store
• Retry-After is returned when a request is rate limited
• The export downloads as text/csv or application/json

6. Which error codes should I expect?

• 400 INVALID_FORMAT
• 400 INVALID_RANGE
• 401 UNAUTHORIZED
• 429 RATE_LIMITED
• 500 INTERNAL_ERROR

For error details and the authentication contract, see the API reference.

7. How are account deletion and data access managed?

Account settings stage an account-deletion request and disable API keys immediately. Finalization occurs after the grace period, and the account owner can cancel the request during that period.

For the binding legal text, use the notice selected for the account: the Global Privacy Notice or the Turkey Privacy Notice.