Neverinstall

GDPR overview

GDPR is claimed in one place only: the security page of the product documentation states that Neverinstall adheres to obligations under laws such as GDPR regarding the processing and sharing of customer data. The privacy policy published on the website itself takes a different footing entirely, drafted under India's Information Technology Act 2000 and the 2011 sensitive-data rules, with Indian law and the courts of Bengaluru governing disputes. It does list data-subject rights close to European ones, including access, rectification, erasure, portability and objection, exercised by writing to the generic support address, and commits to deletion within thirty days. There is no Data Processing Agreement, no Article 27 EU representative, no named data protection officer and no formal subprocessor page, though four third-party services are identified in the policy.

Who owns the data?

The terms place responsibility for content on the customer: you may only submit information you own or have the right to use. Neverinstall states in its security documentation that it has no access to data entered inside the applications running in a workspace, and describes itself as a data processor and, in some cases, a data controller. The privacy policy limits personal data collection to name and email at sign-up, plus address and phone number at payment. Information may be shared with service providers, disclosed when legally compelled, and transferred in a merger or acquisition. With CloudLink, workspaces and data remain inside the customer's own cloud account.

Reuse rights

Users keep what they create inside their workspace, but the licence granted over Neverinstall's own platform content is narrow: it may be viewed, downloaded and printed for personal, non-commercial purposes only, with no right to sublicense, redistribute, resell or reverse engineer. Reselling subscriptions is explicitly forbidden and grounds for permanent termination. One clause deserves attention in the opposite direction: any testimonial or feedback given to Neverinstall is covered by a perpetual, irrevocable licence allowing the company to publish it for marketing purposes without compensation.

Data retention & training

Hosting summary

Neverinstall's documentation lists nine server locations across seven countries: the United States (New York, Dallas and North Virginia), India (Bengaluru, Mumbai, Delhi and Pune), Japan, the United Kingdom, Germany, Finland and Canada. That page is itself marked as last updated two years ago. The privacy policy names Microsoft Azure among the third-party services used, and states that information is kept in locations outside the direct control of the company, on hosting providers' infrastructure, with transfers outside the user's own country possible on the basis of consent. The security documentation adds that encrypted backups are replicated to a separate data centre region and spread across availability zones. With CloudLink the picture changes: data, networking and administrative controls remain inside the customer's own cloud tenant, which is the option to consider where data residency matters. The governing law throughout is Indian, with exclusive jurisdiction in Bengaluru.