Privacy Policy

This policy applies to the Nova website at joinnova.ai and the Nova web application. Nova is operated by Shubham Maurya, a sole proprietor trading as Nova, of Surat, Gujarat, India. For questions or to exercise your rights, contact hello@joinnova.ai.

1. Two different roles

This distinction determines who you should contact about a request:

• For our customers' own data — your account, your workspace, your billing — we are the controller. We decide how that data is used, and this policy governs it.
• For the data of leads and prospects that a customer discovers, imports or contacts through Nova, we are a processor acting on that customer's instructions. The customer is the controller. If you are a lead and want your data removed, contact the business that reached out to you; you may also write to us at hello@joinnova.ai and we will pass the request on and act on it.

2. What we collect

Account and workspace data

Your name, email address, password hash (we never store passwords in plain text), workspace name and members, role, onboarding answers, and your ideal-customer profile, messaging framework and campaign settings.

Connected LinkedIn account data

When you connect a LinkedIn account through our integration partner, we process your LinkedIn profile details, your connections and invitations, and the conversations conducted through Nova — including messages you receive. We also store a record of every action taken on your behalf (invitation, message, profile view, like) so the safety limits can be enforced. We do not store your LinkedIn password; the connection is held as a session credential by our integration partner.

Lead and prospect data

Professional information about the people you target: name, headline, role, employer, location, public profile URL and public activity, plus any notes, tags, scores and research summaries generated in Nova. This is business-context personal data about third parties, processed on your instructions.

Calendar data

If you connect Google Calendar or Microsoft 365, we process events, times and attendee details so Nova can show meetings and schedule content. We request the narrowest scopes that make the feature work, and you can disconnect at any time.

Content and files

Posts, drafts, ideas, voice profiles, uploaded media, and any recordings you make with the voice features.

Payment data

Card processing is handled by Razorpay, our payment gateway. We do not receive or store your card number. We receive a customer and subscription identifier, plan, status, billing country and invoice history.

Technical and usage data

IP address, browser and device type, pages and features used, timestamps, and application logs, performance traces and error reports. We use this to keep the Service running, secure and debuggable.

Cookies

The web application sets strictly necessary cookies for authentication and session security — without them you cannot stay signed in. The marketing website runs no advertising or cross-site tracking cookies. If we later add analytics that are not strictly necessary, we will ask for consent first where the law requires it.

3. Why we use it, and our legal basis

We do not sell personal data, and we do not share it with advertisers or data brokers.

4. AI processing

Nova sends content to Google's Gemini API to draft messages and posts, summarise research and score lead fit. That content can include lead profile data and message context. We use the paid enterprise API tier, under which the provider processes data on our behalf as a processor. We do not use your Customer Data, or the content you send through Nova, to train our own models or third-party foundation models.

5. Who we share data with

We share personal data with the service providers below, only as needed to run the Service, and under contracts that require them to protect it:

We may also disclose data where required by law or valid legal process, to establish or defend legal claims, to protect the rights and safety of people or the Service, or to a successor in a merger, acquisition or asset sale (in which case we will notify you).

6. International transfers

We and our providers operate internationally, so personal data may be transferred outside your country, including to the United States and the European Economic Area. Where we transfer data out of the EEA or UK, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), together with appropriate technical safeguards.

7. How long we keep it

• Account and workspace data — for as long as your account is active, then deleted or anonymised within 90 days of closure.
• Leads, messages and campaign data — until you delete them or your workspace is closed. Deleting a lead removes its research and enrichment payloads.
• Action and safety logs — kept for up to 24 months, because the safety governor needs history to decide whether the next action is allowed.
• Billing records — retained as long as tax and accounting law requires, typically 7 years.
• Technical logs and traces — typically 30 to 90 days.

8. Security

Data is encrypted in transit with TLS and at rest by our hosting and storage providers. Access to production systems is limited to those who need it and protected by strong authentication. Passwords are hashed, third-party credentials are held as scoped tokens, and workspace data is isolated so members of one workspace cannot read another's. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant regulator as the law requires.

9. Your rights

Depending on where you live — including under the GDPR/UK GDPR, India's Digital Personal Data Protection Act, and US state privacy laws such as the CCPA — you may have the right to:

• access a copy of your personal data;
• correct data that is inaccurate or incomplete;
• delete your data, subject to our legal retention obligations;
• receive your data in a portable format;
• object to or restrict processing based on legitimate interests;
• withdraw consent at any time, without affecting past processing;
• opt out of marketing email using the unsubscribe link or by writing to us; and
• nominate another person to exercise these rights on your behalf, where available.

To exercise any of these, email hello@joinnova.ai. We will respond within 30 days and may need to verify your identity first. We will not discriminate against you for making a request. If you are unhappy with our response, you can complain to your local data protection authority.

We do not use automated decision-making that produces legal or similarly significant effects. Lead scoring and ICP fit are decision support: a human approves before anyone is contacted.

10. Children

The Service is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the Service evolves. The date at the top always reflects the current version, and we will notify you by email or in the app before a material change takes effect.

12. Grievance Officer

In accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023, the contact for privacy grievances and for exercising your rights over your personal data is:

• Name: Shubham Maurya
• Designation: Proprietor and Grievance Officer, Nova
• Email: hello@joinnova.ai
• Phone: +91 7621069675
• Address: Surat, Gujarat, India

We acknowledge every grievance within 2 business days and resolve it within 30 days of receipt. There is no charge for making a complaint or a data request. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India or to the data protection authority where you live.

13. Contact

Shubham Maurya (trading as Nova), Surat, Gujarat, India — hello@joinnova.ai · +91 7621069675.