Your data.
Your call.

Nova is operated by Liam Whitlie, Paarl, 7646, South Africa. No VAT registration — operating as a sole proprietor. Liam Whitlie is the data controller for the personal information Nova processes about you. For privacy matters, contact our Information Officer (POPIA) / Data Protection contact (GDPR) at privacy@heynova.tech.

Account details (email, optional first name) — to create your account and sign you in. Memory and cards (notes, tasks, opportunities, agent drafts) — the personal context you give Nova so it can prepare suggestions for you. Connected sources — only what you explicitly link: email content and metadata (subject, sender, body text) fetched via Unipile when you connect an email account, OAuth tokens stored via Nango when you connect third-party apps (Google, Slack, Notion, etc.), and WhatsApp messages you forward to Nova's inbound number. Nova reads only what your integration permission allows and never posts on your behalf without an approved card. Usage events (which agents ran, AI requests counted against your daily allowance) — to enforce fair-use limits and improve reliability. Billing records (subscription plan, status, renewal date) — only when you choose a paid plan; we never see your card number. We do not collect anything from sources you have not explicitly connected.

We process your data on the basis of (a) performance of contract— to deliver the service you signed up for; (b) legitimate interest— to keep the service secure and prevent abuse; and (c) consent— for non-essential analytics, which is off by default until you accept the consent banner. You can withdraw consent at any time by clearing the banner choice in your browser.

Your data lives in a managed Postgres database with row-level security scoped to your user id — other users cannot read your rows even from the same table. Data is encrypted in transit with TLS and encrypted at rest by the database provider. We do not claim end-to-end encryption: our service necessarily decrypts your data to compute on it (that is how Nova works). Secrets (API keys, OAuth tokens) live in a separate encrypted secret store.

Account and memory data is kept for as long as your account is active. AI usage events and agent run logs are retained for up to 90 days for debugging and abuse prevention, then aggregated or deleted. When you delete your account from /account, your rows are hard-deleted from the live database immediately and from rolling backups within 30 days. Audit log entries in data_requests are kept for compliance evidence even after the user is deleted.

You have the right to access, correct, export, delete, and object to processing of your personal data. We have built these into the app:

• Export: /account → Your data → Export my data (JSON). Returns a complete JSON of every row Nova holds about you.
• Delete: /account → Your data → Delete my account. Requires you to type DELETE; runs immediately; you cannot log back in afterwards.
• Correct: edit any note, card, profile field, or guardrail directly in the app.
• Object / restrict: pause any agent from /my-agents, revoke any integration from /permissions.

For anything that can't be self-served, email privacy@heynova.tech and we'll respond within 30 days. If we don't resolve it, you can complain to the South African Information Regulator (POPIA), your EU data protection authority (GDPR), or the California Attorney General (CCPA).

Your Nova database — account, memory, cards, connections and audit logs — is hosted in Amazon Web Services' eu-west-1 region (Dublin, Ireland). It is not hosted in South Africa. The app server runs on Cloudflare's global edge, so the request that serves a page may be handled close to you, but the stored data itself stays in eu-west-1. AI inference is a separate transfer: prompts and the context Nova sends with them are processed by our model provider, which may process them in the United States. Where data leaves the EU/EEA we rely on the relevant provider's Standard Contractual Clauses (SCCs); where data leaves South Africa we rely on POPIA s.72 protections. Per provider detail is listed under Sub-processors below.

When Nova drafts a card or answers an Ask, your prompt and relevant context are sent to a large language model provider. We pay for those calls per token; we do not sell your data to them. Whether a given provider uses paid API content for training depends on their published terms — we do not warrant a blanket "not used to train" statement here because that's a third-party guarantee, not ours. If you need a specific provider's training-opt-out for compliance, email us and we'll confirm the current configuration in writing.

We do not sell your personal data. We do not share it with advertisers. We do not run third-party advertising trackers in the app. We do not use your content to train a model that we operate.

Nova handles financial and household admin and is not directed at children. You must be 18 or older to create an account.

We use one essential cookie/storage entry to keep you signed in. We use a privacy-respecting product analytics layer for aggregate counts (page views, key actions). Analytics is OFF until you accept the consent banner on first visit. We do not use cross-site advertising trackers.

Material changes to this policy are announced in-app at least 30 days before they take effect. The effective date at the top of this page reflects the last change.

If your personal information is exposed, lost, or accessed by someone who shouldn't have it, we will tell you — without undue delay, and within 72 hours of confirming the breach wherever that is feasible. The notice will say what happened, what data was involved, what we've already done, and what (if anything) you should do. If we can't yet confirm the full scope in 72 hours, we'll tell you what we know then and follow up rather than wait for a complete picture. Where the law requires it we also notify the South African Information Regulator under POPIA s.22, and the relevant EU supervisory authority under GDPR Art. 33 — within 72 hours of becoming aware, as those provisions require. We will not quietly absorb a breach and hope you don't notice.

Nova uses AI to draft and to rank: it writes suggested replies, flags renewals, sorts your cards by what looks urgent. None of that takes effect on its own. Every card that would send a message, contact a person, schedule something, or change anything in the real world waits for your explicit tap, and that rule is enforced in the database rather than by the model. So no decision with a legal or similarly significant effect on you is made solely by automated processing — you are the decision-maker, and the AI is the thing that prepared the paperwork. You also have the right under GDPR Art. 22 (and the equivalent POPIA s.71 protection) not to be subject to such a decision made solely by automation; because Nova requires your approval by design, that right is met by the way the product works, not by a promise to review on request. We do not use your data for profiling that produces automated legal effects, and we do not price, score, or restrict your account based on model output. If you ever believe an outcome in Nova was effectively automatic, email privacy@heynova.tech and a human will look at it.