Privacy Policy

Effective Date: May 25, 2026 | Version 1.1 | ainovahq.com

This Privacy Policy explains how N.O.V.A. ("we", "us", "our") collects, uses, stores, and protects your personal information when you use the N.O.V.A. application and related services (collectively, the "App"). By using the App, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Name and email address
Date of birth (required for age verification)
Password (stored in encrypted form — we never see your plaintext password)

1.2 Age Verification Data

To access age-restricted features such as Spicy Mode, we collect:

A selfie photograph submitted for AI-assisted age estimation
Your stated date of birth

Age verification photographs are processed solely for verification purposes. They are not used for any other purpose, shared with third parties for marketing, or used to train AI models.

1.3 Conversation Data

We collect and store messages you send to and receive from Nova, including conversation history, memory entries you create, and interaction patterns used by the karma system.

AI Training: Your conversations with Nova are never used to train AI models — by us or by any of our sub-processors. Conversation data is used solely to deliver the service, maintain Nova's memory of you, and operate the karma system. We do not sell, license, or provide conversation data to any AI model developer for training purposes.

1.4 Voice and Audio Data

If you use voice features, we collect audio transcription data and your selected voice profile preferences. Audio is processed to generate responses via third-party voice synthesis services (Fish.audio, Render). Their respective privacy policies govern their handling of audio data. We do not independently retain raw audio beyond what is necessary to deliver the response.

1.5 Usage Data

Features accessed and interaction metrics
Device type, operating system, and app version
IP address and approximate location
Session duration and frequency of use

1.6 Payment Information

The base app is purchased as a one-time transaction through the Apple App Store or Google Play Store. Apple's and Google's respective privacy policies govern the handling of payment data for those purchases — we do not collect, store, or have access to your payment card details for app store transactions.

Super NOVA subscription payments are processed through PayPal. We do not collect, store, or have access to your full payment card details for PayPal transactions. PayPal's privacy policy governs their handling of your payment data.

2. How We Use Your Information

Purpose	Data Used
Provide and operate the App	Account info, conversation data, usage data
Age verification for restricted features	Date of birth, selfie photograph
Personalize Nova's behavior and memory	Conversation history, memory entries
Process app store purchases and subscription payments	Email address (via Apple/Google/PayPal)
Send Super NOVA renewal notifications	Email address, subscription status
Detect and prevent abuse	Usage data, IP address, conversation flags
Comply with legal obligations	All data as required by law
Improve the App	Aggregated, anonymized usage metrics

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

3. Data Sharing

3.1 Third-Party Service Providers (Sub-Processors)

In accordance with GDPR Article 28 and applicable data protection law, we disclose all third-party sub-processors who process personal data on our behalf in connection with operating N.O.V.A.:

Sub-Processor	Purpose	Data Processed	Location
Base44	App backend infrastructure, database, and hosting	All user data stored in the app	United States
Cloudflare	Website hosting, DNS, CDN, and DDoS protection	IP address, request metadata	United States (global CDN)
OpenRouter	AI request routing for standard chat and age verification	Conversation messages, verification prompts	United States
Venice AI	AI model provider for Dark Nova and Spicy Mode (18+ verified only)	Conversation messages (18+ users only)	United States
Fish.audio	Voice synthesis for premium voice features	Text content for voice generation	United States
Render	Voice microservice hosting	Audio processing data	United States
PayPal	Super NOVA subscription payment processing (web)	Email address, payment transaction data	United States
Apple App Store	App distribution and one-time purchase processing	Purchase receipt, Apple ID email	United States
Google Play Store	App distribution and one-time purchase processing	Purchase token, Google account email	United States
Resend	Transactional email delivery	Email address, email content	United States

These providers are contractually obligated to handle your data only as necessary to provide their services and in accordance with applicable law. We do not authorize any sub-processor to use your data for their own independent purposes.

3.2 Law Enforcement

We will disclose user data to law enforcement authorities when legally required to do so, or when we reasonably believe disclosure is necessary to protect the safety of any person, comply with a legal obligation, or protect our rights and property. We reserve the right to do so without prior notice to you.

3.3 No Sale of Data

We do not sell, rent, or trade your personal information to any third party for their own commercial purposes.

4. Data Retention

4.1 Active Accounts

We retain your data for as long as your account remains active and for a reasonable period thereafter to enable reactivation, resolve disputes, and comply with legal obligations.

4.2 Account Deletion

Upon account deletion, your conversation history, profile data, and associated records will be retained in a secure, encrypted archive for 30 days before permanent deletion. This retention period exists to enable cooperation with lawful law enforcement requests. After 30 days, all data is permanently and irrecoverably deleted.

4.3 Age Verification Photos

Selfie photographs submitted for age verification are used solely for the purpose of AI-assisted age estimation at the time of submission. Once the verification check is complete and a pass or fail determination has been recorded, the photograph is deleted from our systems within 72 hours of submission. We do not retain age verification photographs beyond this window, and they are never used for any secondary purpose including identity verification, biometric profiling, or AI model training.

5. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

Encrypted storage of passwords and sensitive data
Secure encrypted archiving of deleted account data during the retention period
Access controls limiting who can view user data
HTTPS encryption for all data in transit

No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security of your data and are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

In the event of a data breach that affects your personal information, we will notify you as soon as reasonably practicable after becoming aware of the incident, in accordance with applicable law.

6. Children's Privacy

N.O.V.A. is available to users aged 13 and older. Age-restricted features are available only to users 18 and older who have completed age verification. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us immediately at support@ainovahq.com and we will delete the account promptly.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Request a portable copy of your data in a commonly used format
Object to or restrict certain processing of your data
Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at support@ainovahq.com. We will respond within 30 days.

8. Cookies and Tracking

The App may use session-based storage to maintain your login state and preferences. We do not use third-party advertising cookies or cross-site tracking technologies. Our website at ainovahq.com does not use analytics cookies beyond what is inherent to Cloudflare's infrastructure.

You may disable cookies through your browser settings. Doing so may affect the functionality of the web version of the App, including your ability to stay logged in. We do not place personally identifiable information in cookies.

No Advertising: N.O.V.A. does not display advertisements. We do not collect, share, or sell your personal information to advertising companies, and we do not use your data for interest-based or targeted advertising purposes.

Do Not Track: Some browsers offer a "Do Not Track" (DNT) signal. Because we do not engage in the tracking practices DNT is designed to address, we do not alter our data practices in response to DNT signals. Our commitment to not sharing your data with advertising partners applies regardless of any DNT setting.

9. International Users and GDPR

N.O.V.A. is operated from the United States. If you access the App from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the App, you consent to this transfer.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies to you under the General Data Protection Regulation (GDPR) or equivalent laws:

Legal basis for processing: We process your data based on your consent (e.g. account creation, age verification), the performance of our contract with you (e.g. delivering the App's features), and our legitimate interests (e.g. security, fraud prevention, improving the service).
Right to access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request that inaccurate data be corrected.
Right to erasure: You may request deletion of your personal data, subject to any legal retention obligations.
Right to portability: You may request your data in a structured, commonly used, machine-readable format.
Right to restrict processing: You may request that we limit how we use your data in certain circumstances.
Right to object: You may object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@ainovahq.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

10. California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA provides you with the following rights regarding your personal information:

Right to Know: You may request information about the categories and specific pieces of personal data we collect, the purposes for which we use it, and the third parties with whom we share it.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out: We do not sell your personal information to third parties. We do not share your data for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Right to Data Portability: You may request your personal data in a portable format.

To submit a request, contact us at support@ainovahq.com. We will respond within 45 days. Requests may be extended once by an additional 45 days where necessary, and we will notify you of any extension.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the Effective Date at the top of this page and, where appropriate, by sending a notification through the App. Your continued use of the App following any update constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us at:

N.O.V.A. Privacy
support@ainovahq.com
ainovahq.com
Myrtle Beach, South Carolina, United States

By using N.O.V.A., you acknowledge that you have read and understood this Privacy Policy.