Privacy Policy

Last updated 2026-10-28

This policy explains what Nova HQ (“Nova HQ”) collects, why, and the choices you have. It covers business owners and their teams who use Nova HQ, and the customers of those businesses who use a booking page or customer portal.

What we collect

• Account details: name, email, business name and settings, team members and their roles.
• Business content: leads, customers, jobs, tasks, notes, contracts and signatures, invoices, shot lists, timelines, galleries, files and emails written in Nova HQ.
• Customer details entered by a business or by its customers on a booking page or portal: name, email, phone, event details, notes, approvals and payments status.
• Billing: plan and subscription status. Card details are handled by Stripe and never stored by us.
• Technical data: sign-in records, IP addresses used for security and rate limiting (stored as one-way hashes), and error logs.

How we use it

To run Nova HQ for the business: show its workspace, send the emails it asks for, take bookings and payments, deliver galleries, keep the service secure, and provide support. We don't sell personal information and we don't use business or customer content to advertise.

Businesses and their customers

For customer information, the business you deal with decides what is collected and how it's used; Nova HQ processes it on that business's behalf. If you are a customer of a business that uses Nova HQ, contact that business first about your information. We will help them respond.

AI features

When an owner uses the Nova assistant, the relevant business information is sent to our AI provider, Anthropic, to produce the answer. It is used to run the request, not to train models. When an owner connects their own ChatGPT, Claude or another app, that app can read and change the business's jobs through the connector the owner approved, under that app's own privacy terms.

Connected Google, Microsoft and Notion accounts

If an owner connects Gmail or Outlook, Nova HQ asks only for permission to send email and to read the account's email address. We use it only to send the emails the owner sends from Nova HQ, we never read the inbox, and we store the access token encrypted. Nova HQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If an owner connects Notion, we write the job pages they send there and read only the list of pages they shared with us. Disconnecting in Settings removes our stored tokens.

Service providers

We use providers to run Nova HQ: Vercel (hosting), Supabase (database, sign-in and file storage), Stripe (payments), Resend (email delivery) and Anthropic (AI). They process data only to provide their service to us.

Cookies and storage

We use cookies needed to keep you signed in and to secure forms. Your browser also stores display preferences such as theme. We don't use advertising cookies.

How long we keep it

We keep business data while the account is active. After a business is deleted, we remove its data from active systems within 30 days and from backups on their normal cycle. Galleries can close earlier if the business sets a closing date.

Your choices and rights

Owners can export, change or delete their business data and close their account. Depending on where you live, you may have rights to access, correct, delete or object to how your information is used. Email support@novahq.app and we will respond within the time the law requires.

Security

Data is encrypted in transit, access is limited per business, connected-app tokens are encrypted at rest, and sensitive links (customer portals, invites, calendar feeds) use long random tokens stored as hashes.

Children

Nova HQ is for businesses and isn't directed to children under 13.

Changes and contact

We'll post changes here and email owners about significant ones. Questions or requests: support@novahq.app.