Privacy Policy
How NOVA collects, protects, and uses your information — explained in plain terms, no fine print.
We do not sell personal data, we do not show ads based on your conversations, and we never share your information with third parties for marketing purposes under any circumstances.
Who we are and who this policy applies to
NOVA is a conversational AI assistant application, available as a mobile app and a web app. This privacy policy applies to all services offered under the NOVA brand, including the AI chat, user account management, and subscription plans.
The data controller responsible for your data is Nova Ocean, based in Spain. By using NOVA, you accept the practices described in this document.
What data we collect
We only collect the data necessary to provide you the service.
2.1. Account data
| Data | Source | Purpose |
|---|---|---|
| Email address | Firebase Authentication | Identify your account and sign you in |
| Unique user identifier (UID) | Firebase Authentication | Link your conversations and plan to your account |
| Account creation date | Generated by the system | Internal management and support |
2.2. User-generated content
| Data | Purpose |
|---|---|
| Text messages sent to the chat | Generate the AI's response and show you your history |
| Attached files, images, or documents | Process them when you ask for help with them |
| Title and content of saved conversations | Let you review your history later |
2.3. Service usage data
| Data | Purpose |
|---|---|
| Subscribed plan (free / standard / pro / premium) | Apply your plan's limits and features |
| Number of messages sent per day | Check that you have not exceeded the daily limit |
| Selected AI model | Route your request to the right provider |
2.4. Payment data
| Data | Purpose |
|---|---|
| Subscription status | Know which plan should be applied to your account |
| Stripe customer/session identifier | Link your payment to your account, without seeing your card |
We never see or store your full card number or any other sensitive banking data. That is handled exclusively by Stripe, which is PCI DSS certified.
2.5. Data we do NOT collect
- Geographic location (GPS or network-based).
- Contact list.
- Data from other apps installed on your device.
- Biometric data (fingerprint, facial recognition).
- Browsing history outside the app itself.
How and why we use your data
We use the data described above, exclusively, to:
- Provide and maintain the AI chat's operation.
- Verify your identity and keep you signed in.
- Correctly apply your plan's limits and benefits.
- Process payments and manage your subscription.
- Save your conversation history.
- Detect and prevent abuse or fraud on the service.
- Provide technical support when you contact us.
We do not use your data to build advertising profiles, share it with ad networks, or analyze your conversations for commercial purposes unrelated to the chat's own operation.
Legal basis for processing
- Contract performance: we need your account and usage data to provide you the service.
- Legitimate interest: to prevent fraud and ensure the platform's security.
- Consent: when we ask for your explicit authorization, for example before processing a file.
- Legal obligation: to retain billing data as required by tax regulations.
Who we share data with (and who we never share with)
We only work with providers strictly necessary for NOVA to function. All of them act as data processors: they process data according to our instructions, without being able to use it for their own commercial purposes.
5.1. Providers we work with
| Provider | Function | What data they receive |
|---|---|---|
| Firebase (Google) | User authentication | Email, UID |
| Stripe | Payment processing | Billing data, never the full card |
| AI inference providers (§06) | Generate the chat's response | The message from that conversation |
| Cloudflare | Infrastructure and storage (Workers KV / D1) | Encrypted app traffic |
5.2. Who we NEVER share your data with
- Advertising or marketing networks.
- Data analytics companies for resale purposes.
- Third parties not mentioned here, except where legally required.
We do not sell personal data under any circumstances.
How AI processing works
To generate chat responses, NOVA sends the content of your message to one of several language model providers. We use several (instead of just one) to keep the service running if one becomes unavailable:
These providers receive only the text necessary to respond to your specific request. They do not receive your email, your real identity, or your payment data. Communication travels encrypted via HTTPS/TLS.
They act under their own privacy policies as processors of the message content, solely to return a response, and are not authorized by us to use your messages for other purposes.
Information security
- Encryption in transit: all communication between your device, our servers, and external providers travels encrypted via HTTPS/TLS.
- Secure key management: access keys to external services are stored as encrypted environment variables on the server and are never included in client-side code.
- Origin restriction (CORS): our API only accepts requests from the NOVA app itself.
- Server-side verification: your plan and usage limits are always checked on the server, never trusting the user's device.
- Credential rotation: we use several rotating API keys per provider, reducing the impact if one were compromised.
- Outsourced payments: handled entirely by Stripe (PCI DSS); NOVA never sees your card number.
- Least privilege: each part of the system accesses only what is strictly necessary for its function.
Despite these measures, no system is 100% infallible. If a security breach affecting your data were to occur, we would notify you in accordance with applicable regulations.
Data retention and deletion
- Your history is retained while your account remains active.
- Usage data resets periodically according to your plan's cycle.
- Billing data is retained for as long as required by tax regulations.
- If you delete your account, we erase your personal data and history within a reasonable period, except where we are legally required to retain it (e.g., billing).
International data transfers
Some providers (Firebase, Stripe, and certain AI providers) may process data on servers outside your country, including the United States. In those cases, they have their own compliance mechanisms for international transfers (such as standard contractual clauses or other equivalent legal frameworks).
Your rights
- Access: request a copy of your data.
- Rectification: correct inaccurate data.
- Erasure: delete your account and your data.
- Portability: receive your data in a structured format.
- Objection and restriction: object to a specific processing activity.
- Withdrawal of consent: at any time.
To exercise any of these rights, write to us at nova.ia.ocean@gmail.com.
Minors
NOVA is not directed at children under 13 (or the equivalent minimum age required locally). We do not knowingly collect data from minors under that age. If we detect an account belonging to a minor without parental consent, we will delete their information.
Payments and subscriptions
- Your payment method is managed directly by Stripe; NOVA does not store full banking details.
- We only receive payment confirmation and the subscription identifier, to activate your plan.
- You can cancel at any time; limits adjust once the paid period ends.
Cookies and local storage
We may use browser or device local storage (for example, to keep you signed in). We do not use advertising tracking cookies or share this with third-party networks.
Changes to this policy
We may update this policy from time to time. If there are significant changes, we will notify you from within the app or by email before they take effect. The date above always reflects the current version.
Contact
Email:
nova.ia.ocean@gmail.com
Controller: Nova Ocean