Privacy Policy

Last updated: 23 April 2026.

This policy explains what personal data NOVA Labs collects, why, how long we keep it, and what choices you have. It applies to customers who sign up for NOVA and to the phone numbers / lead records customers submit for outbound calls.

1. Data We Collect

From you as a customer of NOVA:

Account data: name, email address, password hash, billing identifiers.
Product content you submit: company name, product descriptions, pitch scripts, call goals.
Usage data: which endpoints you called, when, from what IP, minutes consumed.
Consent declarations you assert when submitting a call request.

From the leads you submit to be called:

Name and phone number as submitted by you.
The call transcript, emotional-state labels, and outcome label produced during the call.
Any email address the lead provides during the call.

2. Why We Process This Data

To operate and improve the service.
To bill you for usage and enforce plan limits.
To provide post-call summaries and email notifications.
To detect and prevent abuse, fraud, and regulatory violations.
To comply with legal obligations.

3. How Long We Keep It

Account data is kept for as long as your account is active, plus a reasonable period afterwards for billing, tax, and dispute resolution (typically up to seven years).

Call content (transcripts, outcome labels, lead records) is kept for 180 days by default, after which it is deleted or aggregated into non-identifying analytics. You or a called party may request earlier deletion by emailing ceo@novalabs.ae.

System logs are retained for up to 90 days.

4. Who We Share It With

We share data only with infrastructure and AI-service subprocessors required to deliver the product:

OpenAI — large-language-model inference for call generation.
Deepgram — speech-to-text transcription.
ElevenLabs — text-to-speech synthesis.
LiveKit — real-time audio transport and SIP telephony.
Stripe / Ziina — payment processing.
Resend — transactional email delivery.
A database host and an observability provider for logs/traces.

Each subprocessor processes the data only to perform the function above and is bound by its own contractual commitments. We do not sell personal data, and we do not share it with third-party advertisers.

5. Your Rights

Depending on your jurisdiction you may have rights to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights email ceo@novalabs.ae from the address associated with the data. We respond within thirty (30) days.

If you are a called party (not a NOVA customer) and want us to delete a recording or transcript of a call you received, email the same address with the phone number that was called and the approximate date.

6. Security

We encrypt data in transit and at rest, scope access on a least-privilege basis, and log administrative actions. No system is perfectly secure; we will notify affected users promptly if a breach meaningfully impacts them.

7. International Transfers

NOVA is operated from the United Arab Emirates. Our subprocessors may process data in the United States, the European Union, and other jurisdictions. Where required by law, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) for international transfers.

8. Children

NOVA is not directed to children under 18. We do not knowingly collect data from children.

9. Changes

We may update this policy. Material changes will be announced by email and reflected by the updated date at the top of this page.

10. Contact

Data-protection questions: ceo@novalabs.ae. General support: ceo@novalabs.ae.