Who this covers
JENA is an AI workforce app made by NOVA ENTERPRISE LIMITED, trading as NOVA (NZBN 9429052611193), a New Zealand company. This page explains what information JENA collects, why, where it is kept, who else handles it, and the choices you have. "We" and "NOVA" mean NOVA Enterprise Limited. We are responsible for your personal information under the New Zealand Privacy Act 2020. Mini NOVA and the NOVA website are covered by the NOVA Privacy Policy.
The short version
- We collect what JENA needs to work: your account details, what you and your team put into JENA, and records of how much AI work your organisation uses.
- Your work is processed by OpenAI to produce your AI employees' answers. OpenAI does not use it to train its models.
- We do not sell your information, show you ads, or use tracking or advertising tools in JENA.
- Your organisation's information is only visible to people in your organisation.
- You can ask us for a copy of your information, correct it, or delete your account or workspace yourself in Settings.
Information we collect
Account details. Your name, email address and a protected form of your password (a one-way, salted hash, never the password itself). When you sign in, JENA keeps a sign-in token in Windows Credential Manager on your computer and a hashed copy on our servers. Sign-ins expire after 7 days.
Organisation details. Your organisation's name, the people in it and their roles, and invitations you send (the invitee's email address and role).
Work you put into JENA. This includes:
- your AI employees: their names, roles, instructions, skills and settings
- chats with your AI employees, including messages and files you attach
- missions, tasks, schedules and their results
- company documents and notes you add to the JENA Brain
- feedback you give on answers, and files your AI employees create for you
Voice. When you use a voice or meeting-notes feature, JENA records audio from your microphone only while you are using that feature. The audio is sent to OpenAI to be turned into text (or text is sent to be read aloud). JENA keeps the resulting text where you put it, but does not store the audio recording.
Connected apps. If an administrator connects another app, we store the app's address, the connection's name, and any key or sign-in token needed to use it. Keys and tokens are encrypted before they are stored. When an AI employee uses a connected app, we keep a record of the action, including who approved it.
Email inbox. If an administrator connects a mailbox, we store its address and app password, encrypted. AI employees read emails only when doing work the organisation asked for, save reply drafts in the mailbox, and send a reply only after a person approves it. People can also send follow-up emails to their own customers from JENA; these go through the organisation's own mailbox and are noted on that customer's record.
Customers and invoices. Leads and customers your organisation adds or receives (name, contact details, what they need, notes, calls, emails and bookings) are kept in your workspace. If your organisation makes invoices in JENA, the invoice (the customer's name and contact details, what was sold, amounts and the payment details your organisation enters) is kept as a file in your workspace.
Your website. If you ask JENA to learn from your website, it reads the public pages of that site and saves what it learned as company notes, colours and a logo you can change or remove.
Website chat, bookings and landing pages. If an organisation adds JENA's chat to its website, visitors' messages and any name, phone number or email address they choose to give are sent to OpenAI to produce the reply and kept in that organisation's chats, where its team can read them. The chat keeps the visitor's own conversation in their browser's storage so it continues on their next visit; it uses no cookies or tracking. Landing pages published with JENA count visits (a number only). If the organisation lets visitors book times through the chat, the booking (time, name, contact details and what it is about) is kept in that organisation's bookings and leads, and a visitor who gives an email address gets a confirmation and a reminder sent by JENA on the organisation's behalf, with a link to cancel. The organisation that runs the website is responsible for telling its visitors about this, and its own privacy policy applies to them.
Phone calls. If an organisation uses JENA's call assistant, the computer's microphone is recorded in short pieces during the call and sent to OpenAI to be turned into text; the audio is not kept. The transcript, the call notes and the outcome are kept in that organisation's chats and leads. If the organisation turns on JENA's own phone calls, the call's audio passes through Twilio and OpenAI while the call is happening and only the transcript is kept. JENA says it is an AI assistant at the start of every call it makes or answers, only calls numbers the organisation approved that day, never calls numbers on its do-not-call list, and adds anyone who asks not to be called again. The organisation is responsible for telling the people it calls that the call is being noted, and its own privacy policy applies to them.
Phone notifications. If you turn on notifications in the JENA phone app, we store the address your phone's push service gives us, which identifies that browser, not you. Notifications carry a short title only.
Share links. If you share a file from JENA, anyone with the link can open that one file until the link expires (30 days) or you stop sharing it.
Usage records. For each piece of AI work we record which employee did it, the AI model used, the amount of AI processing (tokens), web searches, code runs, how long it took and whether it succeeded. These records power the dashboard, budgets and plan limits.
Activity records. We keep a record of important actions in your organisation, such as hiring or removing an AI employee, changing permissions or approving an app action, with who did it and when.
Billing details. Paid plans are handled by Stripe. We store your plan, its status and Stripe's customer and subscription reference numbers. We never see or store your full card details.
Technical information. Our servers keep short-lived technical logs (such as request times, addresses and error details) to run the service, keep it secure and fix problems. JENA does not use cookies, analytics or advertising trackers.
How we use information
- to provide JENA: run your AI employees, chats, missions, schedules, the Brain and connected apps
- to run the website chat, bookings, calls, emails and invoices your organisation sets up
- to keep accounts secure, for example by limiting repeated wrong passwords
- to show usage and apply plan limits and budgets you set
- to process payments and manage subscriptions
- to provide support and tell you about important changes to JENA or your account
- to improve JENA's reliability and features, using usage records and technical logs, not the content of your work
We do not use your organisation's content to train AI models, and we do not sell personal information.
Who handles information for us
| Provider | What it does for JENA | Where |
|---|---|---|
| OpenAI | AI answers, web search, code runs, document search, voice transcription and speech | United States |
| Supabase | Stores JENA's database | Singapore |
| Render | Runs JENA's online service | Singapore |
| Stripe | Payments and subscriptions | United States and other countries |
| GitHub | Hosts JENA's installer and update files (no customer information) | United States |
| Twilio | Connects JENA's own phone calls, only for organisations that turn them on | United States and other countries |
| Google and Apple push services | Deliver phone notifications (a short title only) | United States and other countries |
| Openverse and Pexels | Free stock photo search for designs (receives only the search words) | United States and other countries |
| Google Fonts | Supplies the typefaces on published landing pages (visitors' browsers load them) | United States and other countries |
To produce an answer, JENA sends OpenAI the relevant instructions, messages, files and document extracts. Under OpenAI's API terms this information is not used to train OpenAI's models, and OpenAI may keep API data for up to 30 days to detect abuse. Documents you add to the JENA Brain are kept in an OpenAI search index until you remove them from JENA. When you connect another app, information moves between JENA and that app as you direct, and that app's own privacy policy applies to what it holds.
We may also share information if the law requires it, to protect people's safety, or as part of a sale or restructure of NOVA's business, in which case this policy would continue to apply.
Information sent overseas
Some providers above store or process information outside New Zealand. We choose providers that protect information in ways comparable to the Privacy Act, and rely on their contractual commitments to keep it secure and use it only to provide their service to us.
How we protect information
- Connections to JENA are encrypted (HTTPS).
- Passwords are stored as salted hashes, and sign-in tokens are stored as hashes.
- Connected-app keys and tokens are encrypted.
- Every request is checked against your organisation, so one organisation cannot see another's information.
- Repeated wrong passwords and sign-up attempts are limited, and two-step sign-in with an authenticator app is available (owners can require it for everyone).
- Database backups are taken daily, kept privately and test-restored every week.
No system is perfectly secure. If a privacy breach is likely to cause serious harm, we will tell the people affected and the Privacy Commissioner, as the Privacy Act requires.
How long we keep information
We keep your organisation's information while it uses JENA. When an owner deletes a workspace, or someone deletes their account in Settings, it is deleted from JENA straight away, and from our backups within 30 days. If your organisation stops using JENA without deleting its workspace, ask us and we will delete it within 30 days. We keep billing records where the law requires it, for example for tax. Expired sign-ins are removed automatically.
Your choices and rights
Inside JENA you can delete AI employees, missions, schedules, files, Brain documents and notes, feedback and connected apps at any time. Owners can delete a whole workspace, and anyone can delete their own account, from Settings, and download a copy of everything in a workspace (Settings, then Download all my data). Under the Privacy Act you can also ask us for a copy of the personal information we hold about you, and ask us to correct it. Email us at the address below and we will respond within 20 working days.
If your organisation's administrator manages your JENA account, some requests may need to go through them, because the information belongs to your organisation's workspace. If you are not satisfied with our response, you can complain to the New Zealand Privacy Commissioner at privacy.org.nz.
Children
JENA is a business tool and is not intended for anyone under 16.
Changes to this policy
We will update this page when JENA changes. If a change is significant, we will tell organisation owners by email or in JENA before it takes effect.
Contact
NOVA Enterprise Limited, Auckland, New Zealand. Questions about JENA or this page: admin@deskwithnova.com.