Privacy Policy

1. Who this policy covers

This policy explains how NOVA handles personal information on deskwithnova.com, in NOVA accounts, in Gnomon and in NOVA ONE. The legal operator is NOVA ENTERPRISE LIMITED, a New Zealand limited company (NZBN 9429052611193), trading as NOVA. “NOVA”, “we”, “us” or “our” mean that company.

We aim to handle personal information in line with the New Zealand Privacy Act 2020.

2. What we collect

Depending on how you use our services, we may process:

• account information such as your name, email address and account identifier;
• plan, billing-status, credit and usage information;
• for NOVA ONE: the facts you approve about your business, your call lists (business names, phone numbers and notes), call recordings’ text transcripts and summaries, the details people give on calls (such as a name, email address or callback time), leads, tasks and your do-not-call list;
• for Gnomon: the texts and decisions you send for checking, which are processed to return a result and are not stored;
• technical information needed for security, rate limiting, reliability and troubleshooting, and website analytics.

3. People on NOVA ONE calls

NOVA ONE makes and answers calls for the businesses that use it. The people on those calls are not always our customers. On every call NOVA ONE says it is a digital assistant and who it is calling for.

The business that uses NOVA ONE decides who is called and why, and is responsible for having a lawful basis to contact them. We process call information on that business’s behalf to provide the service. Anyone who asks not to be called again is added to that business’s do-not-call list straight away.

If you were called by NOVA ONE and want to know what was recorded, or want it corrected or removed, email admin@deskwithnova.com with the number that was called.

4. Google account data in NOVA ONE

A business using NOVA ONE can choose to connect its Google account in NOVA ONE’s Settings, so that its AI caller can book appointments in the business’s Google Calendar and email people from the business’s Gmail address when they ask for something by email. Connecting is optional, and the business can disconnect at any time.

What NOVA ONE accesses. When a business connects Google, NOVA ONE asks Google for permission to:

• see the email address of the connected Google account, to show which account is connected;
• see when the business’s primary calendar is free or busy, to offer callers times that are free;
• add events to that calendar, for the bookings its caller makes (with the caller’s name, contact details and what the booking is about);
• send email from the account, only when a person on a call asks for something by email.

NOVA ONE does not read the business’s emails, its contacts or the details of its existing calendar events. It sees only whether a time is free or busy.

How it is used. Google account data is used only to provide these features to the business that connected it: to offer free times on a call, to make the booking, and to send the email the person asked for. Free times are passed to our voice provider during the call only so the caller can be told which times are available. We do not sell Google account data, use it for advertising, or use it to develop, improve or train AI or machine-learning models. People at NOVA do not read it, except with the business’s permission for support, when needed for security or to investigate abuse, or when the law requires it.

Storage and security. NOVA ONE keeps the access token Google gives it, encrypted, and the email address of the connected account. Bookings are stored in the business’s own Google Calendar, and sent emails in its own Gmail. When a business disconnects Google in Settings, NOVA ONE cancels its access with Google and deletes the token. A business can also remove NOVA ONE’s access in its Google Account (Security, Third-party apps with account access); NOVA ONE then can no longer use the account, and disconnecting in Settings deletes what NOVA ONE kept.

Limited Use. NOVA ONE’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4A. Remote control and the NOVA ONE browser extension

A business using NOVA ONE can choose to turn on Remote control and add the NOVA ONE Remote Control extension to its Chrome or Edge browser. NOVA ONE can then carry out a task the person asks for on a website, in one browser tab. Both are optional, both are off until the business turns them on, and either can be turned off at any time.

What is accessed. Only during a task the person started, and only in the one tab NOVA ONE is working in, the extension sends NOVA ONE:

• pictures of that tab, so the next step can be worked out;
• the text of the page, when a task needs a page read;
• the label of a button before it is clicked, so that sending, paying, publishing or deleting is stopped for the person’s approval.

If a task needs the business’s own customers, quotes or invoices from NOVA ONE, those are used too. A page the person asks NOVA ONE to work on may show other people’s details, and a picture of that tab would include them.

What is not accessed. The extension does not look at other tabs, browsing history, saved passwords or anything else in the browser. It never types a password: if a site asks to sign in, the person does that themselves. It works only on the sites the person named for that task.

How it is used and kept. The pictures and text are sent to our AI provider (see section 6) to decide each step, and are used for nothing else: not for advertising, and not sold. Pictures are held only while the task runs and for up to an hour after so the person can see how it ended; they are not kept in the business’s records. What is kept is a record of each task: who started it, what was asked, each approval that was asked for and the answer, and how it ended.

5. Why we use information

We use information to provide and secure our services: to make and answer calls, keep transcripts, leads and tasks, check AI texts and decisions, authenticate accounts, process payments, enforce plan limits, prevent abuse, troubleshoot failures and improve reliability. We do not sell personal information.

6. Service providers and overseas processing

We rely on specialist service providers for AI processing, phone calls, voice, authentication and databases, payments and hosting. These currently include Anthropic (AI), ElevenLabs (voice and speech), Twilio (phone calls), Supabase (accounts and data), Stripe (payments), Render and Vercel (hosting), and Google Analytics on this website. Information may be processed outside New Zealand as part of providing the service.

We assess our handling of personal information and our providers against New Zealand privacy requirements, including the rules on sending information overseas.

7. Payment information

Payments are processed by Stripe. NOVA does not receive your full card number. Stripe may collect payment and billing information under its own privacy terms.

8. Retention and security

We keep personal information only as long as reasonably needed for the purpose it was collected for, our legitimate operational needs, or legal obligations. A business using NOVA ONE can delete its calls, leads and tasks, and we delete a business’s call data when its account closes, unless the law requires us to keep it.

We use reasonable technical and organisational safeguards, but no internet service can guarantee absolute security.

9. Access, correction and privacy requests

You may ask for access to, or correction of, personal information we hold about you, or raise a privacy concern. Email admin@deskwithnova.com or use the contact page. We may need to check your identity first. You can also contact the Office of the Privacy Commissioner.

10. Changes to this policy

We may update this policy as our services or providers change. The latest version is published here with an updated date.