GDPR Compliance
We are committed to protecting the privacy rights of EU residents and ensuring full compliance with the General Data Protection Regulation.
Your Rights Under GDPR
As a data subject, you have the following rights regarding your personal data. We honor each of these through a verified, manually handled request to privacy@novaico.com, and respond within 30 days as required by law.
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct any inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Restrict
Limit how we process your personal data.
Right to Object
Object to processing based on legitimate interests.
Automated Decisions
Not be subject to decisions based solely on automated processing.
Withdraw Consent
Withdraw consent at any time where processing is based on consent.
Legal Basis for Processing
Contract Performance
We process data necessary to provide our services to you, including account management, ticket handling, and support features.
Legitimate Interests
We process data for legitimate business purposes such as improving our services, security monitoring, and fraud prevention, balanced against your rights and interests.
Consent
For optional features like marketing communications, we obtain your explicit consent. You can withdraw consent at any time.
Legal Obligation
We may process data to comply with legal requirements, such as tax regulations, court orders, or regulatory requests.
Data Processing Details
Data Controller
Novaico, Inc. acts as the data controller for personal data collected through our platform. Our customers (tenants) may act as data controllers for their end-user data, with Novaico acting as a data processor.
Sub-Processors
We use the following sub-processors to provide our services:
| Service | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database, file storage, transactional and inbound email | EU (Frankfurt, eu-central-1) |
| Vercel | Marketing website hosting only — no customer or ticket data | EU (Frankfurt) — DPA in place |
| Sentry | Application error monitoring | EU |
| OpenAI | AI features (draft replies, categorization, knowledge base) | USA (DPA in place) |
| Microsoft Azure OpenAI | AI features (fallback provider) | EU |
| Telnyx | Voice calls and telephony | EU / USA (DPA in place) |
| Stripe | Payment processing | USA (SCCs in place) |
| Gmail inbox integration and Google sign-in | EU / USA (SCCs in place) | |
| Apple | Mobile push notifications for the agent app | USA (DPA in place) |
| Slack | Operational alerting and the Slack channel integration | USA (SCCs in place) |
| GitHub | Issue tracker integration | USA (SCCs in place) |
| Atlassian (Jira) | Issue tracker integration | EU / USA (SCCs in place) |
| Zoom | Meeting integration | USA (SCCs in place) |
| TeamViewer | Remote support sessions | EU (Germany) |
| Meta (WhatsApp Business) | WhatsApp support channel | EU / USA (SCCs in place) |
The application and all customer data are hosted on AWS in the EU (Frankfurt). Vercel hosts this marketing website only; it never receives ticket, customer or account data.
International Transfers
When data is transferred outside the EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements with all sub-processors
- Supplementary measures where required
Data Retention
We retain personal data for the duration of the service relationship. Upon a verified request, we delete or anonymize the requested data. Automated retention schedules and self-service tooling are in active development.
Exercise Your Rights
To exercise any of your GDPR rights, please contact our Data Protection team. We will respond to your request within 30 days.
Data Protection Contact
privacy@novaico.comIf you are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.