novaico
Explore plans

Privacy Policy

Last updated: September 9, 2026

1. Introduction

Novaico ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our customer support platform and related services.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, company name, and password when you create an account.
  • Support Data: Tickets, messages, attachments, and other content you submit through our platform.
  • Payment Information: Billing details processed securely through our payment provider (Stripe).
  • Communication: Messages you send to us for support or inquiries.

2.2 Information Collected Automatically

  • Usage Data: How you interact with our platform, features used, and actions taken.
  • Device Information: Browser type, operating system, IP address, and device identifiers.
  • Cookies: Session cookies and analytics cookies to improve your experience.

2.3 Information from Third Parties

  • Authentication Providers: Information from Google when you sign in with a Google account.
  • Integrations: Data from connected services like GitHub, Gmail, or Jira when you authorize them.

3. Google User Data

Customers may connect a Google account to Novaico. When you do, we access and process Google user data only to provide the features you enable, as described below.

3.1 What We Access

  • Sign in with Google (scopes: openid, email, profile): we store the account email address and display name to authenticate you and identify your account.
  • Gmail integration for a team's support mailbox (scopes: gmail.readonly, gmail.modify, gmail.send): we read incoming messages so they become support tickets, and store the message headers, body, and attachments needed to display the ticket conversation. We mark imported messages as read and apply a label in the mailbox, and we send agent replies from the connected mailbox.
  • Google Calendar (scope: calendar.events): when an agent schedules a meeting from a ticket, we create and update the calendar events we created. We never read other events in the calendar.

3.2 How We Use It

We use Google user data solely to provide the features above. We never use it for advertising, and we never use it to train generalised AI or machine-learning models. Our AI features process ticket content, which may include email content, through OpenAI to draft replies, classify, and translate, strictly to provide those features to your workspace.

3.3 Limited Use Disclosure

Novaico's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4 Sharing

We do not sell Google user data. It is shared only with the sub-processors needed to run the service, and with the members of your own workspace:

  • Amazon Web Services (EU, Frankfurt): hosting and storage.
  • OpenAI: AI features.
  • Sentry: error monitoring.
  • Your workspace: the members of the customer's own workspace who have access to the connected mailbox and its tickets.

3.5 Storage and Protection

Google user data is encrypted in transit and at rest. OAuth tokens are stored encrypted. All data is hosted in the EU.

3.6 Retention and Deletion

OAuth tokens are deleted immediately when you disconnect the integration in Settings → Email Integration, or when you revoke access at myaccount.google.com/permissions. Imported ticket content is kept as part of your workspace's support records until the workspace deletes the ticket or the account. You can request deletion by emailing the contact in section 13 of this policy.

3.7 Revoking Access

You can disconnect a connected Google account at any time in Settings → Email Integration, which removes our stored tokens immediately. You can also revoke Novaico's access directly from your Google account at myaccount.google.com/permissions.

4. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve our services
  • Process transactions and send related information
  • Send technical notices, updates, and support messages
  • Respond to your comments, questions, and requests
  • Power AI features to help your team provide better support
  • Monitor and analyze trends, usage, and activities
  • Detect, investigate, and prevent fraudulent transactions and abuse
  • Comply with legal obligations

5. AI and Machine Learning

Our platform uses OpenAI's services to provide AI-powered features such as:

  • Draft reply suggestions
  • Ticket categorization and priority detection
  • Knowledge base search and recommendations
  • Translation services

When using AI features, relevant ticket content is processed by OpenAI. We do not use your data to train AI models. OpenAI's data processing is governed by their privacy policy and our data processing agreement with them.

6. Data Sharing and Disclosure

We may share your information with:

  • Service Providers: Companies that help us operate our platform (hosting, analytics, payment processing).
  • AI Providers: OpenAI for processing AI features, subject to strict data processing agreements.
  • Legal Requirements: When required by law, subpoena, or government request.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.
  • With Your Consent: When you explicitly authorize sharing.

We do not sell your personal information to third parties.

7. Data Retention

We retain your information for the duration of the service relationship. Concretely:

  • Account data: retained for the life of the account.
  • Tickets and messages: retained until deleted by the workspace, or 30 days after the account is closed.
  • Backups: retained for up to 35 days.
  • Logs: retained for 400 days.

Upon a verified request, we delete or anonymize the requested data, except where we are required to retain certain information for legal compliance, dispute resolution, and enforcement of our agreements.

8. Data Security

We implement industry-standard security measures including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Regular security assessments and penetration testing
  • Access controls and audit logging
  • Secure infrastructure hosted on AWS

9. Your Rights

Depending on your location, you may have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Export your data in a portable format
  • Object to or restrict processing
  • Withdraw consent

To exercise these rights, contact us at privacy@novaico.com. We handle each request through a verified manual process and respond within 30 days, extendable where the law permits. Self-service export and deletion tooling is in active development.

10. International Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards through Standard Contractual Clauses and other legal mechanisms.

11. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through our platform. Your continued use after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy, please contact us: