Privacy policy

If you hold a Nova account

We keep what you give us to run your account, and nothing else:

• Your name and email address, which you sign in with and which we write to with sign-in links, password resets and invitations.
• Your password, stored only as a one-way hash that cannot be turned back into the password. If you set up two-factor sign-in, its secret is stored encrypted.
• Your sessions: when and from which kind of device you signed in, so you can see them and sign any of them out.
• The organisations you belong to, your role in each, and who invited you.
• A record of support access: when somebody at Nova opens your organisation to help you, a line is written that you and your team can read in its access log.

What your bot learns from

Your bot reads the websites, documents, pasted text and product feeds you add to it, and keeps the text so it can answer from it. If that content contains personal information, such as a staff member's name on a contact page, the bot can repeat it, because it is your published content. You decide what to add, and you can correct or remove any source at any time, after which the bot stops answering from it.

If you chat to a bot on a business's website

The business whose website you are on is responsible for its conversations with you. Nova processes them on that business's behalf, as an operator in POPIA's terms. This is what happens to what you type:

• Your questions and the bot's answers are stored as a transcript, which the business's team can read and reply to.
• To write an answer, your question and the relevant parts of the business's own content are sent to an artificial intelligence model provider. The model writes the reply, and Nova checks every sentence against the business's content before you see it.
• If the conversation needs a person, the business's team can take it over and answer you themselves.
• The chat window keeps the conversation in your browser tab only, so it survives moving between pages. It is cleared when the tab is closed.
• Do not type passwords, card numbers or other sensitive information into a chat.

Who else processes it

We use a small number of service providers to run Nova: the artificial intelligence model provider that writes answers, the provider that turns text into search vectors so the bot can find the right passage, the email service that delivers our mail, and the hosting that stores the data. Some of these providers process information outside South Africa. We use them only to provide Nova, and we do not sell personal information or use it for advertising.

Cookies

Nova sets only the cookies that keep you signed in and stop another website from submitting your forms. It sets no advertising or tracking cookies. If a business has Google Analytics on its own website, the chat window can report events such as a chat being opened to that business's own analytics account; that is the business's choice.

How long we keep it

Expired sessions, used sign-in links and rate-limit counters are deleted on a schedule. The support access log is kept for a year so your team can see who reached into your organisation. Your account details, your bots' content and their transcripts are kept while your account is open, and you can remove sources and bots yourself.

Your rights

Under POPIA you may ask us what personal information we hold about you, ask us to correct or delete it, and object to how it is used. If you chatted to a business's bot, contact that business first, because it decides what happens to its conversations; we will help it answer you.

If you are not satisfied with how we handle a request, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

Contact

Questions about this policy, or a request about your information, go to Nova AI (Pty) Ltd, which operates Nova.