Privacy Policy

For the NovaBuild platform, we are the controller of personal data about account holders, workspace members, prospects and visitors. For content you put into projects, including personal data about your own end users, you are the controller and NovaBuild is your processor. That relationship is governed by the Data Processing Addendum.

If you are a member of a workspace created by someone else, that workspace owner can see the projects, chat history and usage in that workspace. Talk to them about their own retention choices.

• Directly from you when you register, create projects, type prompts, upload files or contact support.
• Automatically from your device and browser when you use the app, including cookies described in the Cookie Policy.
• From services you connect, such as an identity provider returning your email and name, or a source host returning repository metadata.
• From our payment processor, which returns billing status and limited card metadata.
• From security tooling, which produces abuse and fraud signals about requests.

Where we rely on legitimate interests we have balanced them against your rights, and you can object using the contact details below.

To answer a prompt we send the prompt, the relevant slices of your project file tree, tool results and conversation history to the model provider selected for the run. Providers currently in use are listed on the Subprocessors page. If you supply your own provider key, the request goes to that provider under your own account and their terms.

To build and preview your project we send your project files to the sandbox provider, which runs dependency installs, typechecks, dev servers and production builds inside an isolated container.

We do not use your prompts, project files, generated code or chat history to train or fine tune foundation models, and our provider agreements are configured to exclude platform traffic from provider training where the provider offers that setting. We may use aggregated and de identified metrics, such as error rates, tool call success rates and latency, to improve routing and prompts. Those metrics do not contain your code or your customers' data.

We share personal data only in these cases:

• Subprocessors that operate parts of the service on our behalf, under contract, listed on the Subprocessors page.
• Other members of your workspace, according to their role.
• Anyone with the link, for projects you set to public, limited to the file tree and preview.
• Payment and tax providers, to take payment and issue invoices.
• Professional advisers, auditors and insurers, under confidentiality.
• Authorities, where a valid legal request applies. We check the request, resist overbroad demands, and tell you unless prohibited.
• An acquirer, in a merger or sale of assets, with notice to you and no reduction in protection.

We do not sell personal data and we do not share it for cross context behavioural advertising.

NovaBuild and its providers operate globally, so data may be processed outside your country, including in the United States and the European Economic Area. Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on an adequacy decision where one exists, and otherwise on the Standard Contractual Clauses with the UK Addendum, combined with technical measures such as encryption in transit and at rest and strict access control. A copy of the transfer mechanism used for a given provider is available on request.

Deletion from live systems is immediate or same day. Copies inside encrypted backups roll off on the schedule above, and we do not restore deleted content from backup except to recover from an incident affecting the whole platform.

Measures include encryption in transit with modern TLS, encryption at rest for databases and backups, row level security on every tenant table, credential encryption with server side only decryption, least privilege access for staff with logging, isolated per project sandboxes, tamper resistant audit logging, rate limiting and quota enforcement, dependency scanning, and code review before release. Full detail is in the Security page.

Depending on where you live, you can ask us to:

• confirm what we hold and give you a copy, in a portable format where applicable;
• correct data that is wrong or incomplete;
• delete data, subject to legal retention such as invoices;
• restrict or object to processing, including profiling for abuse prevention;
• withdraw consent for marketing at any time, without affecting other processing;
• not be discriminated against for exercising a privacy right;
• appeal a decision we make about your request.

Many of these can be done yourself in the app: export a project, delete a project, delete a workspace, change your email, or unsubscribe from marketing.

Email privacy@novabuild.dev from the address on your account, and tell us what you want. We verify identity before acting, respond within 30 days, and may extend once by a further 60 days for complex requests, telling you why. There is no charge unless a request is excessive or repetitive. An authorised agent may act for you with written proof.

We use a small number of first party cookies for authentication, security and preferences, plus privacy respecting product analytics. Details, including how to control them, are in the Cookie Policy.

We use automated checks to score requests for abuse and fraud, to enforce rate limits, and to route prompts to a model. These decisions can slow or block a request, but they do not have legal effects on you within the meaning of data protection law. If an automated control blocks you incorrectly, email support@novabuild.dev and a human will review it.

NovaBuild is not intended for children under 16, we do not knowingly collect their data, and we will delete an account promptly if we learn the holder is under age. Contact privacy@novabuild.dev if you believe a child has registered.

On the free plan projects are public by default. A public share page exposes the generated file tree, the rendered preview, the project name and description, and aggregate view counts.

Anyone can request removal of personal data that appears in a public project by emailing privacy@novabuild.dev with the share link and the detail concerned.

We maintain an incident response process with defined severities, on call escalation, containment steps and post incident review. If a breach affects your personal data and is likely to create risk, we notify you without undue delay, and we notify supervisory authorities within 72 hours where the law requires it. Where we act as your processor we notify you promptly so you can meet your own notification duties.

We update this policy as the product changes. The effective date and version at the top reflect the current text. Material changes are announced in the app or by email before they take effect, and we keep prior versions available on request.

Privacy requests and questions: privacy@novabuild.dev. Security reports: security@novabuild.dev. If you are unhappy with our response you can complain to your local data protection authority, and we ask that you give us the chance to fix the issue first.