1. Overview

NovaHQ ("we", "us", "our") is an Australian business operating system built for trade and service businesses. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website and platform (the "Service").

We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

2. Information We Collect

We collect information that you provide directly to us, including:

• Account information: name, email address, and password (encrypted)
• Business information: business name, ABN, address, phone number, and industry
• Usage data: how you interact with the Service, including features used and actions taken
• Communication data: emails and messages sent through the platform
• Payment information: processed securely through Stripe; we do not store full card numbers

3. How We Use Your Information

We use your information to:

• Provide, maintain and improve the Service
• Create and manage your account and organisation
• Process payments and manage subscriptions
• Send service-related communications, notifications and updates
• Provide customer support and respond to inquiries
• Send product tips, news and offers only where you have expressly opted in
• Analyse usage patterns to improve features and user experience
• Comply with legal obligations

4. Data Storage and Security

Your data is stored using organisation-based data isolation. Each organisation's data is separated, and only authorised users within your organisation can access it. We use role-based access control to enforce data permissions.

We take reasonable steps to protect your information from unauthorised access, alteration or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

5. Data Sharing

We do not sell, rent or trade your personal information. We may share information with:

• Service providers who assist us in operating the platform (e.g., Stripe for payments, cloud hosting providers)
• Third-party providers when an authorised organisation administrator connects Gmail, Google Drive or Calendar via OAuth 2.0. Provider passwords are never stored; authorisation tokens are encrypted at rest.
• Law enforcement or government agencies if required by law

6. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or outdated information
• Request that we delete your personal information (subject to legal requirements)
• Opt out of marketing communications
• Complain about our handling of your personal information

7. Marketing Communications

Responding to a contact request is separate from marketing. We only use contact-enquiry details for product news, tips or offers when you expressly select the marketing opt-in. Every automated marketing message must include a working unsubscribe option, and an opt-out blocks further marketing contact.

8. Cookies

We use essential cookies to maintain your session and authenticate your account. We do not use third-party advertising cookies. You can control cookies through your browser settings.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After account closure, we retain data for a reasonable period to comply with legal obligations and resolve disputes, then delete or anonymise it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date.

11. Business Data

You may upload or create business data within the Service, including customer records, job details, quotes, estimates, invoices, documents and photos. This data is stored within your organisation's isolated workspace and is only accessible to users you invite.

We do not access, review or use your business data for any purpose other than providing and improving the Service. Aggregate, non-identifiable usage patterns may be analysed to improve features.

12. Analytics

We use privacy-conscious analytics to understand how the Service is used and to improve user experience. Analytics events track product interactions (such as page views, feature usage and signup flow progress) but do not include passwords, access tokens, customer job data, quote values, invoice details, uploaded file names or sensitive organisation information.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at hello@novahq.com.au.