Nova Cloud – Privacy Policy

1. Who We Are and How to Contact Us

2. Scope

This Policy applies to:

• Visitors to our Site;
• Users of the Nova Cloud console, API, and Services;
• Individuals who communicate with us (for example, via email or support tickets).

It does not apply to:

• Content you process within your own applications using our Services, where you act as a controller in respect of your end users. You are responsible for your own privacy practices toward your end users.

3. Information We Collect

3.1 Information You Provide Directly

• Account information: name, email address, organization name, username, and password (hashed);
• Billing information: billing address, tax identifiers (if provided), and limited payment-related details;
• Support communications: messages you send to us (for example, through email or support forms).

We do not store full credit card numbers on our systems. Payment details are handled by Stripe or other third-party processors.

3.2 Information Collected Automatically

When you use the Site or Services, we automatically collect:

• Log data: IP address, browser type, operating system, device identifiers, timestamps, pages viewed, and referring URLs;
• Service usage data: VM configurations, creation and deletion times, resource utilization (for example, CPU/GPU usage, bandwidth, storage), and API usage;
• Cookies and similar technologies: to remember your session, secure access to the console, and understand how our Site is used.

3.3 Information Related to Virtual Machines and Data

• You may store data on virtual machines and volumes that you control; this is Customer Content.
• The underlying storage for Customer Content is located in Canada.
• We generally do not access Customer Content except as necessary:
  • To provide or maintain the Services;
  • To troubleshoot, secure, or manage the platform;
  • When required by law; or
  • With your explicit permission (for example, during a support case).

4. How We Use Your Information

We use your information for the following purposes:

1. Providing the Services
   • Creating and managing your account;
   • Provisioning and operating virtual machines and associated resources;
   • Processing payments and invoices.
2. Operating and improving our platform
   • Monitoring performance and reliability;
   • Developing and enhancing features;
   • Analyzing usage trends to improve capacity planning and user experience.
3. Security and abuse prevention
   • Detecting and preventing fraud, abuse, and violations of our AUP;
   • Protecting the integrity and security of the platform and other customers.
4. Legal and compliance
   • Fulfilling tax and accounting obligations where required by law;
   • Responding to lawful requests from regulators or law enforcement.
5. Communication
   • Sending service-related emails (for example, billing notices, security alerts, policy changes);
   • Responding to your support requests.

Where required by law, we rely on legal bases for processing such as performance of a contract, legitimate interests, compliance with legal obligations, and (where relevant) consent.

5. How We Share Information

We do not sell your personal information. We may share limited information with:

5.1 Service providers

• Payment processors: Stripe and similar services to process payments;
• Infrastructure and hosting providers: for the Site and control plane (some of which may be outside Canada, for example, in the United States);
• Analytics and monitoring tools: to understand usage and maintain stability;
• Email and support systems: to send notifications and manage support interactions.

These providers are contractually required to handle data in accordance with applicable privacy standards.

5.2 Legal and compliance

• When required by law, regulation, legal process, or governmental request;
• To protect the rights, property, or safety of Nova Cloud, our customers, or others.

5.3 Business transfers

In connection with a merger, acquisition, corporate reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to appropriate safeguards.

We do not share your Customer Content with third parties except as required to provide the Services or to comply with law.

6. International Data Transfers

• VM data is stored in Canadian datacenter facilities.
• Site, console, and account-related data may be processed or stored in the United States or other countries where our service providers operate.

Where required by law for international transfers, we rely on appropriate safeguards (such as contractual clauses) to protect your information.

7. Data Retention

We retain information only as long as necessary for the purposes described in this Policy or as required by law.

1. Virtual machines and storage
   • When you delete a VM or volume (or when your account or Services are terminated), we delete the underlying data as part of our normal operations.
   • Deleted VM data is not recoverable by Nova Cloud.
2. Account and operational data
   • Non-financial account and operational data (for example, logs, support history, configuration metadata) is generally retained for up to 1 year after account closure, after which it is deleted or anonymized, subject to technical constraints and security practices.
3. Financial and tax records
   • We retain the minimum required financial records (invoices, payment history, tax-relevant records) for up to 7 years to comply with Canadian tax code and accounting obligations.
4. Cookies
   • Cookies are retained for varying periods depending on their purpose (session vs. long-lived), generally from a single session up to around 13 months.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of certain information, subject to legal and technical constraints;
• Object to or restrict certain processing;
• Request a copy of your data in a portable format.

To exercise any of these rights, contact us at contact@nova-cloud.ai. We may need to verify your identity before responding. Some requests may be limited or denied where we are required or permitted by law to retain information (for example, financial records needed for tax compliance).

If you are located in the European Economic Area or another region with similar rights, you may also have the right to lodge a complaint with a supervisory authority.

9. Security

We use reasonable technical and organizational measures designed to protect your information and Customer Content, including:

• Access controls and authentication;
• Segregated infrastructure for customer workloads;
• Logging and monitoring for unusual activity.

However, no method of transmission or storage is completely secure. You are responsible for:

• Securing your account credentials and SSH keys;
• Configuring your VMs, firewalls, and applications securely;
• Maintaining your own backup copies of any critical data.

10. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us, and we will take steps to delete such information where required.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and may provide additional notice (for example, via the console or email). Your continued use of the Services after changes are effective indicates your acceptance of the updated Policy.

12. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy, please contact: