Nova AI Technologies ("we", "us", "Nova") operates the NovaBuildBot, NovaChat, and Nova Hub services (together, the "Service"). This policy describes what information we collect, how we use it, and your choices.
Who we are
Nova AI Technologies is a small business based in India. We provide an AI-powered marketing platform to small businesses (clinics, salons, restaurants, retailers, professional services). Contact us anytime at hello@novabuildbot.com.
Information we collect
We collect only what we need to deliver the Service.
- Account information: your name, business name, business type, phone, email, address, services offered. You provide these when you sign up via Telegram.
- Telegram identity: your Telegram user ID and username, which we use to authenticate you when you message our bot.
- Business content: the text, photos, prices, hours, and other content you give us to publish on your website or social media.
- Social media access tokens: when you connect Instagram or Facebook, we receive long-lived access tokens issued by Meta. We use these only to post on your behalf, to read engagement on those posts, and to read content you've authorized.
- WhatsApp Business credentials: when you connect a WhatsApp Business number, we store the credentials needed to send and receive messages on your behalf.
- Conversations and bookings: messages between you and your customers handled by NovaChat, plus appointments booked through the platform.
- Site analytics: pageview, traffic source, and device data from Cloudflare for the website we host for you.
- Service logs: records of agent runs, AI tool calls, errors, and similar operational logs needed to run and debug the Service.
How we use your information
- To deliver the Service: build and update your website, post to your connected social accounts, manage WhatsApp conversations, generate marketing content.
- To run autonomous agents (e.g. the SEO Agent and Social Media Agent) that propose and, with your approval, apply changes on your behalf.
- To send you reports, summaries, and approval requests on Telegram.
- To improve and debug the Service.
- To bill for the Service and keep records as required by law.
We do not sell your information. We do not use your business or customer data to train any third-party AI model.
Third-party services we use
We rely on the following service providers to operate the platform. Each only receives the data necessary for its role.
- Anthropic (Claude API): processes prompts and generates content. Inputs and outputs may be retained per Anthropic's terms; Anthropic does not train models on API customer data by default.
- Meta (Facebook & Instagram Graph API): we send and read posts and Page data using tokens you authorize via Facebook Login. We request only these permissions:
pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights. We never request access we don't use.
- Meta WhatsApp Business Cloud API: sends and receives WhatsApp messages on your business number once you complete Embedded Signup.
- Cloudflare: hosts your website (Cloudflare Pages), provides web analytics, and routes traffic.
- GitHub: stores the source code of your website in a repository owned by NovaBuildBot.
- Telegram (Bot API): delivers messages between you and our bot.
- Railway: hosts our backend services and the database.
- Pexels: royalty-free stock images sourced for posts you approve.
How we protect your information
- All traffic is over HTTPS.
- Tokens and credentials are stored in our managed PostgreSQL database with restricted access.
- OAuth tokens (Meta, Google) are never displayed back to anyone after storage.
- The team has minimum necessary access to debug and operate the Service.
No service is perfectly secure. If we ever discover a breach affecting your data, we will notify you promptly.
Data retention
We keep your information for as long as your account is active. If you cancel the Service, we retain a minimum operational record (e.g. invoices) for legal compliance and delete the rest within 30 days unless you request earlier deletion.
Children's privacy
The Service is intended for businesses, not minors. We do not knowingly collect personal information from children under 18. If you believe a child has signed up, contact us and we'll delete the account.
International users
We operate from India and our database is hosted in regions chosen by Railway and Cloudflare. By using the Service you consent to your data being processed in these regions.
Changes to this policy
We may update this policy as the Service evolves. The "Last updated" date at the top reflects the most recent change. If a change materially affects your rights, we'll notify you via Telegram.