Privacy Policy

Last updated: June 4, 2026

Nova Enterprises operates NovaNexus and related services (the "Platform"). This policy explains what information we collect, how we use it, and your rights regarding that information. By using the Platform, you agree to this policy.

1. Information We Collect

• •Account information: email address, hashed password (never stored in plaintext), and organization name when you register.
• •Usage data: features you use, cards you generate, outcomes you log, and actions you take. This powers the calibration and learning systems.
• •Financial data: if you connect a broker account (e.g., Alpaca), we store encrypted API credentials. We do not store balances or execute trades without your explicit action.
• •Payment data: processed by Stripe. We do not store credit card numbers. We receive payment confirmation and your subscription tier.
• •Communication data: if you contact us by email, we retain that correspondence.
• •Device and access data: IP addresses, browser type, and timestamps for security and fraud prevention.

2. How We Use Your Information

• •To provide, operate, and improve the Platform.
• •To generate personalized Decision Cards and calibrate recommendations from your logged outcomes.
• •To send transactional emails: account confirmations, receipts, and alerts you have opted into.
• •To detect and prevent fraud, abuse, and unauthorized access.
• •To comply with applicable laws and respond to legal requests.
• •We do not sell your personal information to third parties.
• •We do not use your data to train AI models sold to other companies.

3. Data Retention

• •Your account data is retained as long as your account is active.
• •If you delete your account, personal information is removed within 30 days. Aggregated, anonymized data may be retained.
• •Outcome and decision data is stored to calibrate your personal recommendations. You may request deletion at any time.

4. Third-Party Services

• •Stripe: payment processing. Stripe's privacy policy governs data handled during payment.
• •Resend: email delivery infrastructure.
• •Railway and Vercel: cloud hosting and infrastructure.
• •Alpaca Markets: optional broker integration. Your Alpaca account is subject to Alpaca's own terms.
• •Google Gemini / Groq: AI card generation. Situation descriptions you enter are sent to generate responses. We do not retain prompts beyond the active request.

5. Cookies and Local Storage

• •We use browser local storage to maintain your login session and store some tool data locally (e.g., income tracker sessions).
• •We use minimal cookies for authentication only. We do not use advertising cookies or third-party tracking.

6. Security

• •All data is transmitted over HTTPS.
• •Passwords are hashed using bcrypt and never stored in plaintext.
• •Broker API keys are encrypted at rest.
• •The event log uses hash chaining to maintain audit integrity.
• •If you discover a security vulnerability, contact hello@novanexus-ai.com.

7. Your Rights

• •Access: request a copy of your personal data at any time.
• •Correction: update account information through the Settings page.
• •Deletion: request deletion of your account and associated data.
• •Portability: export your decision cards, outcomes, and journal entries using the built-in CSV export features.
• •To exercise any of these rights, email hello@novanexus-ai.com.

8. Children's Privacy

• •The Platform is not intended for individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, contact us immediately.

9. International Users

• •The Platform is operated from the United States. If you access it from outside the US, your data may be transferred to and processed in the United States.
• •We apply GDPR principles of data minimization, purpose limitation, and user rights to all users regardless of location.

10. Changes to This Policy

• •We may update this Privacy Policy. We will notify registered users of material changes by email. Continued use after changes constitutes acceptance of the updated policy.