Nova and your data
What Nova keeps, why, where, and how to erase it all. Written to be read.
This English version is a translation provided for convenience. In case of any discrepancy, the French version prevails. Read the French version.
- Without an account, everything stays in your browser.
- Your payment card never goes through Nova: payment is made with Stripe.
- No advertising, no reselling of data.
- The site’s audience measurement is anonymous and cookie-free.
- Your employer sees neither your questions nor your activity.
- You can export everything and delete everything, on your own, in one click.
Who is responsible
The data controller is Marceau Ruis, a sole proprietor under French law (entrepreneur individuel), publisher of Nova. Contact: hello@novaforwork.com.
If you use Nova without an account
Nova’s demo access requires no account. In that case, your profile (first name, job, tools), your progress, your stack, and your requests are saved in your browser only (“local storage”). Nothing is sent to Nova. Clearing the site’s data in your browser erases everything.
If you create an account
| Data | What it is used for |
|---|---|
| First name, email address | To recognize you and log you in. |
| Sign-in with Google (if you choose it) | To log you in without a password. Nova receives your email address and your first name from Google, nothing else. |
| Password | To log you in. It is never stored in plain text: only an encrypted fingerprint (a hash) is kept. |
| Answers given when you get started (job, tasks, tools, chosen plan) | To let you pick up where you left off, even on another device. |
| Job, tools, progress, stack | To suggest what is useful to you, and to restore your workspace on your other devices. |
| Company name, website, size, logo, budget, catalog | To run the company workspace, if you create one or join one. If a business owner enters their company’s website, Nova reads the home page of that site to suggest the company’s name and logo; nothing else from it is kept. |
| Email addresses of the people invited by a business owner | To send them the invitation, and to show the business owner who has joined the workspace. A withdrawn invitation is erased. |
| Subscription (plan, billing period, status, end date of the current period, discount if any) | To open your access, and to display “My subscription” and your invoices. |
| Complimentary access given by Nova, if any (end date) | To open your full access without a subscription, for the planned duration. |
| Tool requests (tool, reason, answer) | To pass the request on to the person who approves it, and to give you their answer. |
Legal basis: the performance of the service you request by creating an account. Nova collects no sensitive data and asks you not to enter any.
Payment
When you subscribe, you pay on a Stripe page. Stripe receives your email address, your name, your billing address, and your card details. Nova neither receives nor stores your card number: it keeps only the chosen plan, the status of the subscription, and the identifiers Stripe gives it to find the subscription again. Invoices are kept for as long as the law requires.
The emails Nova sends you
Nova sends few emails, and never advertising. There are two kinds.
- Service emails. The welcome email when your account is created, the link to choose a new password, the notice that your account signs in with Google, the confirmation of your subscription, of its cancellation, or of its resumption, the invitation sent at a business owner’s request, and the reply to the contact form. They are part of the service you request: they are always sent.
- Two reminders, at most. If you create an account without subscribing, Nova writes to you twice at most, about three days and then ten days later, to remind you what your demo access lets you do. Legal basis: Nova’s legitimate interest in presenting its service to a person who has just created an account. A person invited by their company does not receive them. Upcoming reminders are canceled as soon as you subscribe, join a team, or delete your account.
- Stopping the reminders. Each reminder carries a “Stop these reminders” link: without logging in, it opens a page where a button confirms it. Your email app may also offer to unsubscribe you in one step. The same setting is found in “My account,” under “Emails from Nova.” Service emails continue to be sent.
- Who sends them. Resend (Resend, Inc., a U.S. company) sends Nova’s emails as a processor. Nova’s sending domain is set there to the Ireland region (European Union). Resend receives the recipient’s address and the content of the email. A scheduled reminder waits there for its date.
- What Nova keeps of them. The number of emails sent each day, so as not to exceed what its provider allows: a number, never an address.
Vendors’ videos
Some pages offer a vendor’s official video, hosted by YouTube. Nothing is loaded from YouTube until you click the video: no image, no cookie. When you click, the YouTube player (“privacy-enhanced mode”) loads, and Google then receives your IP address and technical information about your browser.
The site’s audience measurement
To know how many people visit the site and which pages are read, Nova itself counts the pages it serves. This measurement is anonymous and cookie-free: nothing is stored or loaded in your browser, and no tool from another provider is called.
- What is counted. A page of the site loaded by a browser. Bots recognized by their name (search engines, AI assistants, link previews) are not counted.
- A fingerprint for the day. To count a visitor only once per day, the service computes a fingerprint from your IP address and the name of your browser, mixed with a salt (a randomly drawn value) that changes every day and is destroyed the next day. The fingerprint therefore cannot be used to recognize you from one day to the next, and can no longer be recomputed. Fingerprints are destroyed after two days.
- No IP address kept. Your IP address is used for the computation, then is not stored.
- What remains: totals. The number of page views and of visitors per day, the most-read pages (the whole product counts as a single address), and the name of the site a visit comes from (“google.com,” never the full address; nothing for a return from payment or from sign-in). These totals are kept for thirteen months.
- No trackers. No cookie, no persistent identifier, no profile, no advertising. This measurement says nothing about what you do in Nova.
These counts are hosted by Cloudflare, in the European Union. They are viewed only by Nova’s publisher.
What your employer sees
In a company workspace, the person who administers it sees the list of members, the budget, the catalog, and the tool requests addressed to them. They see neither your questions to Nova, nor the pages you view, nor your progress. Nova is not a surveillance tool.
“Ask Nova”
When you ask Nova a question, your question, your job, and the list of your tools are sent to Anthropic (the maker of Claude) to write the answer. Anthropic states, in the terms of its offering for businesses, that it does not use these exchanges to train its models. Do not enter personal or confidential data in your questions: describe the task, not the case.
If the answering service cannot be reached, or if its budget for the month has been reached, the answer is composed in your browser, from Nova’s guides, without sending anything.
Where the data is, and who has access to it
- Cloudflare (hosting of the site and of the accounts). Its servers are spread around the world, including outside the European Union; transfers are governed by the European Commission’s standard contractual clauses. The audience measurement counts are kept in a database hosted in the European Union.
- Anthropic (answers from “Ask Nova”), in the United States, under the same framework.
- Stripe (payment of subscriptions and invoices), in Ireland and in the United States, under the same framework.
- Google, in two cases only: if you choose to sign in with Google, and if you play a video (YouTube).
- Resend (Resend, Inc., a U.S. company) sends Nova’s emails as a processor. Nova’s sending domain is set there to the Ireland region (European Union). See “The emails Nova sends you.”
No one else receives your data. It is not sold, rented, or used for advertising.
Cookies
Nova sets one session cookie, and only if you log in: it keeps your session open for thirty days. It is necessary for the service and is used for nothing else. During a sign-in with Google, a second cookie, which lasts ten minutes, protects the round trip. The Stripe payment page and the YouTube player, when you open them, may set their own cookies, on their own pages. There is no advertising cookie and no audience measurement cookie (the site’s measurement is cookie-free, see above): that is why no banner asks for your consent.
How long
Your data is kept for as long as your account exists. When you delete your account, it is erased, except for invoices, which the law requires to be kept. An invitation link or a verification link stops working once it has been used or has expired. The audience measurement totals, which do not relate to anyone in particular, are kept for thirteen months.
Your rights
You can view, correct, export, and delete your data at any time. In Nova: “My account,” then “Export my data” or “Delete my account.” You can also object to a processing operation or ask a question by writing to hello@novaforwork.com: we reply within one month.
If the answer does not satisfy you, you can lodge a complaint with the CNIL (the French data protection authority) (cnil.fr).
Security
Exchanges are encrypted (HTTPS). Passwords are protected by a key derivation function (PBKDF2). Sessions can be closed at any time from “My account.”
If this page changes
Any significant change will be indicated here, with its date, before it applies.
Last updated: October 5, 2026