Privacy Policy

Nova & the Scope of This Document

Nova is a product of Inceptica LLC. Inceptica LLC is the service provider and legal contracting party; “Nova”, “we”, “us” and “our” refer to Inceptica LLC when describing the provider’s rights and obligations. Nova Brain is the company-context intelligence foundation used across AI Code Reviews, Developer Device Security and Compliance for SOC 2 and other frameworks. It is not a separate legal entity.

Nova Cloud provides workspace-level services and team visibility. Nova Endpoint provides developer-device and local development workflows. The data processed depends on the features used, the systems connected, the permissions granted and the customer’s configuration—not simply on an application or asset appearing in a product illustration.

Company Context & Connected Sources

When authorized by a customer, Nova processes relevant content and metadata from source repositories, cloud systems, company applications and developer devices. Sources may include GitHub, Google Workspace, Office 365, AWS, Azure, GCP, laptops, desktops, Google Drive and Slack. Connected knowledge can include documents, messages, policies, author information, timestamps and access metadata. Customers must have authority to connect these sources and provide appropriate notices to affected individuals.

Code, Devices & Compliance Data

AI Code Reviews may process code, diffs, file paths, commit and pull-request metadata, review comments, findings and suggested fixes. Developer Device Security may process device identifiers, operating-system and software information, configuration and posture signals, scan results and remediation records. Compliance workflows may process controls, policies, evidence, access records and audit activity. These materials can contain personal or confidential information.

Nova Brain & AI Processing

Nova Brain uses authorized company context to analyze relationships and generate findings, recommendations and evidence mappings. Relevant inputs and context may be processed by AI service providers acting for Inceptica. AI analysis to deliver a requested feature is distinct from training models. The DPA’s restrictions on unauthorized AI training and product improvement continue to apply. Customers should avoid submitting secrets or unnecessary sensitive personal information.

Workspace Visibility & Privacy Roles

When a device or development workflow is connected to a company workspace, associated findings and reports may be available to authorized workspace administrators and team members according to configured access. Inceptica generally acts as processor for customer-controlled content and as controller for its own account administration, billing, security and business communications. For customer-controlled personal data, contact the organization that manages the workspace; we assist that organization under the DPA.

Introduction

Inceptica LLC, provider of Nova ("Nova", "we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Nova Brain-powered platform for AI Code Reviews, Developer Device Security and Compliance and related services (collectively, the "Services"), visit our website at https://teamnova.ai (the "Site"), or interact with us.

This notice explains our information practices. Where consent is required for a particular activity, it is obtained separately; using the Services is not blanket consent to every form of processing.

1. Information We Collect

We collect information you provide directly, information collected automatically, and information from third-party sources.

1.1 Information You Provide

Account Information

Name, email address, phone number (optional)

Company name, job title, department

Billing information (processed by Stripe)

Password and account credentials

Service Data

Compliance framework selections and configurations

Security policies and controls documentation

Evidence and documentation you upload

Audit reports and assessments

Integration configurations and credentials

Support requests and communications

Profile Information

User preferences and settings

Team member information you add

Communication preferences

1.2 Information Collected Automatically

Usage Data

Features used and actions taken in the platform

Frequency and duration of use

Performance metrics and error reports

Search queries within the platform

Device and Technical Information

IP address and approximate location

Browser type and version

Operating system

Device identifiers

Cookies and similar technologies (see Section 5)

Integration Data When you connect third-party services, we collect:

Configuration metadata

Evidence required for compliance assessments

System logs and audit trails

Access and permission information

1.3 Information from Third Parties

Integration Partners

Data from connected services (GitHub, AWS, Azure, GCP, etc.)

Authentication information from identity providers

Employee data from HR systems you connect

Service Providers

Payment and billing information from Stripe

Analytics data from our analytics providers

Customer relationship data from support tools

Publicly Available Sources

Company information for verification

Public security advisories and compliance updates

2. How We Use Your Information

We use collected information to:

2.1 Provide and Maintain Services

Create and manage your account

Deliver Nova Brain-powered code reviews, developer device security and compliance services

Process transactions and billing

Provide customer support

Send service-related communications

2.2 Improve and Develop Services

Analyze usage patterns and trends

Develop new features and functionality

Fix bugs and improve performance

Conduct research and analytics

Create aggregated benchmarking data

2.3 Ensure Security and Compliance

Detect and prevent fraud, abuse, and security incidents

Monitor and enforce our Terms of Service

Comply with legal obligations

Protect rights and safety of users

2.4 Communications

Send transactional emails (receipts, alerts, updates)

Provide technical notices and security alerts

Deliver customer support

Send marketing communications (with your consent)

2.5 Legal and Business Purposes

Comply with applicable laws and regulations

Respond to legal requests and prevent harm

Protect our rights and property

Support business operations and transactions

3. How We Share Your Information

We do not sell or rent your personal information. We share information only as described below:

3.1 With Your Consent

When you explicitly agree to sharing

When you direct us to share with third parties

For testimonials or case studies (with permission)

3.2 Service Providers We share information with vendors who help us provide Services:

Cloud infrastructure (AWS)

Database services (MongoDB Atlas)

Payment processing (Stripe)

Email delivery services

Analytics providers

Customer support tools

All service providers are bound by contractual obligations to protect your information.

3.3 Integration Partners When you connect third-party services:

We exchange data necessary for the integration

Authentication tokens for continued access

Evidence and compliance data as you configure

3.4 Within Your Organization

With administrators on your account

With Users you designate

According to your configured permissions

3.5 For Legal Reasons

We may disclose information if required to:

Comply with laws, regulations, or legal requests

Protect safety, rights, or property

Detect, prevent, or address fraud or security issues

Enforce our Terms of Service

3.6 Business Transfers If we're involved in a merger, acquisition, or asset sale:

Your information may be transferred

We'll notify you before any transfer

The information remains protected under this Privacy Policy

3.7 Aggregated Information We may share aggregated, non-identifying information:

Industry benchmarks and reports

Usage statistics and trends

General compliance insights

4. Data Retention

We retain your information for as long as necessary to:

Provide Services during your subscription

Comply with legal and regulatory requirements

Resolve disputes and enforce agreements

Support legitimate business purposes

Specific Retention Periods:

Account information: Duration of account plus 30 days

Compliance evidence: As required by applicable frameworks (typically 3-7 years)

Audit logs: 12 months minimum

Support tickets: 24 months

Billing records: 7 years for tax purposes

Marketing data: Until you opt-out

After retention periods, we securely delete or anonymize your information.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

5.1 Types of Cookies

Essential Cookies

Required for platform functionality

Maintain security and authenticate users

Remember preferences and settings

Analytics Cookies

Understand how you use our Services

Measure performance and identify issues

Improve user experience

Marketing Cookies (with consent)

Remember your interests

Provide relevant advertisements

Measure marketing effectiveness

5.2 Managing Cookies

You can control cookies through:

Browser settings to block or delete cookies

Our cookie consent banner preferences

Email footer links for marketing preferences

Note: Disabling essential cookies may impact Service functionality.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your information:

6.1 Access and Portability

Request a copy of your personal information

Receive data in a structured, machine-readable format

Transfer data to another service provider

6.2 Correction and Update

Correct inaccurate information

Update or complete your information

Manage your account settings directly

6.3 Deletion and Restriction

Request deletion of your personal information

Restrict processing in certain circumstances

Object to specific processing activities

6.4 Consent Management

Withdraw consent where processing is based on consent

Opt-out of marketing communications

Manage cookie preferences

6.5 Additional Rights

California Residents (CCPA/CPRA): Right to know, delete, opt-out of sale (we don't sell data), and non- discrimination

EU/EEA Residents (GDPR): All rights under GDPR including data portability and right to object

Other Jurisdictions: Rights under applicable local privacy laws

To exercise your rights, contact privacy@teamnova.ai. We'll respond within 30 days (or as required by law).

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

7.1 Security Measures

Encryption at rest (AES-256) and in transit (TLS 1.2+)

Multi-factor authentication

Access controls and least privilege principles

Regular security assessments and penetration testing

Incident response procedures

Employee training and confidentiality agreements

7.2 Your Responsibilities

Maintain strong, unique passwords

Enable multi-factor authentication

Protect your account credentials

Promptly report security concerns

While we strive to protect your information, no method is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, particularly the United States where our primary infrastructure is located.

8.1 Transfer Mechanisms

We ensure appropriate safeguards through:

Standard Contractual Clauses (SCCs) for EU/EEA data

UK Transfer Addendum for UK data

Similar mechanisms for other jurisdictions

Contractual protections with all sub-processors

8.2 Your Consent

International transfers are subject to the applicable safeguards described above; use of the Services is not relied on as blanket consent to restricted transfers.

9. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect information from children. If we learn we've collected information from a child under 13, we will delete it promptly. Contact us if you believe we have information about a child.

10. Third-Party Links and Services

Our Services may contain links to third-party websites and services. We're not responsible for their privacy practices. We encourage you to review their privacy policies before providing information.

11. Marketing Communications

11.1 Opt-In/Opt-Out

We send marketing emails only with your consent

You can opt-out anytime via email footer links

Opt-out doesn't affect transactional communications

11.2 Do Not Track Our Services don't currently respond to Do Not Track signals. However, you can manage tracking through cookie preferences.

12. California Privacy Rights

12.1 CCPA/CPRA Rights

California residents have additional rights:

Right to Know: What personal information we collect, use, and share

Right to Delete: Request deletion of personal information

Right to Opt-Out: We don't sell personal information

Right to Non-Discrimination: Equal service regardless of privacy choices

Right to Correction: Correct inaccurate information

Right to Limit: Limit use of sensitive personal information

12.2 Categories of Information

Collected: Identifiers, commercial information, professional information, internet activity Sources: Directly from you, automatically, third parties Purposes: Service delivery, security, analytics, legal compliance Sharing: Service providers, with consent, legal requirements

To exercise rights, email privacy@teamnova.ai.

12.3 Shine the Light California residents may request information about disclosures to third parties for direct marketing (we don't make such disclosures).

13. European Privacy Rights

13.1 Legal Basis for Processing

We process personal data based on:

Contract: Necessary to provide Services

Legitimate Interests: Improve services, security, fraud prevention

Consent: Marketing communications, cookies

Legal Obligation: Compliance with laws

13.2 GDPR Rights EU/EEA residents have rights to:

Access, rectify, and erase personal data

Restrict or object to processing

Data portability

Lodge complaints with supervisory authorities

Withdraw consent

13.3 Data Protection Officer

Contact our DPO at privacy@teamnova.ai for privacy concerns.

14. Changes to Privacy Policy

We may update this Privacy Policy to reflect:

Changes in our practices

New features or services

Legal or regulatory requirements

We'll notify you of material changes via:

Email to your account email

Prominent notice in the Services

Updated "Last Updated" date

Where required, we will provide notice or obtain consent before applying material changes to our information practices.

15. Contact Information

For privacy questions, concerns, or to exercise your rights:

Data Protection Officer Inceptica LLC (Nova, an Inceptica product) 2389 Main St. STE 100 Glastonbury, CT 06033 Email: privacy@teamnova.ai Website: https://teamnova.ai

Response Time: We aim to respond within 30 days (or as required by law).

16. Jurisdiction-Specific Provisions

16.1 Nevada Residents

Nevada residents may opt-out of sale of covered information (we don't sell information).

16.2 Virginia Residents

Virginia Consumer Data Protection Act provides similar rights to CCPA.

16.3 Colorado Residents Colorado Privacy Act provides rights similar to GDPR and CCPA.

16.4 Connecticut Residents

Connecticut Data Privacy Act provides comprehensive privacy rights.

16.5 Other Jurisdictions We comply with applicable privacy laws in all jurisdictions where we operate.

17. Privacy Notice for Specific Data Types

17.1 Sensitive Personal Information

We limit collection of sensitive information to what's necessary for compliance frameworks (e.g., background check data for certain certifications). This data receives enhanced protections.

17.2 Employee Data When you connect HR systems, we process employee data solely for compliance purposes (access reviews, training records, etc.). Employees may exercise privacy rights through you or directly with us.

17.3 Audit Data

Information collected for audit purposes is retained per framework requirements and shared only with authorized auditors as you direct.

18. Accountability and Governance

18.1 Privacy by Design We incorporate privacy considerations into all stages of product development.

18.2 Privacy Impact Assessments

We conduct assessments for new processing activities that may impact privacy.

18.3 Vendor Management

We ensure all vendors meet our privacy standards through:

Contractual obligations

Security assessments

Regular reviews

18.4 Training Our employees receive regular privacy and security training.

19. Complaints and Recourse

If you have privacy concerns:

3. If unsatisfied, you may: File a complaint with your supervisory authority (EU/EEA)

Contact your state attorney general (US)

Pursue available legal remedies

20. Accessibility

This Privacy Policy is available in alternative formats upon request. Contact privacy@teamnova.ai for assistance.

Your privacy is important to us. This Privacy Policy is designed to be transparent about our practices while providing you with control over your information.