This policy explains what personal data Nova collects, why it is used, who it may be shared with, how long it is kept and the choices available to you. It applies when you visit Nova, create an account, study, contact support or subscribe to Nova Plus.
Who controls your data
Zac Cameron-Webb trading as Nova is the data controller and service provider. Nova is a sole-trader business established in the United Kingdom and currently serves adults studying at UK universities in the United Kingdom.
For privacy, account or billing questions, email support@studynova.me.
Personal data Nova collects
- Account and identity data: your email address, password hash, verification status, sign-in and recovery records, and your Google OpenID identifier if you choose Google sign-in.
- Wishlist data: your email, any name, university and course you choose to provide, and confirmation, invitation and email-sending records. Nova uses these to manage the early-access place you request. Joining the Wishlist does not subscribe you to product updates.
- Study content: modules, lectures, authorised sources and uploaded files, extracted text, generated study materials, outlines, study notes, highlights, flashcards, practice questions, answers, chats, study sessions, evidence and academic history.
- AI and source data: prompts assembled from the relevant study context, model responses, citations, the provider route used, safety outcomes, and usage and quality records.
- Billing data: your plan and access status, Stripe customer, checkout and subscription references, payment status and billing-event records. Stripe collects your full payment-card details; Nova does not.
- Support data: the messages you send, case details, any time-limited content access you grant, and the resulting access history.
- Security and service data: session and CSRF data, IP addresses or privacy-minimised fingerprints, browser information, request and error metadata, feature activity and performance records needed to operate and protect Nova.
- Communication preferences: whether you opted in to product updates, when and where you made that choice, the wording shown to you and any later withdrawal.
- Conversion and analytics data: versioned journey steps, outcome codes, account activation and billing milestones, and a keyed first-party visitor fingerprint only after optional analytics consent. Nova excludes answers, source text, note content, generated study content and unrestricted URLs.
Nova receives this data from you, from Google when you choose identity-only sign-in, from Stripe for billing, from Resend for transactional-email delivery events and through operation of the service. Google sign-in does not request access to Google Drive, Google Calendar or unrelated Google data.
Why Nova uses your data
- To perform the contract with you: create and secure your account; store and process your study work; provide requested AI-assisted features; apply usage allowances; provide Nova Plus; and handle billing, cancellation and support.
- For Nova’s legitimate interests: keep the service reliable and secure, prevent fraud and abuse, diagnose failures, measure performance, improve safety and understand aggregate product use. Nova does not rely on legitimate interests for direct-marketing email.
- To meet legal obligations: keep and provide records where tax, accounting, consumer-protection, security or lawful-request duties apply.
- With your consent: send optional product updates and record first-party analytics about public landing, pricing, call-to-action and registration-start events. You can withdraw consent at any time without affecting processing that already took place lawfully.
Nova needs your account identity and the study data you choose to add to provide the service. Product updates and public-page analytics are optional and are not required to use Nova. Nova also records limited account events such as registration, verification, first use, allowance use and billing outcomes to operate the service and understand aggregate performance.
AI processing and automated decisions
Nova uses AI to extract and organise authorised sources, prepare source-grounded study material, explain content, provide feedback on attempts and recommend possible next moves. These outputs support your study; they do not determine a grade, admission, employment, credit decision or another legal right. Nova does not make solely automated decisions about you that have legal or similarly significant effects.
Nova sends only the study context needed for the feature you request to the configured provider. Production AI processing currently runs through Amazon Bedrock. Google Vertex AI, OpenRouter and Microsoft Azure OpenAI integrations are retained but are not active production routes unless separately reviewed and approved. Nova records the provider route used. Production controls require each active route’s region, retention, training and international-transfer arrangements to be reviewed and documented; provider training on Nova data is disabled.
Providers and recipients
- DigitalOcean: virtual-server hosting for the Nova web service and its locally managed PostgreSQL database and uploaded files.
- Amazon Web Services: Bedrock AI processing for production AI features.
- Google: identity-only OpenID Connect, Google Workspace for business email and retained Vertex AI infrastructure when separately selected for an AI feature.
- OpenRouter: routing to an AI model when selected for a feature.
- Microsoft Azure OpenAI: AI processing when selected for a feature.
- Stripe: hosted checkout, payments, subscriptions, invoices and the billing portal.
- Resend: transactional account-email delivery and metadata-only delivery events. Open and click tracking are disabled.
- Sentry, when error monitoring is enabled: content-free error types, application code locations, release identifiers and request timings. Nova excludes exception messages, frame variables, request bodies, account identifiers and academic content from these reports.
Nova may also disclose data where required by law, to protect students or the service, or as part of a business transfer subject to appropriate safeguards. Nova does not sell personal data.
International transfers
Some providers may process personal data outside the United Kingdom. Where this is a restricted transfer, Nova uses the relevant UK adequacy regulations or an appropriate safeguard, such as an International Data Transfer Agreement or UK Addendum. Email support@studynova.me to ask which provider handled a feature or for information about the applicable safeguard.
How long Nova keeps data
- Wishlist details remain until you leave the list, an owner removes the signup, or you delete the associated Nova account. Every wishlist email includes a link to remove your details and cancel unused invitations.
- Account identity, current preferences, and core study content are kept while your account is active, unless you delete specific content or your account. Study session briefs, questions, submitted answers, feedback and Evidence are core study content.
- Operational activity records, including chat-operation records, are scheduled for deletion after 365 days by default. That operational schedule does not delete Study questions, answers, feedback or Evidence.
- Failed source-processing job records are scheduled for deletion after 30 days by default. Source originals and their academic history remain until you explicitly delete the Source or account, including when processing fails.
- Temporary AI response copies used to recover a repeated request expire after 24 hours. Erasing the related source or conversation also removes these copies. Saved study conversations follow the core study-content rules above.
- Transactional-email delivery metadata is scheduled for deletion after 90 days. Temporary export archives expire after 24 hours; deleting account content invalidates existing archives containing it.
- Temporary support access expires after 1, 4 or 24 hours. Support-access audit records are scheduled for deletion after 365 days.
- Privacy-request audit records may be retained for up to seven years. Billing, tax, fraud-prevention and legal records may be retained for the period required to meet those obligations.
- Account deletion removes account-linked records and queues stored files for erasure, with retries if storage is unavailable, except limited audit, security or billing records that must be retained for compliance or legal claims.
Security and support access
Nova uses access controls, password hashing, secure session and CSRF protections, encrypted HTTPS connections, account-scoped data access and privacy-minimised security records. No internet service can guarantee absolute security. Email support@studynova.me if you believe your account or data may be at risk.
Support does not have unrestricted access to study content. You choose which content categories support may inspect for a stated purpose and no more than 24 hours. A permission covers the selected categories across your account. You can revoke access early and review actual access activity in Privacy & Data.
Your choices and rights
When signed in, you can export account data, manage temporary support access and delete your account in Privacy & Data. Depending on the circumstances, you may also have the right to access, correct or erase personal data; restrict or object to processing; and receive portable data.
Your export is prepared in the background as a ZIP archive with structured records, readable text, original files and a list of any files that could not be included. Downloading requires recent identity confirmation. Archives remain available for 24 hours, and you can request a new archive once every 24 hours.
You have the right to object to processing based on legitimate interests and to direct marketing. You can withdraw product-update consent in Settings or by using the unsubscribe option in a product-update email.
Email support@studynova.me to exercise a data-protection right. Nova may need to verify your identity and normally responds within one month, subject to any lawful extension.
Complaints and changes
Please contact Nova first so the issue can be investigated. You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.
Nova updates this policy when its processing changes. Where required, material changes will be brought to account holders’ attention before the new processing begins.