Legal

Privacy Policy

Last updated November 6, 2026. Draft for review by counsel before launch.

What we collect

• Account: your name, email and profile picture from Google sign-in.
• Conversations: text transcripts of your voice conversations with NOVA (not audio recordings), saved to your account so you can review and continue them.
• Memory (only if you turn it on): facts NOVA extracts from your conversations and a search index of your transcripts. Off by default.
• Billing: card payments are processed by Banco Cuscatlán (PayWay). To renew your subscription monthly we store your card details encrypted (AES-256-GCM) and only our billing job can decrypt them. We show you only the brand and last 4 digits. Deleting your account deletes the stored card.
• Your OpenAI key (optional): encrypted at rest with AES-256-GCM, used only to run your own voice sessions and text commands, never displayed again.
• NOVA Credits: your balance, a ledger of top-ups and charges, and a usage record for each AI request (time, type and amount charged; never the content). Card top-ups are processed by Banco Cuscatlán (PayWay) like your subscription.
• Free demo: to enforce the 5-minute limit we keep salted hashes of your IP address and browser signals, plus a signed cookie. Demo conversations aren't saved.

Google user data

When you sign in with Google, NOVA receives only your basic profile: name, email address and profile picture (the openid, email and profile scopes). We use it solely to create and identify your account and to show your name and picture in the app. We don't access your Gmail, Drive, contacts or any other Google data, we don't sell or share Google user data with third parties, and we don't use it for advertising or to train AI models. Deleting your account deletes this data. NOVA's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How it's used

To run NOVA for you: authenticate you, bill your subscription, continue past conversations, and (if enabled) let NOVA recall what you told her. We don't sell your data or use your conversations for advertising.

Processors

OpenAI processes live audio and text to generate NOVA's responses, embeddings and summaries. When you use NOVA Credits, requests run on NOVA's OpenAI account; when you use your own key, they run on your OpenAI account under OpenAI's terms. To bill accurately, our server stays connected to your live voice call and reads only the usage figures OpenAI reports, never the conversation. Banco Cuscatlán (PayWay) processes card payments. Google provides sign-in. Our database and hosting providers store the data above.

Isolation

Each account's conversations and memory are scoped to that account in the application and by database row-level security. NOVA's memory search can only see your own data.

Your controls

• View, delete or disable memory anytime at Dashboard → Memory.
• Delete any conversation from History.
• Export everything as JSON or delete your account from Account. Deleting your account removes your conversations, memory, key and settings and cancels your subscription.

Contact

Questions about your data, or requests to access or delete it: support@holoagent.io.