Privacy Policy

1. Information we collect

• Account data — name, email, and password when you register or sign in (including via “Sign in with Google”).
• Order & shipping data — the products you buy, shipping address, and contact details. Guests provide this at checkout without creating an account.
• Payment data — card payments are processed by Stripe. We never see or store full card numbers; we only receive a confirmation and limited billing details.
• Usage & device data — pages visited, referring links, approximate location, browser and device type, collected via cookies and analytics (see our Cookie Policy).
• Support messages — anything you send us or type into the shopping assistant.

2. How we use your data

• Process and deliver orders, and send order confirmations.
• Provide, secure, and improve the store and your account.
• Respond to support requests and power the shopping assistant.
• Detect fraud, debug errors, and keep the service reliable.
• Send service messages and, where permitted, marketing you can opt out of at any time.

3. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf, including:

• Stripe — payment processing.
• Google — sign-in (OAuth) and analytics (Analytics / Tag Manager).
• Email provider — transactional emails such as order confirmations.
• Error & performance monitoring — diagnostic data to help us fix problems.

We may also disclose data when required by law or to protect our rights and users.

4. Legal bases

Where the GDPR applies, we process data to perform our contract with you (orders and accounts), for our legitimate interests (security and improvement), to meet legal obligations, and with your consent (for non-essential cookies and marketing).

5. Data retention

We keep personal data for as long as your account is active or as needed to provide the service, then for the period required to meet legal, tax, and accounting obligations, after which it is deleted or anonymised.

6. Your rights

Depending on where you live (e.g. under the GDPR or CCPA), you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below.

7. Security & international transfers

We use encryption in transit and access controls to protect your data. Some providers may process data outside your country; where required we rely on appropriate safeguards for those transfers.

8. Children

NOVA is not directed to children under 16, and we do not knowingly collect their personal data.

9. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new “Last updated” date.

10. Contact us

Questions about privacy? Email privacy@novashop.com.