Legal / last updated 7 November 2026
Privacy Policy
What we collect, why, where it is kept, who helps us process it, and how to have it removed. This covers our website, our customers (the businesses that subscribe), and the people who message those businesses.
Data controller for our website and our customer accounts: ATIELIT Bilişim ve Teknoloji Limited Şirketi, Çeliktepe Mah. İsmet İnönü Cad. Yıldırımlar İş Merkezi No: 11 İç Kapı No: 502, Kağıthane / İstanbul, Türkiye (MERSİS 0101125774400001).
Privacy contact: support@novusai.company
1. Two roles
- We are the controller of data about people who visit our website or contact us, and of the account data of the businesses that subscribe (the people who log in to the dashboard).
- We are a processor of the messages that a business's own customers send it through NovusAI. The business decides why those messages are processed; we process them only on its instructions, to provide the service, under a data processing agreement. If you messaged a business that uses NovusAI, that business is your first point of contact for your rights, and we will help it respond.
2. What we process
| Whose | What | Why |
|---|---|---|
| Website visitors | Your language choice, kept in your own browser. If you use the chat widget, a random visitor ID kept in your browser, and what you write. For each page opened and each main button pressed, a count: the page, its language, the site you came from, campaign tags in the link, and whether the screen is a phone, tablet or computer — without cookies, without any ID, and without storing your IP address or browser details, so a count cannot be traced to you. | To show the site in your language, to answer your enquiry, and to know how the site is used as a whole. We use no analytics or advertising cookies. |
| Prospective customers | Name, email, phone and what you tell us when you ask for a demo. | To reply and arrange the demo (legitimate interest; steps before a contract). |
| Customer accounts | Team members' names, email addresses, roles and sign-in records; business details; settings and knowledge base. | To provide the service under our contract. |
| Our customers' customers (as processor) | Phone number or channel ID, name if given, message content, voice notes and their transcripts, photos and documents sent and their extracted text, appointments booked, and the details the assistant records about the enquiry. | To answer the enquiry, route it to the business's team and keep its record, on the business's instructions. |
| Billing | Handled by Paddle, our Merchant of Record. We receive your name, email, country, plan and payment status — never your full card details. | To manage your subscription and meet tax and accounting obligations. |
| Operations | Logs of requests and errors, and the cost of each AI model call. | To keep the service secure and working and to bill transparently. |
We do not sell personal data, use it for advertising, or use conversations to train AI models.
3. Where it is kept
Our database (Supabase) and application servers (Google Cloud) are in Frankfurt, Germany, and conversation content and account data are stored there. Attachments (photos, voice notes and documents) are stored in Google Cloud Storage in Belgium, also in the EU. To perform a task, such as writing a reply or delivering a notification, some providers below process data outside the EU, under standard contractual clauses; the table says which, and where.
4. Who helps us process it
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud Storage, Cloud Tasks) and Firebase (hosting, sign-in) | Running the application, storing attachments, dashboard sign-in, hosting this website | EU: the application in Frankfurt, attachments in Belgium; Firebase sign-in is global |
| Supabase | Database | EU (Frankfurt) |
| Meta Platforms (WhatsApp, Instagram, Messenger) | Receiving and sending the business's messages on the channels it connects | Global, under Meta's own terms with the business |
| OpenRouter and the model hosts it routes to | Generating replies and reading photos and documents. Requests go only to an allowlist of hosts that do not keep prompts for training: DeepInfra, DigitalOcean, Together, Fireworks, Novita, Lambda, Hyperbolic, Groq, Cerebras, and the model makers OpenAI, Mistral, Google and Anthropic. No request goes to a host in China. | USA and EU |
| OpenAI | Generating replies, only if switched on for a business's account (off by default) | USA |
| Google (Gemini API) | Generating replies, only if switched on for a business's account (off by default) | USA / global |
| Mistral AI | Generating replies (fallback) and transcribing voice notes | EU (France) |
| Deepgram | Transcribing voice notes, through its EU endpoint | EU |
| Brevo (Sendinblue SAS) | Sending notification emails to the business's team | EU |
| Firebase Cloud Messaging (Google) | Notifications about conversations to the team's phones, if they install the app | Global |
| ClickUp | Support requests a business sends us from its dashboard | USA |
| Google Calendar / Apple iCloud | Only if a business connects a calendar: checking busy times and adding bookings | Global |
| Paddle | Payments, invoicing and tax, as Merchant of Record | UK / EU / USA |
5. How long we keep it
Account and conversation data are kept while the business's subscription is active. When a business cancels, we delete its account data within 90 days unless the law requires us to keep something longer (for example, billing records under Turkish tax law). A business can delete an individual customer's data at any time, and we act on deletion requests passed to us by a business within 30 days. Operational logs are kept for up to 30 days.
6. Security
Data is encrypted in transit and at rest. Each business's data is separated from every other's inside the database itself by row-level security policies, not only by application code. Access to production systems is limited to the people who run the service. Please do not send payment card numbers in a chat: if one arrives anyway, we replace it with its last four digits before it is stored or read by an AI model.
7. Storage in your browser (cookies)
This website and the chat widget set no cookies. They keep three small items in your browser's own storage, each needed for something you asked for, so no consent banner is shown. You can clear them at any time in your browser's settings.
| Name | Kind | What it does | How long |
|---|---|---|---|
novusai.lang | localStorage | Remembers the language you chose for this site | Until you clear it |
novusai:visitor_id | localStorage | A random ID that lets the chat widget show you your own conversation when you come back. It is not linked to you unless you tell us who you are in the chat | Until you clear it |
novusai:conv:demo:v1 | sessionStorage | Keeps the demo conversation on this site while the tab is open | Until you close the tab |
Page and button counts (section 2) use none of these, and no cookie, ID or fingerprint.
8. Talking to an AI
Replies sent through NovusAI are written by an AI assistant on the business's behalf. By default the first reply in a conversation says so, in the customer's language, and a person from the business can read every conversation and take it over at any time. The assistant answers questions, records the enquiry and can book appointments; it makes no decision that has legal or similarly significant effects on you on its own.
9. Your rights
Under the GDPR and Türkiye's Personal Data Protection Law No. 6698 (KVKK, Article 11), you can ask to know whether we process your data, get a copy, have it corrected or deleted, restrict or object to processing, and receive it in a portable format. Write to support@novusai.company; we answer free of charge within 30 days. If your request concerns messages you sent to a business that uses NovusAI, we will pass it to that business and help it respond.
You can also complain to a data protection authority: in the EU, the one where you live or work; in Türkiye, the Personal Data Protection Board (kvkk.gov.tr), within 30 days of our answer, or within 60 days of your request if you got none. Turkish readers will find the same information in our KVKK Aydınlatma Metni.
10. For businesses: our data processing agreement
When we process a business's customers' data, we do so under our Data Processing Agreement, which is part of our Terms of Service. The providers in section 4 are its sub-processors.
11. Changes
If we change this policy in a way that matters, we update the date above and tell our customers by email before the change takes effect.