1. Overview
Nova Platform Inc. ("Nova", "we", "us") provides an AI-native restaurant operating system. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have regarding your data.
This policy applies to novatab.com, the Nova platform (including POS, KDS, mobile apps, online ordering, and AI features), and any related services provided by Nova.
2. Information we collect
From restaurant customers (Nova's direct customers)
- Account information (name, business name, email, phone, billing address)
- Payment information (processed by certified PCI-compliant processors)
- Operational data (orders, transactions, menu items, schedules, inventory, financial records)
- Device and usage data (device identifiers, IP addresses, browser type, pages viewed, actions taken)
- Communications with Nova (support tickets, sales conversations, feedback)
From restaurant guests (your customers)
- Identifiers (name, email, phone) if a guest chooses to share these with the restaurant
- Transaction history at restaurants using Nova
- Loyalty program activity
- Device identifiers when ordering via mobile or web
- Voice recordings when ordering through Voice AI (with disclosure and consent)
3. How we use it
We use the information we collect to:
- Provide, operate, and maintain the Nova platform
- Process transactions and payments
- Send you product updates, support communications, and (with consent) marketing materials
- Improve our services and develop new features
- Comply with legal obligations
- Detect and prevent fraud, security incidents, and abuse
4. How we share information
We do not sell personal data. We share information only as described below:
- Restaurant customers: Your operational data is yours. We process it on your behalf to provide the Nova platform.
- Service providers (sub-processors): Cloud infrastructure, payment processors, communication providers — under contract and only as necessary to provide our services. Current sub-processor list available on request.
- Legal requirements: When required by law, subpoena, or to protect our rights or the safety of others.
- Business transfers: In the event of a merger, acquisition, or asset sale, with notice to affected parties.
5. Restaurant guest data
Nova processes restaurant guest data on behalf of our restaurant customers. The restaurant is the data controller; Nova is the data processor. Restaurant customers determine:
- What guest data is collected
- How long guest data is retained
- Whether guest data contributes to shared AI models (opt-out available at the restaurant tenant level)
- Whether guests can request access, deletion, or portability of their data
Guests with questions about their data should contact the restaurant first. If unresolved, contact us at privacy@novatab.com.
6. AI & machine learning
Nova uses AI across the platform: Voice AI, Vision AI, Reporting AI, AI Marketing, and AI-driven upsell, among others. Our approach to data and AI:
- Customer-specific models (your menu, your guest history, your prep times) are trained only on your data and inaccessible to other Nova customers.
- Shared models may be informed by aggregated, anonymized signals across customers. PII and brand-identifying data are never used in shared models.
- Opt-out: Restaurant customers can opt out of shared model contributions at any time via account settings or by emailing privacy@novatab.com.
- Voice AI recordings are retained per the restaurant's configured retention policy. Guests are disclosed that Voice AI may handle their call.
For more on Nova's AI approach, see our Responsible AI principles.
7. Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict processing of your personal information. To exercise these rights:
- Restaurant customers: Contact your account manager or email privacy@novatab.com.
- Restaurant guests: Contact the restaurant first. Nova will support the restaurant in responding to your request.
- California residents (CCPA), EU/UK residents (GDPR), and other jurisdictions: Specific rights apply. Email privacy@novatab.com to exercise them.
8. Security
Nova maintains a comprehensive security program. Highlights:
- PCI DSS Level 1 certified
- EMV certified
- SOC 2 Type II in progress
- TLS 1.3 in transit, AES-256 at rest
- Quarterly third-party penetration testing
For details, see our security program overview.
9. Data retention
We retain information for as long as needed to provide the Nova platform, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods are governed by your MSA / DPA.
10. International transfers
Nova is headquartered in the United States. If you are located outside the US, your information may be transferred to and processed in the US. We use standard contractual clauses where required.
11. Children's data
Nova's platform is not directed to children under 13. We do not knowingly collect personal information from children. Restaurant customers using Nova should not collect children's data without parental consent and appropriate compliance with COPPA and similar laws.
12. Changes to this policy
We may update this policy from time to time. We will notify restaurant customers of material changes by email and post the updated policy here with a new "Last updated" date.
Privacy questions: privacy@novatab.com
Data Protection Officer: dpo@novatab.com
Mailing address: Nova Platform Inc., [SF address], San Francisco, CA