Privacy Policy
Last updated: 25 September 2026 · Version 2.0
This Privacy Policy explains how Nova Data Analytics (NDA) ("Nova", "we", "us") collects and uses personal data when you visit novadata.io, use the Nova application at app.novadata.io or the Nova MCP Connector, contact us, or when we contact you as a business prospect. It also explains your rights and how to exercise them.
Nova's services are designed for businesses. Most of the data we process is business data about Amazon selling activity. This policy covers the personal data involved, such as the names and contact details of the people who use Nova or whom we contact.
1. Who we are
The controller is Nova Data Analytics (NDA), SAS, RCS Lyon 978 950 350, 21 Chemin du Lavoir, 69570 Dardilly, France.
For any question about your personal data: [email protected] or +33 6 71 03 48 97.
When our customers use Nova to analyse their own Amazon accounts, Nova processes the personal data contained in that data on their behalf, as a processor, under our Data Processing Agreement. In that case, the customer is the controller and you should contact the customer first.
2. Summary
- We collect account, billing, usage and support data to provide Nova, and Amazon business data that customers choose to connect.
- From Amazon buyers, we only keep the country of delivery of each order: no names, emails or addresses.
- We do not sell personal data.
- Analytics, advertising and visitor identification cookies are used on our website only with your consent.
- We contact businesses about Nova by email and LinkedIn based on our legitimate interest, and you can object at any time.
- You can access, correct, delete or export your data, and object to marketing, by writing to [email protected].
3. Data we collect
3.1 Data you give us
- Account data: name, business email, password (stored in hashed form) or, if you sign in with Google, the email address of your Google account, company name, role, team invitations and settings.
- Billing data: billing name and address, VAT number, invoices and payment status. Payment card details are collected and stored by Stripe, not by Nova.
- Customer inputs: data you enter in Nova, such as cost of goods, VAT settings, fulfilment costs, product tags, stock parameters and supplier orders. This is mainly business data.
- Communications: messages you send us by email, in-app chat or other channels, call notes, meeting bookings, feedback, feature suggestions and roadmap votes.
- Website forms: data you enter to book a demo, join a waitlist, use a free tool that asks for your email, apply to our partner or affiliate programmes, or refer someone.
- Referrals: when you refer someone, the first name and email address you give us for that person.
3.2 Data we collect automatically
- Usage data in the App: pages and features used, actions performed, session information, device and browser type, IP address, campaign or partner that brought you to Nova, and error reports. We collect it with Google Analytics 4, Mixpanel, Intercom and Sentry, described in our Cookie Policy.
- Session recordings in the App: with your consent, recordings of your screens and interactions in the App, which may show the data displayed on screen, used to understand and fix usability problems.
- Nova MCP Connector usage: the tools called, their parameters, the short description of the request that your AI assistant may send with each call, the accounts queried, errors and timing, linked to your user and organisation. We do not receive the full conversation you have with your AI assistant.
- Account Actions logs: when available, the actions performed on connected Amazon accounts, the user or token that performed them and Amazon's response.
- Website data: pages visited, referring site, campaign parameters and interactions, collected through cookies and similar technologies as described in our Cookie Policy.
3.3 Data from third parties
- Amazon: when a customer connects an Amazon account, we receive the data of that account through Amazon's APIs: seller account identifiers and store names, marketplaces, orders and order items, sales and traffic figures, fees, settlements and other financial events, advertising data (campaigns, targeting, search terms and advertising invoices), Search Query Performance data, inventory, inbound shipments, removals, storage fees, returns, listings and listing issues, catalogue data and Best Sellers Rank, and offers. This is business data. It can include personal data when the seller is an individual or a sole trader. The only buyer information we keep is the country of delivery of each order. We do not keep buyers' names, email addresses, phone numbers, addresses or other details.
- Google: if you sign up with Google, your name, email address and profile identifier.
- Our partners and affiliates: the fact that you arrived through their link.
- Public and professional sources, for prospecting: professional contact details and company information (name, job title, company, business email, LinkedIn profile, company website, public information about the company's Amazon store) obtained from public sources such as LinkedIn and Amazon storefronts, and from B2B data providers.
- Visitor identification: the name and characteristics of the company associated with the IP address of a Website visitor, provided by lemlist, if you have accepted this category of cookies.
4. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account, provide the App, the Nova MCP Connector and their features | Account data, customer inputs, Amazon data, usage data | Performance of the contract |
| Calculate Fees, including Fees based on the volumes of connected Amazon accounts, invoice, collect payments and manage disputes | Billing data, Amazon order and sales volumes | Performance of the contract, and our legal obligations for accounting and tax |
| Provide customer support, including checking your data to answer a question | Account data, communications, usage data, Amazon data | Performance of the contract |
| Answer support requests with the help of AI: our chat may first reply through an AI agent identified as such, and replies drafted by our team with AI tools are reviewed by a person before they are sent | Communications, account data | Legitimate interest in answering quickly and accurately |
| Secure the services, prevent fraud and trial abuse, enforce our Terms, keep logs of MCP calls and Account Actions | Account data, usage data, logs, IP address | Legitimate interest in protecting Nova and its customers, and performance of the contract |
| Measure the use of features from our servers to improve Nova | Usage data | Legitimate interest in improving our product |
| Use analytics cookies and session recordings in the App | Usage data, session recordings | Your consent |
| Produce aggregated and anonymised statistics and benchmarks | Amazon data, usage data, which are anonymised first | Legitimate interest |
| Send service information (onboarding, trial reminders, billing, changes to our terms) | Account data | Performance of the contract |
| Send product news and offers to customers and trial users | Account data, usage data to choose relevant messages | Legitimate interest for professional contacts, with an unsubscribe link in every email |
| Contact businesses that may be interested in Nova (prospecting by email, LinkedIn or phone) | Professional contact and company data | Legitimate interest in developing our business, with a right to object at any time |
| Measure our website audience and our advertising, identify visiting companies | Cookie and website data | Your consent |
| Show our ads to people similar to our customers, or exclude existing customers, using hashed email lists on advertising platforms | Email address, in hashed form | Legitimate interest, with a right to object at any time |
| Invite customers to leave a review on third-party review sites | Account data | Legitimate interest |
| Send one invitation to a person you referred | Referral data | Legitimate interest of the referrer and of Nova |
| Manage partner and affiliate programmes, including commission payments | Application data, payment details | Performance of the contract |
| Comply with legal obligations and respond to authorities | Any relevant data | Legal obligation |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interest |
Volume-based pricing. Where our Fees depend on the order and sales volumes of connected Amazon accounts, they are calculated automatically, as set out in our Terms. This calculation relates to business activity and can be checked by a person on request at [email protected]. We do not make decisions based solely on automated processing that produce legal effects concerning you, within the meaning of Article 22 GDPR.
5. Amazon data
We use data obtained from Amazon only to provide our services to the customer who connected the account, in line with Amazon's data protection and acceptable use policies. We do not request access to Amazon's restricted buyer data, such as buyers' names, email addresses, phone numbers or addresses, and the only buyer information we keep is the country of delivery of each order. We do not use Amazon data for our own marketing and we do not sell it. When a customer revokes Nova's access, we stop collecting data from that account.
6. AI assistants and the Nova MCP Connector
When you connect Nova to an AI assistant such as Claude, ChatGPT, Gemini or Cursor, the data returned by Nova is sent to that assistant at your request. The provider of the assistant processes it under your own agreement with it, and it is not a sub-processor of Nova. Check its settings on data retention and model training before connecting business data. We log MCP calls as described in Section 3.2 to operate, secure and support the connector.
7. Who receives your data
- Our team, on a need-to-know basis.
- Our service providers (sub-processors), who process data on our instructions for hosting, databases, email, payments, support chat, product analytics, error monitoring, AI assistance and marketing tools. The current list is available at novadata.io/subprocessors.
- Amazon, when you perform Account Actions or when we retrieve your data through Amazon's APIs.
- Advertising platforms (Google, Meta), for the purposes and on the conditions described in Section 4 and in our Cookie Policy.
- Your organisation: the users of your organisation and, for agencies, the client representatives invited by the agency can see the data of the accounts they have access to.
- Partners and affiliates: an affiliate may be told that a customer it referred has subscribed, and the amount on which its commission is based, but not the customer's data in Nova.
- Professional advisers, auditors and authorities, when required by law or to defend our rights.
- A buyer or successor, in the event of a merger, acquisition or sale of all or part of our business, subject to confidentiality.
We do not sell personal data.
8. International transfers
Nova is hosted in France, by Scaleway in the Paris region. Some of our providers are located, or may access data, outside the European Economic Area, in particular in the United States: this is the case of Stripe, Slack, Sentry, WorkOS, Intercom and Google. These transfers rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), with additional safeguards where needed. The safeguard used for each provider is shown on our Subprocessors page. You can ask us for more information at [email protected].
9. How long we keep data
| Data | Retention period |
|---|---|
| Account data and customer inputs | For the duration of the account, then up to 60 days after the end of the subscription or trial to allow reactivation or export, then deleted |
| Amazon data of an account that does not subscribe after its trial | Up to 30 days after the end of the trial, then deleted |
| Amazon data of a subscribed account | For the duration of the subscription, then up to 60 days, then deleted |
| Invoices and accounting records | 10 years, as required by the French Commercial Code |
| Support conversations | For the duration of the account and 3 years after the last contact |
| MCP call logs and Account Actions logs | 12 months, or longer when needed for a dispute or a security investigation |
| Security and technical logs | 12 months |
| Prospect data | 3 years from our last contact with you, or until you object |
| Customer data used for marketing | 3 years after the end of the customer relationship, or until you object |
| Referral invitation data | 12 months if the person does not sign up |
| Cookie consent choice | 6 months |
| Cookies and similar technologies | As indicated in the Cookie Policy, 13 months maximum |
| Data needed for a legal claim | Until the end of the applicable limitation period |
Backups are overwritten on their normal cycle. Anonymised statistics may be kept without limit because they no longer identify anyone.
10. Security
We take technical and organisational measures appropriate to the risks, including: encryption of data in transit; encryption at rest of the application database; an analytics warehouse on dedicated servers in France; passwords stored in hashed form; email verification and limits on login attempts; connection to Amazon through Amazon's own authorisation flows, so that we never receive your Amazon password; hashed and revocable access tokens for the Nova MCP Connector; logging of MCP calls; regular backups; and access to production data limited to authorised team members bound by confidentiality. No system is completely secure. If a personal data breach is likely to result in a high risk to your rights, we will inform you as required by law. To report a security issue, write to [email protected].
11. Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access your personal data and obtain a copy;
- correct inaccurate data;
- delete your data;
- restrict processing;
- object to processing based on our legitimate interest, and object at any time to marketing, prospecting and hashed email audiences;
- receive the data you provided in a structured, machine-readable format and have it transmitted to another provider;
- withdraw your consent at any time, for example through "Manage cookies" on our website;
- give instructions about the use of your data after your death.
To exercise your rights, write to [email protected]. We may ask you to prove your identity. We respond within 30 days. For complex or numerous requests, this period may be extended by two months, in which case we tell you why within the first 30 days. To stop marketing emails, you can also use the unsubscribe link in each email.
If your data is processed by Nova on behalf of a customer (for example if you work for an agency's client), we will forward your request to that customer.
You can lodge a complaint with the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the authority of the EU country where you live or work.
12. Children
Nova is intended for professionals. We do not knowingly collect data from persons under 18.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version. We will inform customers of material changes by email or in the App before they apply.
14. Contact
Nova Data Analytics (NDA), SAS, RCS Lyon 978 950 350, 21 Chemin du Lavoir, 69570 Dardilly, France
[email protected] · +33 6 71 03 48 97