Privacy Policy

We may collect the following categories of information:

Form submissions

Information you submit through forms on our site, such as our on-site quiz or contact form. This may include your name, email address, company details, and your answers about your business and operations.

Technical data

Limited technical information and aggregated usage statistics, collected via privacy-friendly analytics. No tracking or advertising cookies are used.

We process your personal data for the following purposes:

• To deliver and manage our services (audits, automation flows).
• To process subscriptions, payments, and invoicing.
• To communicate with you regarding updates, inquiries, or support.
• To improve our website, services, and user experience.
• To comply with legal and tax obligations.
• To improve services, perform quality assurance, and optimize internal systems using aggregated or anonymized usage data.

2.1 API service disclosure

Noventra AI integrates with various third-party APIs to provide automation services. Our use and transfer of information received from these APIs always adheres to the respective provider's terms.

• Google APIs. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Other services. For all other integrations, we adhere to the relevant provider's developer terms and data usage policies.

We only request the minimum permissions (scopes) necessary to execute your specific workflows. We do not store your credentials directly. They are managed through secure OAuth tokens on our encrypted instance, and we do not share this data with third parties for marketing or advertising purposes.

Internal human access to Google Workspace user data is prohibited. No Noventra AI personnel access Gmail, Drive, Calendar, or other Workspace content. Limited metadata review may occur only for security investigation, or with the user's explicit consent during technical support.

2.2 Google Workspace data handling

When users connect Google Workspace services (including Gmail, Google Drive, Google Sheets, Google Calendar, or Google Forms), Noventra AI processes data solely to execute user-configured automation workflows.

• Email content, including subject lines, message bodies, attachments, and conversation threads, is processed ephemerally and is never stored by Noventra AI.
• Email attachments are stored only within your own Google Drive when explicitly requested by the workflow. Noventra AI retains only a reference to the Drive file, and does not store attachment contents.
• Noventra AI does not store, reuse, or repurpose Google user data for analytics, advertising, profiling, or machine learning model training.
• Access to Google Workspace data is limited to the minimum scopes required for your enabled workflows, and occurs only while those workflows are active.
• You may revoke Google Workspace access at any time via your Google account security settings, or by disconnecting credentials. Revocation immediately prevents further access.

We rely on the following lawful bases under Article 6 GDPR:

Consent

When you subscribe to newsletters or marketing.

Contract

When processing your data to deliver services you request.

Legal obligation

For tax and accounting compliance.

Legitimate interests

For business operations and service improvement.

We may share your data with trusted third-party service providers who help us operate and deliver our services. These include:

• Hosting and infrastructure providers, to ensure secure and reliable operation of our systems.
• Business productivity and communication tools, for email, file storage, and collaboration.
• Customer relationship management platforms, to manage client interactions.
• Payment processors, to handle billing and subscriptions securely.
• Automation and AI service providers, including large language model platforms, used to process instructions, generate content, and operate automated workflows.

Primary data processing occurs on servers located within the European Union. Some subprocessors may process data outside the EU as described below.

Automated processing may be used to assist in service delivery and operational workflows. No decisions producing legal or similarly significant effects are made solely through automated means.

These providers act as subprocessors and process data only under our instructions, subject to GDPR-compliant agreements. We do not sell or rent your personal data.

Some subprocessors may process data outside the EU/EEA (for example, in the USA). In those cases, appropriate safeguards are applied, including Standard Contractual Clauses (SCCs) approved by the European Commission.

• Client service data: retained for the duration of the contract, plus up to 6 years to comply with legal, tax, and accounting obligations.
• Google Workspace communication content: not retained by Noventra AI, and excluded from these retention periods.
• Marketing data: retained until you unsubscribe or withdraw consent.
• Technical and cookie data: retained only for as long as necessary for aggregated analytics and system operation, in accordance with our Cookie Policy.

Under GDPR Articles 15 to 22, you have the right to:

• Access your personal data.
• Request correction of inaccurate data.
• Request deletion (the "right to be forgotten").
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Request data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Spanish Data Protection Authority (AEPD).

Requests can be made by contacting legal@noventra-ai.com. We respond to all verified requests within 30 days, in accordance with GDPR requirements.

This site uses only strictly necessary or privacy-friendly analytics tools that do not involve tracking or advertising cookies. No non-essential cookies are used at this time.

If non-essential cookies or tracking technologies are introduced in the future, a cookie consent mechanism will be implemented in accordance with applicable law. See our Cookie Policy for details.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, restricted access, and regular system monitoring.

Our services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Updates will be published on this page with a new "Last updated" date. Significant changes may also be highlighted on the homepage.

For residents of the United States, additional privacy rights may apply under state laws such as the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, and similar legislation. These rights may include:

• The right to know what categories of personal data we collect.
• The right to request access to or deletion of your personal data.
• The right to opt out of any sale of personal data. Noventra AI does not sell personal data.
• The right to non-discrimination for exercising these rights.

To exercise any of these rights, please contact us at legal@noventra-ai.com. We will verify and respond to your request in accordance with applicable U.S. law.

The data controller responsible for your personal data is:

Noventra AI, a sole proprietorship operated by Oliver Smith.
NIF: Y9119568J
Address: C. Maestra Ángeles Aspiazu 23, 29640 Fuengirola, Málaga, Spain
Email: legal@noventra-ai.com

For questions about this Privacy Policy, or to exercise your rights, please contact:

Noventra AI Legal
Email: legal@noventra-ai.com