Privacy Policy

The short version

• Who we are. Nova Bookings LLC is a Pennsylvania company. We run the novabooking.online website, the Nova Command Center app, and the websites we build for the businesses that use Nova.
• Two roles. For our own visitors and customers, we decide how data is used (we are the "controller"). For the customers of the businesses that use Nova, the business is in charge and we handle the data only to run the service for it (we are its "processor" or "service provider").
• What we collect. Contact details (name, email, phone), bookings, chat messages, and account details. We also briefly use your IP address to stop abuse (rate limiting).
• AI chat. When AI chat is turned on, recent chat messages are sent to Google (Gemini API, free tier) to write replies. Google may use them to improve its products, and Google staff may review them. AI replies can be wrong.
• Email only for customer communications. Nova does not send text messages or use analytics tools today. We will update this policy before adding either.
• Payments. Businesses that subscribe to Nova pay through Stripe. Stripe handles card details; Nova does not receive or store full card numbers or security codes.
• Who helps us. Vercel (hosting), Neon (database), IONOS (email), Stripe (billing), and Google (Gemini API) only when AI chat is enabled.
• No selling. We don't sell personal information or share it for targeted advertising.
• Your choices. You can ask to see, fix, or delete your data. Email contact@novabooking.online. If you're a customer of a business that uses Nova, contact that business first.

1. Who we are

Nova Bookings LLC, a Pennsylvania limited liability company ("Nova Bookings," "we," "us," or "our"), operates:

• the marketing website at novabooking.online;
• the Nova Command Center application at commandnova.online ("Command Center"); and
• websites that we build and host for the service businesses that subscribe to Nova ("Client Websites"), including their chat, booking, and contact features.

Together these are the "Services." This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have.

2. Our two roles: controller and service provider

When we are the controller. We decide how personal information is used, and this policy fully applies, for:

• visitors to novabooking.online, including people who use its chat or booking/demo form;
• people who contact us, request a demo, or become our customers; and
• the business owners and team members who have Command Center or other Nova accounts ("Account Users").

When we are a processor / service provider. Businesses that subscribe to Nova ("Business Customers") use the Services to manage their own leads and clients. Information about those people ("End Customers"), such as the leads, bookings, chat messages, names, email addresses, and phone numbers that arrive from a Business Customer's website or are entered in Command Center, is processed by us on behalf of and under the instructions of that Business Customer. The Business Customer is the controller (or "business," under California law) for that data, and its own privacy notice governs it. We use End Customer data only to provide the Services to that Business Customer, as described in our Terms & Conditions.

If you are an End Customer, please see Section 11.4.

Note: novabooking.online is itself connected to a Command Center account operated by Nova Bookings. Chats and bookings from our own website are stored there, and for that data we are the controller.

3. Information we collect

3.1 Information you give us

• Contact, demo, and booking requests (novabooking.online): name, email address, phone number, the service you're interested in, your preferred time, and any message you write.
• Chat (novabooking.online and Client Websites): the name you give (the chat asks for it first), your messages, and any contact details you choose to share.
• Account information (Command Center): your name, email address, password (stored in a protected, hashed form), business name, business details (such as industry, timezone, and reminder settings), and your team role (Owner, Admin, or Staff). When an Owner or Admin invites a team member, we receive that person's name, email address, and role from the person inviting them.
• Communications with us: the content of emails and support requests you send us.
• Billing information for Nova's business customers: billing contact name and email, business name, billing address, tax ID or exemption details if provided, the Plan and term purchased, invoices, and payment history. Card or bank details are entered directly into forms hosted or provided by Stripe. Nova does not receive or store full card numbers or security codes. Stripe shares limited details with us, such as card brand, last four digits, expiration date, and payment status, so we can manage your subscription.

3.2 End Customer data we process for Business Customers

Each Business Customer's website sends information to that business's own Command Center account through a website connection key issued by Nova for that site. That information can include End Customers' names, email addresses, phone numbers, booking details (service, date and time, status), chat messages, lead source, and notes. Business Customers and their team members can also enter or edit this information in Command Center.

Health and other sensitive information. Nova is built for booking and client communication, not for medical or other sensitive records. Please don't submit health or medical details (such as symptoms, diagnoses, medications, treatment history, or insurance information), government ID numbers, or payment card numbers in chat, booking notes, or forms. Nova is not offered as a HIPAA-compliant service, and we do not currently sign Business Associate Agreements. Some details can still reveal something sensitive. For example, the name of a booked service may suggest a cosmetic or dental treatment. We handle that information only to provide the booking and related messages for the business, as described in this policy. We don't sell it, we don't use it for advertising, and we don't use it to infer anything about you. If you have entered sensitive information by mistake, contact the business you booked with or email contact@novabooking.online, and we'll help delete it.

3.3 Information collected automatically

• IP address for abuse prevention. When a website sends a request to our systems (for example a chat message or booking), we use the visitor's IP address to apply per-visitor rate limits that protect the Services from spam and abuse. Our rate limiter holds this in short-lived memory, not in our database.
• Server logs. Like most websites, our hosting provider records standard request logs (such as IP address, date and time, requested page, browser type, and response status) for security and troubleshooting. These are kept for a limited period set by the provider's log settings.
• Records of automated messages. When Command Center sends an automated email, we keep a record of what was sent, when, to which address, and whether it succeeded, so the business can see its message history and so we can prevent duplicates.

We do not currently use analytics, advertising, tracking pixels, or session-recording tools on novabooking.online, Command Center, or Client Websites. If we add any, we'll update this policy first and ask for consent where the law requires.

3.4 Information we do not currently collect

• Full payment card numbers. Subscription payments are processed by Stripe. Nova never stores full card numbers or security codes. Nova does not take payments from End Customers on behalf of Business Customers. We will update this policy before we offer that feature.
• Text messages (SMS). We don't send or receive text messages today. Phone numbers are collected so the business can contact you, not for automated texts. Before we add SMS, we'll update this policy and collect any consent the law requires.

4. How we use information

As controller, we use the information we collect to:

• provide, operate, secure, and maintain the Services;
• create and manage accounts, sign you in, and keep each business's data separate;
• respond to demo requests, bookings, chats, and support messages;
• send service messages about your account (for example, sign-in, security, or changes to the Services);
• send you information about Nova Bookings if you're a customer or asked for it, with an unsubscribe option in every marketing email;
• prevent spam, fraud, and abuse (including rate limiting);
• understand and fix problems and improve the Services; and
• comply with the law and enforce our Terms.

As controller, we also use the information we collect to:

• bill for subscriptions, process payments and refunds, send receipts, renewal reminders, and failed-payment notices, and handle payment disputes; and
• calculate and collect applicable taxes and keep tax and accounting records.

As processor / service provider, we use End Customer data only to provide the Services to the relevant Business Customer. This includes storing it in that business's account, showing it to that business's authorized team, sending the automated emails that business has turned on (Section 6), drafting chat replies (Section 5), securing the Services, and meeting legal obligations. We do not use one business's End Customer data for another business, and we don't sell it or use it for our own marketing.

5. AI chat

Chat on novabooking.online and on Client Websites can suggest or send replies using a mix of pre-written templates and, when AI chat is enabled, an AI model provided by Google, through the free tier of its Gemini API. When AI chat is enabled, we send Google only what it needs to write a reply: basic facts about the business (such as its name, industry, and services) and the most recent messages in the conversation (currently up to the last ten). We remove email addresses and phone numbers typed into chat before sending, and we don't send your name, booking details, or lead notes. Visitors from the European Economic Area, Switzerland, and the United Kingdom receive pre-written replies only, and their chats are not sent to Google.

• Google receives this information to generate the reply. Because we use Google's unpaid Gemini API, Google's terms allow it to use these prompts and responses to provide, improve, and develop its products and machine learning technologies, and human reviewers may read them after Google disconnects them from our account. Google's own Privacy Policy governs that use. Please don't share personal, health, payment, or other sensitive details in chat. To reach the business without AI, use the booking or contact form.
• AI replies are generated automatically and may be inaccurate or incomplete. They are not professional, medical, legal, or financial advice. Please confirm important details, such as prices, availability, or appointment times, directly with the business.
• When AI chat is enabled, the chat is labeled so you know you are talking to an automated assistant, not a person, and links to this policy.
• We don't use AI chat to make decisions that have legal or similarly significant effects on you.

When AI chat is not enabled, replies come only from pre-written templates, and chat content is not sent to Google.

6. Automated emails

Command Center can send automated emails on a Business Customer's behalf to the End Customer contact details that the business has collected:

• a booking confirmation;
• reminders before the appointment (by default 24 hours and 2 hours before); and
• one follow-up inviting the End Customer to rebook after a cancellation or no-show.

We send these emails through our email provider, IONOS, using a Nova Bookings mailbox. They appear as coming from "Business name via Nova." If you reply, your reply currently reaches Nova Bookings's mailbox, and we pass it to the business.

If you don't want to receive these emails, contact the business or reply "unsubscribe", and we'll help the business stop them.

We don't send text messages today (Section 3.4).

7. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are used in California law.

We disclose personal information only:

• To our service providers (subprocessors), listed below, who process it for us under contractual terms that limit their use of the data to providing services to us, except that Google's use of AI chat content sent through its free Gemini API is governed by Google's own terms, as described in Section 5;
• Within a Business Customer's account: End Customer data is visible to the team members that business invites, based on the roles it assigns (Owner, Admin, Staff);
• To professional advisors such as lawyers and accountants, under confidentiality duties;
• When required by law or to protect the rights, safety, or property of Nova Bookings, our users, or others. Where the data belongs to a Business Customer and the law allows, we'll tell that business first; and
• In a business transfer (such as a merger, acquisition, financing, or sale of assets), subject to confidentiality protections and to this policy.

Subprocessors (current)

Stripe may use some payment information as an independent controller for purposes such as fraud prevention and meeting its legal obligations, under the Stripe Privacy Policy.

We'll update this list before adding a new subprocessor.

8. Features we don't offer yet

We currently do not offer or use: payments from End Customers to Business Customers through the Services, SMS or text messaging, or analytics or advertising tools. We will update this Privacy Policy before any of these features goes live, and we will ask for consent where the law requires it.

9. Retention and deletion

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it.

A Business Customer can ask us to delete specific End Customer records at any time, and we'll do so within 30 days.

10. Security

We use reasonable administrative, technical, and organizational safeguards, including:

• encryption in transit (HTTPS) across the Services;
• separation of each business's data by account, with access limited by role;
• a separate website connection key for each Business Customer's site, issued by Nova;
• hashed passwords; and
• secrets kept in our hosting environment, not in code.

No system is perfectly secure. If we learn of a security breach affecting your personal information, we'll notify affected people, Business Customers, and authorities as required by applicable law, including Pennsylvania's Breach of Personal Information Notification Act. Where the affected data belongs to a Business Customer, we'll notify that business without unreasonable delay so it can meet its own obligations.

Please use a strong, unique password and tell us promptly at contact@novabooking.online if you suspect unauthorized access to your account.

11. Your rights and choices

11.1 Everyone

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct inaccurate information;
• delete your information; and
• stop sending you marketing emails (you can also use the unsubscribe link in any marketing email).

Email contact@novabooking.online with your request. We'll need to verify your identity, usually by confirming control of the email address or phone number on file. We aim to respond within 30 days. We won't treat you differently for using your rights.

11.2 California residents

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to us, California residents have the right to know, access, correct, and delete their personal information, the right to opt out of its sale or sharing, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights. You can use an authorized agent.

In the past 12 months we collected these categories: identifiers (name, email, phone, IP address); customer records (business, booking, and billing details); commercial information (plans purchased and payment history); internet or network activity (request logs); and the content of chats and messages. We collected them from you, from your devices, and from the businesses that use Nova. We used them for the purposes in Section 4 and disclosed them only to the recipients in Section 7, including our payment processor for billing. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you.

11.3 People in the EEA, UK, or Switzerland

The Services are aimed at businesses in the United States. If the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing accounts and the Services), legitimate interests (security, abuse prevention, rate limiting, responding to inquiries, improving the Services), consent (where we ask for it, which you can withdraw), and legal obligation. You have the rights of access, rectification, erasure, restriction, portability, and objection, and you can complain to your local data protection authority. Your information is processed in the United States.

11.4 Customers of businesses that use Nova (End Customers)

If a business you booked with or chatted with uses Nova, that business controls your information. Please send your request to the business. If you contact us, we'll pass your request to the business and help it respond, as its service provider.

12. Children

The Services are for businesses and adults. They are not directed to children under 13, and we don't knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age). Business Customers may not use the Services to collect personal information from children under 13 without meeting the Children's Online Privacy Protection Act (COPPA) and other applicable law. If you believe a child has given us personal information, contact us and we'll delete it.

13. Cookies

We use only cookies that are strictly necessary for the Services to work. We don't use advertising or analytics cookies.

Because these cookies are strictly necessary, we don't show a cookie consent banner. You can block cookies in your browser, but Command Center sign-in won't work without them. If we add any non-essential cookies, we'll update this section first and ask for consent where required. We don't currently respond to Do Not Track signals because we don't track you across sites.

14. International users

We're based in the United States and our providers process data in the United States. If you use the Services from elsewhere, your information will be transferred to and processed in the United States, where data protection laws may differ from yours.

15. Changes to this policy

We may update this policy. We'll post the new version here with a new effective date. For material changes, including adding payments, SMS, analytics, or a new type of subprocessor, we'll post the update before the change takes effect and notify Account Users by email or in-product notice.

16. Governing law

This Privacy Policy is governed by the laws of the Commonwealth of Pennsylvania, USA, consistent with our Terms & Conditions, except where the privacy laws of your place of residence give you rights that can't be waived.

17. Contact us

Nova Bookings LLC (Pennsylvania)
Email: contact@novabooking.online