Privacy policy

This policy explains how Noviom Labs Limited uses personal information when you visit our website, contact us, become a client or use one of our digital services.

1. Who we are

Noviom Labs Limited is the controller responsible for the personal information described in this policy.

• Company number: 11618526
• Registered office: 4 Abbotts Close, Boxgrove, Chichester, England, PO18 0EL
• Privacy contact: [email protected]

2. Information we collect

Depending on how you deal with us, we may collect:

• your name, company, job title, email address and telephone number;
• enquiry details, project requirements, budgets, correspondence and meeting notes;
• account, authentication and support information if you use a client area;
• contract, invoice, payment-status and transaction information (payment-card details are handled by our payment provider rather than stored by us);
• technical information such as IP address, browser, device, referring page, security logs and cookie choices; and
• the name you use to start Novi, messages you enter into the AI assistant, and any contact details and project summary you choose to submit;
• marketing preferences and interaction information, where permitted.

We do not intentionally collect special-category information, criminal-offence information or information about children through this website. Do not enter passwords, payment-card details, health information or other sensitive information into Novi or an enquiry. Fields marked as required are needed to operate the requested chat or respond to an enquiry; if you do not provide them, we may be unable to do so.

3. How and why we use it

Where we rely on legitimate interests, we balance the benefit to our business and customers against your rights and reasonable expectations.

4. Where information comes from

Most information comes directly from you. We may also receive it from your employer or colleagues, public business sources, referral partners, service providers, advertising platforms or consented analytics tools.

5. Who we share information with

Recipients may include DigitalOcean and its infrastructure partners for hosting; OpenAI for Novi responses; Google for reCAPTCHA abuse prevention; Resend or another configured email provider for enquiry notifications; Stripe for payments; professional advisers; contractors working under appropriate obligations; consented analytics or advertising providers; and regulators, courts or law-enforcement bodies where required. We do not sell personal information.

When a supplier processes information for us, we require suitable contractual, confidentiality and security protections. Some suppliers may also act as an independent controller for their own regulated purposes.

Novi and artificial intelligence

Novi is an AI assistant, not a person. When you send a chat message, the recent conversation text is sent through OpenAI's API so that a response can be generated. We set store: false. OpenAI states that API data is not used to train its models by default unless the customer opts in; however, OpenAI may retain prompts, responses and related metadata in abuse-monitoring logs for up to 30 days unless stricter data-retention controls apply. OpenAI may process this information outside the UK under the transfer safeguards described below.

Novi provides general information about Noviom Labs and may be inaccurate or incomplete. It does not make decisions with legal or similarly significant effects. A person reviews every enquiry before taking it forward. Conversation state is added to our CRM only when you explicitly submit an enquiry.

Google reCAPTCHA loads when you choose to open Novi and processes technical and interaction information to protect the service from automated abuse. Google acts under its own applicable privacy terms for that processing.

6. International transfers

Some suppliers may process information outside the UK. Where this happens, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, with supplementary safeguards where appropriate. Contact us for details relevant to your information.

7. How long we keep it

Our usual retention periods are:

• enquiries that do not become projects: up to 24 months after the last meaningful contact;
• client, contract and project records: for the engagement and normally up to 7 years afterwards;
• invoices and accounting records: normally 6 years after the relevant financial year;
• routine support correspondence: up to 24 months after resolution, unless part of a client record;
• routine security and server logs: normally up to 90 days, unless needed for an incident;
• unfinished Novi conversation state on our server: normally 30 minutes after the last active session;
• unfinished Novi conversation state in your browser: until the tab is closed, the enquiry is submitted or the browser storage is cleared;
• OpenAI API abuse-monitoring data: up to 30 days by default, unless stricter controls or a legal exception applies;
• marketing records: until you opt out, or after 24 months without meaningful engagement; and
• cookie choices: 6 months.

We may keep information longer for a dispute, legal hold or statutory obligation, and may delete or anonymise it earlier when no longer needed.

8. Your rights

Subject to applicable exemptions, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing or direct marketing; and withdraw consent without affecting earlier lawful use.

We do not make solely automated decisions with legal or similarly significant effects. Email [email protected] to exercise a right. We may verify your identity and usually respond within one month.

9. Complaints

Please contact us first. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Security, children and changes

We use proportionate technical and organisational safeguards, although no internet service is completely secure. Our services are aimed at businesses and not directed to children. We may update this policy when our services, suppliers or legal duties change; the date above identifies the current version.

11. Work we perform for clients

When we host, maintain or support a client's website or app, that client will usually be the controller for its end-user information and Noviom Labs will act as its processor under written instructions. The client's privacy notice applies to that processing. Our role, security responsibilities, subprocessors, assistance with rights requests and deletion or return of information should be set out in the relevant service agreement or data-processing terms.