Privacy policy

Note for review: Drafted to reflect our intended practice. Have counsel confirm it against actual data flows and subprocessors before relying on it.

1. Who we are

NOVALEAFAI PRIVATE LIMITED ("NovaleafAI", "we", "us") operates the website at novaleaf.ai and provides the NovaleafAI platform. For personal information collected through this website, we are the data controller. For personal information processed on behalf of our customers within the platform, we act as a data processor and the customer is the controller.

Registered office: Ghaziabad, Uttar Pradesh 201003, India. Contact: hello@novaleaf.ai.

2. Information we collect

Information you give us

• Contact and demo request forms: your name, work email, company, role, and the content of your message.
• Correspondence: emails and messages you send us, and our replies.
• Recruitment: anything you send when applying to work with us.

Information collected automatically

• Basic technical information from your visit — IP address, browser type, pages viewed, and referring page — used to keep the site working and understand aggregate usage.
• A single local preference for light or dark theme, stored in your browser and never transmitted to us.

Customer platform data

When a customer connects their systems to the platform, we process the personal information contained in that data — such as their end customers' contact details, orders, and conversation transcripts — solely to provide the service, under the terms of our agreement with that customer.

3. Why we use it

• To respond to your enquiry or arrange a demo, on the basis of taking steps at your request prior to entering a contract.
• To provide, maintain, and improve the platform, on the basis of our legitimate interests and our contracts with customers.
• To send occasional product updates where you have asked for them, on the basis of consent, which you can withdraw at any time.
• To meet legal, accounting, and reporting obligations.

4. Model providers and automated processing

The platform uses large language models to generate responses and analyse conversations. Where third-party model providers are used, we contract for terms that prevent your data being used to train their models, and prefer zero-retention or bounded-retention arrangements. A current list of subprocessors is available on request.

Automated agents may take actions on a customer's behalf within limits that customer configures. Customers are responsible for setting those limits and for the escalation paths to a human.

5. Sharing

We do not sell personal information. We share it only with:

• Service providers who host, secure, and support our infrastructure, under contract and limited to what they need.
• Model and communications providers required to deliver the service.
• Professional advisers, and authorities where we are legally required to do so.
• An acquirer, in the event of a sale or reorganisation of the business, subject to the same protections.

6. Where data is stored, and international transfers

Our primary storage and processing takes place in data centres located in India. Where a customer requires a different region, that is agreed in writing and configured for their deployment.

Some of our subprocessors — in particular model and communications providers — process data outside India. Where that happens we rely on contractual safeguards, including standard contractual clauses where the receiving jurisdiction requires them, and we limit transfers to what is necessary to deliver the service. A current list of subprocessors and their locations is available on request.

7. Retention

Enquiry and demo request data is kept for as long as needed to respond and for a reasonable period afterwards for our records. Platform data is retained according to the retention window agreed with each customer and deleted on termination, subject to legal requirements.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, or restrict processing of your personal information, to object to processing, to data portability, and to withdraw consent. To exercise any of these, email hello@novaleaf.ai. We will respond within the period required by applicable law.

If you are an end customer of one of our customers, your request is best directed to that company, since they control the data. We will assist them in responding.

You also have the right to complain to a data protection authority. In India that is the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023. If you are in the European Economic Area or the United Kingdom, you may complain to your local supervisory authority.

9. Security

We maintain technical and organisational measures appropriate to the risk, described in more detail in our security overview. No system is perfectly secure, and we will notify affected parties and authorities of a qualifying breach as required by law.

10. Cookies and local storage

This website sets no advertising cookies, no cross-site tracking cookies, and no analytics cookies. We do not currently run an analytics product, an advertising pixel, or a third-party chat widget on this site.

The only thing stored on your device is your light or dark theme preference, held in your browser's local storage. It never leaves your browser and is not sent to us.

Two third-party requests are made when you load a page: web fonts from Google Fonts, and — only when you submit a form — our form delivery provider. Neither sets a tracking cookie for us.

If this changes: Adding analytics, an ad pixel, or a chat widget means updating this section and, in the EEA and UK, adding a consent banner that blocks those scripts until the visitor agrees.

11. Changes

We will update this policy as the service changes and will revise the "last updated" date above. Material changes will be communicated to customers directly.

12. Contact

Questions about this policy: hello@novaleaf.ai, or write to us at Ghaziabad, Uttar Pradesh 201003, India.