Privacy Policy
Last updated: 18 October 2026
This Privacy Policy explains how NOVA™ ("we", "us" or "our") collects, uses, shares and protects your information when you use the NOVA training platform at novaalliedtrainingllm.com (the "Service"). The data controller is NOVA™, contact will@novaalliedtrainingllm.com.
1. Information We Collect
1.1 Information You Provide
We collect information you provide directly to us, including:
- Account Information: Name, email address, organisation, job title, and password when you create an account
- Profile Information: Professional details, role, and preferences you add to your profile
- Content: Documents, data, and other content you upload for processing
- Communications: Information you provide when you contact us for support
1.2 Information Collected Automatically
When you use the Service, we automatically collect:
- Log Data: the server address requested, the time, the response status and how long it took; sign-in and account events with the IP address and browser type; and error reports sent by the page when something fails
- AI Usage: the number of AI requests made from your account, used to apply daily limits
- Cookies: See our Cookie Policy for details
1.3 Information from AI Processing
When you use our AI features, we process:
- Input prompts and queries you submit
- Documents and data you upload for analysis
- Generated outputs and your interactions with them
2. How We Use Your Information
We use the information we collect to:
| Purpose | Legal Basis |
|---|---|
| Provide and maintain the Service | Contract performance |
| Process your AI requests and generate outputs | Contract performance |
| Authenticate users and maintain security | Legitimate interests |
| Send service notifications and updates | Contract performance |
| Improve and develop the Service | Legitimate interests |
| Respond to support requests | Contract performance |
| Comply with legal obligations | Legal obligation |
3. AI Processing and Your Data
When you press an AI button, the text needed for that request is sent to the AI service that answers it. This includes the text of any document you uploaded for that activity. NOVA does not train AI models of its own.
- Uploaded documents are read in your browser and their text is sent to Anthropic for the AI actions you choose (for example Extract from Document).
- Uploaded files and the text taken from them are stored in your NOVA project (Cloudflare D1 database and R2 file storage) until you delete them or your account is deleted.
- Your projects are not shown to other users unless you share them with your team or organisation.
- Whether an AI provider may keep or use the data it receives is set by that provider's terms. Anthropic's commercial API terms state that API inputs are not used to train its models.
4. Data Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
- Service Providers (processors): the companies listed in the table below, only to run the Service
- Legal Requirements: When required by law, regulation, or legal process
- Safety: To protect the rights, property, or safety of NOVA, our users, or others
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- With Your Consent: When you have given us permission to share
| Processor | What it receives | Purpose | Location |
|---|---|---|---|
| Cloudflare | All requests; your account, projects and uploaded files (D1 database and R2 file storage); request counters (KV store); text sent to Workers AI models | Hosting, storage, and pictures and speech made by Workers AI models (@cf/leonardo/lucid-origin, @cf/black-forest-labs/flux-1-schnell, @cf/myshell-ai/melotts, @cf/deepgram/aura-2-en, @cf/deepgram/aura-1) | Cloudflare global network |
| Anthropic | The text of each AI request, including uploaded document text | Drafting, translation and the picture safety check (Claude models) | United States |
| Voyage AI | Doctrine search questions and doctrine passages | Turning text into search vectors | United States |
| Pinecone | Search vectors and doctrine passages | Doctrine search indexes | United States |
| Resend (Mailgun if Resend fails) | Your name and email address, and the content of account emails | Account emails such as invitations, email checks and password resets | United States |
| GitHub | The course content of an e-learning build you start | Building the e-learning package | United States |
5. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. Specifically:
- Account Data: Retained until account deletion
- Generated Content: Retained until you delete it or close your account
- Usage Logs: Retained for 12 months for security and fault finding
- Support Communications: Retained for 3 years
After account deletion, we may retain certain information as required by law or for legitimate business purposes.
6. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- HTTPS on all connections
- Cloudflare encrypts stored data at rest
- Sign-in with email address and password; the sign-in cookie is HttpOnly and Secure
- Checks in NOVA's own code that keep each user's and each organisation's data apart
- Limits on the number of requests and AI actions per user
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data
- Portability: Request a copy of your data in a portable format
- Restriction: Request limitation of processing
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent where processing is based on consent
You can download a copy of your data, or delete your account and its data, from the Settings page. To exercise any other right, email will@novaalliedtrainingllm.com.
8. International Data Transfers
Anthropic, Voyage AI, Pinecone, Resend, Mailgun and GitHub process data in the United States, and Cloudflare processes data on its global network. Transfers of personal data from the UK to these processors are to be made under the UK International Data Transfer Addendum or equivalent safeguards under UK data protection law.
9. Users Under 18
The Service can be used by people under 18 where their organisation has authorised their access, as section 4 of our Terms requires for every user. Accounts held by people under 18 have these extra safeguards:
- One age question: when you apply for access we ask whether you are 18 or over. We keep only that answer, never your date of birth.
- Safety instructions on every AI request: every request to the AI made from an account held by a person under 18 carries extra instructions that block sexual content, graphic violence, self-harm content and requests for personal details.
- Pictures: adding your own pictures is switched off for these accounts, and every request to make a picture is checked first and refused if the check fails.
- Reporting: to report an AI answer, email will@novaalliedtrainingllm.com with the page address and the answer.
We process the personal information of users under 18 under UK data protection law (the UK GDPR and the Data Protection Act 2018) and follow the Information Commissioner's Office Age Appropriate Design Code (the Children's Code) where it applies. More detail is on our AI Safety and Young Users page. If you have a concern about an account held by a person under 18, contact us using the details in section 11.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
Data controller: NOVA™
Email: will@novaalliedtrainingllm.com
Security problems: security@novaalliedtrainingllm.com
Address: NOVA™, United Kingdom
You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.