Privacy Policy

Last updated: July 30, 2026

This Privacy Policy explains how Novra, LLC ("Novra," "we," "us") collects, uses, and discloses information in connection with the Novra website and platform (the "Service"). This Policy currently applies to users located in the United States; we will update this Policy if we expand to users in other regions (see Section 9).

1. Account Data vs. Customer Content

We distinguish between two categories of information:

• Account Data: information you provide to create and manage your account, such as your name, email address, optional profile picture, and brokerage/company name.
• Customer Content: information you upload or input while using the Service, such as property details, rent rolls, tenant information, financials, comparables, and buyer or other third-party contact details, which may include third-party personal data such as names, phone numbers, and license numbers.

This Policy addresses each category separately below because they are collected, used, and retained differently.

2. Information We Collect

2.1 Account Data

• Name
• Email address
• Profile picture (optional)
• Brokerage or company name

2.2 Customer Content

You may upload property details, rent rolls, tenant information, financial data, comparables, and buyer contact information. Because you control what you upload, Customer Content may include personal data of third parties (for example, a tenant's or buyer's name, phone number, or professional license number). By uploading such information, you represent that you have the right to do so (see our Terms of Service, Section 4.4).

2.3 Payment Information

Payment card details are collected and processed directly by Stripe through Stripe Checkout. Novra does not receive or store your full card number or other sensitive payment credentials.

2.4 Cookies and Similar Technologies

We use the following categories of cookies:

• Essential: session/authentication cookies (Better Auth) and Stripe Checkout cookies necessary for the Service to function.
• Functionality: cookies that remember preferences such as theme and cookie-consent choices.
• Error Monitoring: Sentry, to detect and diagnose technical errors.
• Performance: Vercel Analytics and Speed Insights (cookieless).
• Analytics: PostHog, which is strictly consent-gated — no analytics cookie loads or captures any data before you accept the cookie banner. Analytics are first-party proxied, track manual pageviews plus four named product events (signup, BOV generated, document uploaded, checkout started), and are identified by user ID only, with no session recording and no autocapture.

We do not use marketing or advertising cookies. You can manage cookie preferences through our cookie consent banner.

3. How We Use Information

• To provide, operate, and maintain the Service, including generating Outputs from your Customer Content;
• To process payments and manage subscriptions and credits;
• To monitor, secure, debug, and improve the Service — this may involve Novra personnel accessing Customer Content as needed for support, security, or engineering purposes;
• To communicate with you about your account, transactions, and Service updates; and
• To comply with legal obligations.

We do not use your Customer Content to train any AI model. Our AI model providers do not train on your data, and retain requests only briefly for abuse-prevention purposes before deletion. We do review and access Customer Content as needed to operate, secure, debug, and improve the Service, but not to train third-party AI models.

4. AI Processing and Subprocessors

The Service uses AI models from Anthropic, OpenAI, and Google, accessed through the Vercel AI Gateway, to generate Outputs from the Customer Content you provide. These providers act as subprocessors and do not use your data to train their models. Requests are retained briefly (typically 7–30 days) by these providers solely for abuse-monitoring purposes before deletion.

The Service does not integrate directly with third-party real estate data sources (such as MLS feeds). Novra does use Anthropic's server-side web search to supplement deal context, and Pexels to source stock imagery for generated materials; Pexels receives only image search queries and no personal data.

5. Sharing of Information

We share information with the following categories of service providers (subprocessors), each engaged solely to help us operate the Service:

• Stripe — payment processing
• Resend — transactional email
• Inngest — background job orchestration (may process event payloads and run logs)
• Sentry — error monitoring
• Vercel — hosting, analytics, and AI Gateway
• Supabase — database and document storage
• Google — OAuth sign-in
• PostHog — product analytics (consent-gated)
• Pexels — stock image search (queries only, no personal data)
• Anthropic, OpenAI, Google — AI model providers, accessed via Vercel AI Gateway

We do not sell your personal information. We may disclose information if required by law or to protect the rights, property, or safety of Novra, our users, or others.

6. Organizations and Workspaces

If you join an organization workspace, your Customer Content within that workspace is controlled by the organization and is accessible to other members of that workspace (generally restricted to users sharing the organization's verified email domain). If you leave an organization, you lose access to that workspace's content, but the content remains with the organization.

7. Where We Store Data

Databases and file storage are hosted on AWS in the us-west-2 region (Oregon, USA). Application compute and the AI Gateway run on Vercel, based in the United States. All data is currently stored and processed in the United States.

8. Data Retention and Deletion

While your account is active, we retain your Account Data and Customer Content to provide the Service. Cancelling a paid subscription does not delete your account or data — your account persists on the Free tier unless you separately request deletion.

If you delete your account, your data is removed from our live systems within 30 days and from backups within 90 days.

We retain billing and tax records (via Stripe) for 7 years as required for financial and legal compliance, and we retain anonymized billing records (no longer linked to your identity) after account deletion.

Our AI model providers retain request data for approximately 7–30 days for abuse-prevention purposes before deletion.

9. Your Rights

Depending on your state of residence, you may have rights under state privacy laws (such as the California Consumer Privacy Act / California Privacy Rights Act) to know what personal information we collect, request deletion or correction of your information, and opt out of certain uses. We do not sell personal information. To exercise these rights, contact us at notices@getnovra.ai. We currently operate solely in the United States and will update this Policy, including with respect to obligations such as the EU/UK General Data Protection Regulation, before accepting users located in the UK or EU.

10. Children's Privacy

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Security

We use commercially reasonable technical and organizational measures designed to protect your information. Access to user workspace data is restricted to Novra's founders and authorized personnel for support and engineering purposes. We maintain infrastructure logs, application logs, and a complete billing/credit transaction ledger; we do not currently maintain per-record data-access audit logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date, and will provide additional notice of material changes as appropriate.

13. Contact Us

If you have questions about this Privacy Policy, contact us at notices@getnovra.ai.