Last updated · November 2, 2026
This Privacy Policy explains how Novra, LLC (“Novra,” “we,” “us”) collects, uses, and discloses information in connection with the Novra website (www.getnovra.ai) and platform (app.getnovra.ai), including Neo, our AI agent (together, the “Service”). This Policy currently applies to users located in the United States; we will update this Policy if we expand to users in other regions (see Section 9).
1
Account Data vs. Customer Content
We distinguish between two categories of information:
Account Data: information about you as a user of the Service — for example your name, email address, sign-in details, and how you use the Service.
Customer Content: information you or your workspace upload, input, send, or connect while using the Service — for example property details, rent rolls, tenant information, financials, comparables, contacts, emails you send to Neo, and data from connected services — which may include third-party personal data such as names, phone numbers, email addresses, photos, and license numbers.
This Policy addresses each category separately below because they are collected, used, and retained differently.
2
Information We Collect
2.1 Account Data
Name, work email address, optional profile picture, and brokerage or company name
Sign-in and security data: password hash or Google sign-in identifier (name, email, and profile picture from Google), two-factor authentication settings, and session records including IP address and browser user agent
Billing status, plan, credit balance, and transaction history (card details are handled by Stripe — see 2.3)
Usage and activity data: when you sign in, which features you use (for example deals, documents, Broker Opinions of Value, chats, schedules, and email threads), with timestamps and the names of the records involved
Feedback you give on Neo’s responses (ratings and comments), and signals such as undoing or regenerating a result
Messages you send to our support team
Referral information: the email addresses of people you invite, and the referral link you signed up through
2.2 Customer Content
You and your workspace may upload or create property details, rent rolls, tenant information, financial data, comparables, buyer and contact records, team member profiles, documents, images, and presentation templates, and you converse with Neo in chat. Customer Content also includes:
Emails to Neo. Each workspace has a Neo email address. Emails and attachments that members send to it are processed to carry out the request, and attachments are added to the workspace’s documents.
Connected services. If you connect a service such as Box or Granola, Neo can read the files or meeting notes that service makes available under the permissions you grant, and, with your approval, save files back to it. Access tokens are stored encrypted.
Agent activity. Neo’s chat history, the steps it takes (including the inputs and results of the tools it uses), and the output of scheduled and email runs.
Because you control what you upload or connect, Customer Content may include personal data of third parties. By uploading or connecting such information, you represent that you have the right to do so (see our Terms of Service, Section 4.4).
2.3 Payment Information
Payment card details are collected and processed directly by Stripe through Stripe Checkout. Novra does not receive or store your full card number or other sensitive payment credentials.
2.4 Cookies and Similar Technologies
We use essential cookies to run the Service, functional cookies and local storage to remember your preferences, and — only with your consent — analytics (PostHog and Sentry Session Replay) and, on our website only, marketing (LinkedIn Insight Tag). Your choice applies on both www.getnovra.ai and app.getnovra.ai. See our Cookie Policy for the full list and how to change your choice.
3
How We Use Information
To provide, operate, and maintain the Service, including generating Outputs from your Customer Content and running Neo on your instructions, including scheduled and email runs;
To process payments and manage subscriptions, credits, trials, and referrals;
To monitor, secure, debug, and improve the Service. This may involve Novra personnel accessing Customer Content and Neo’s activity as needed for support, security, or engineering purposes — including reviewing traces of Neo’s work and the responses users rate poorly or that fail, and, for support, signing in to your account with access that is logged;
To understand how the Service is used (for example, activation and usage metrics) and improve it;
To communicate with you about your account, transactions, and Service updates, and to send invitation emails to people you refer; and
To comply with legal obligations.
We do not use your Customer Content to train any AI model, and we do not allow our AI model providers to do so.
4
AI Processing and Subprocessors
The Service sends relevant portions of your Customer Content to AI models to generate Outputs:
Neo (chat, delegated work, and scheduled and email runs) uses Anthropic models accessed directly through Anthropic’s API by default. If you choose an OpenAI or Google model in chat, it is accessed through the Vercel AI Gateway with zero data retention and no training enforced.
Other AI features — Broker Opinion of Value generation, document extraction, template processing, and composing Neo’s email replies — use models from Anthropic, OpenAI, and Google, accessed through the Vercel AI Gateway with zero data retention and no training enforced.
Document search converts document text into embeddings using OpenAI, through the Vercel AI Gateway.
None of these providers use your data to train their models. Requests sent directly to Anthropic are retained by Anthropic for up to 30 days for trust-and-safety purposes and then deleted.
Neo’s activity — including prompts, the inputs and results of the tools it uses, and your feedback, identified by user and workspace ID — is recorded in LangSmith (LangChain), which we use to debug and improve Neo. These traces are deleted automatically after 14 days. Occasionally we turn a request into a test case for checking future versions of Neo; before we keep it, we rewrite it so it no longer identifies you, your firm, or your records.
The Service does not integrate directly with third-party real estate data sources (such as MLS feeds). To supplement deal context, the Service sends web-search queries to Anthropic’s web search and to Tavily, and image-search queries to Pexels; these receive search queries only. Property and comparable addresses are sent to Mapbox to place them on maps.
5
Sharing of Information
We share information with the following service providers (subprocessors), each engaged solely to help us operate the Service:
Vercel — hosting, cookieless performance analytics, document processing, and AI Gateway
Supabase (on AWS) — database and document storage
Anthropic, OpenAI, Google — AI model providers (see Section 4)
LangSmith (LangChain) — tracing and evaluation of Neo’s activity
AgentMail — workspace email addresses for Neo: receiving members’ emails and sending Neo’s replies and scheduled-run results
Resend — account, billing, and notification emails, including alerts to our team when a user rates a response poorly
Inngest — background job orchestration (may process event payloads and run logs)
Stripe — payment processing
Sentry — error monitoring (including user and workspace identifiers on errors) and, with your consent, Session Replay
PostHog — product analytics (consent-gated)
Upstash — rate limiting (IP address and user identifiers)
Cloudflare — Turnstile bot protection on sign-in and sign-up
Google — OAuth sign-in
Mapbox — geocoding and maps
ConvertAPI — converting presentation files to and from PDF and images (files are not stored)
Tavily — web search (queries only)
Pexels — stock image search (queries only, no personal data)
LinkedIn — advertising measurement on our website only, with your consent
Connected services you choose. When you connect Box, Granola, or another service, data flows between that service and Novra under the permissions you grant and that provider’s own privacy policy.
Within your workspace. Customer Content in a workspace is shared with its other members (see Section 6), and Neo may email results to the members you choose.
We do not sell your personal information or share it for cross-context behavioral advertising, except that, with your consent, the LinkedIn Insight Tag on our website measures our LinkedIn advertising; it is never loaded in the app. We may disclose information if required by law, to protect the rights, property, or safety of Novra, our users, or others, or in connection with a merger, acquisition, or sale of assets.
6
Organizations and Workspaces
If you join an organization workspace, Customer Content within that workspace is controlled by the organization and is accessible to other members of that workspace. Your chats with Neo are private to you. Workspace invitations are generally limited to people on the inviting member’s email domain. If you leave an organization, you lose access to that workspace’s content, but the content remains with the organization.
Where a brokerage firm’s presentation templates are made available, they are shared with workspaces linked to that firm, which are limited to users with the firm’s email domains.
7
Where We Store Data
Databases and file storage are hosted on AWS in the us-west-2 region (Oregon, USA). Application compute and the AI Gateway run on Vercel in the United States. Our subprocessors process data in the United States. All data is currently stored and processed in the United States.
8
Data Retention and Deletion
While your account is active, we retain your Account Data and Customer Content to provide the Service. Cancelling a paid subscription does not delete your account or data — your account persists on the Free tier unless you separately delete it.
You can delete your account from your account settings. Deletion is scheduled after a 7-day grace period, during which you can cancel it. When it runs, we delete your account, your personal chats and Neo’s conversation history with you, and any workspace where you are the only member — including its documents, its Neo email address, and its connections to third-party services, whose access is revoked. Workspaces you share with others remain with those organizations. A workspace owner can also delete a workspace, with the same effect for that workspace. Deleted data is removed from our live systems within 30 days and from backups within 90 days.
We retain billing and tax records (via Stripe) for 7 years as required for financial and legal compliance. After account deletion we also keep de-identified usage and billing records (such as credit transactions, with your name, email, and workspace removed) and aggregate statistics, which no longer identify you and which we use for accounting and to understand how the Service is used.
When you delete your account, we also ask PostHog to delete your analytics profile, including the events and any session recordings linked to it. Some other data held by subprocessors expires on their schedules rather than ours: requests sent directly to Anthropic are retained for up to 30 days; traces in LangSmith are deleted automatically after 14 days; and error reports in Sentry expire automatically.
9
Your Rights
Depending on your state of residence, you may have rights under state privacy laws (such as the California Consumer Privacy Act / California Privacy Rights Act) to know what personal information we collect, request deletion or correction of your information, and opt out of certain uses, including the sale or sharing of personal information and targeted advertising. We do not sell personal information. You can opt out of marketing cookies through our cookie banner, and we honor Global Privacy Control signals as an opt-out. To exercise your rights, contact us at notices@getnovra.ai. We currently operate solely in the United States and will update this Policy, including with respect to obligations such as the EU/UK General Data Protection Regulation, before accepting users located in the UK or EU.
If personal data about you was uploaded to the Service by one of our customers (for example, as a tenant, buyer, or contact), that customer controls it; please contact them, and we will assist them with your request.
10
Children’s Privacy
The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.
11
Security
We use commercially reasonable technical and organizational measures designed to protect your information, including encryption of connected-service access tokens and isolation of each workspace’s data. Access to user workspace data is restricted to authorized Novra personnel for support, security, and engineering purposes; when our staff sign in to an account to provide support, that session is recorded. We maintain infrastructure logs, application logs, and a complete billing/credit transaction ledger; we do not currently maintain per-record data-access audit logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date, and will provide additional notice of material changes as appropriate.
13
Contact Us
If you have questions about this Privacy Policy, contact us at notices@getnovra.ai.