Privacy Policy
Last updated: June 30, 2026 · Effective: June 30, 2026
novpha (“novpha”, “we”, “us”, or “our”) is an outreach tool that helps you find prospect contacts and send and track email campaigns from your own Gmail account. This Privacy Policy explains what information we collect and access, how and why we use it, who we share it with, how long we keep it, and the rights and choices you have. By creating an account, signing in, or using novpha, you acknowledge that you have read and understood this policy.
Contents
1. Information we collect and access
- Google account profile. When you sign in with Google we receive your email address, name, and profile picture to identify your account and show who is signed in.
- Gmail (sending and replies). With your permission (the https://mail.google.com/ scope) novpha sends your outreach and follow-up emails as you, and reads your mailbox only to detect and display replies to the campaigns you send from novpha.
- Data you create in novpha. Prospect contacts and public profile data you harvest through searches, the email content you compose, campaign settings, lists/folders, and engagement signals (sends, opens, clicks, replies).
- Personal data of your prospects. Contacts you discover or import may include third parties’ names, email addresses, job titles, public social/profile links, and similar business-contact information. See “Data of people you contact.”
- Billing information. If you purchase credits or a paid plan, our payment processor collects and processes your payment details. We do not store full card numbers; we receive limited transaction metadata (e.g., amount, status, last four digits) to manage your account and credits.
- Automatically collected data. When you use novpha we collect log and usage data such as IP address, browser/device type, pages and features used, timestamps, and diagnostic/error data, to operate and secure the service.
- Support communications. If you contact us, we keep your messages and contact details to respond and improve support.
2. Cookies and similar technologies
We use strictly necessary cookies and similar technologies (such as a session cookie) to keep you signed in, secure your session, and remember preferences like theme and zoom. We do not use third-party advertising cookies. You can control cookies through your browser, but disabling essential cookies may prevent sign-in.
Outreach emails you send through novpha may include open- and click-tracking so we can show you which prospects engaged. You control whether tracking is enabled for your campaigns where that option is available.
3. How we use your information
- To provide core features: sending campaign and follow-up emails you compose, from your own Gmail, and threading replies correctly.
- To poll your inbox so we can show you which prospects replied.
- To run searches and enrichment that build your prospect lists.
- To process payments, manage credits/usage, and prevent fraud.
- To operate, maintain, secure, debug, and improve the service.
- To communicate with you about your account, security, and changes.
- To comply with legal obligations and enforce our terms.
We do not sell your data, share it for cross-context behavioral advertising, or use your Gmail content to train generalized AI/ML models.
4. Legal bases for processing (EEA/UK)
Where the GDPR or UK GDPR applies, we process personal data on these bases: performance of a contract (to provide the service you sign up for); legitimate interests (to secure, operate, and improve novpha and to support our users, balanced against your rights); consent (for example, the Google permissions you grant, which you can withdraw at any time); and legal obligation (to meet record-keeping, tax, and compliance requirements).
5. Google API Services — Limited Use
novpha’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we only use Google user data to provide and improve the user-facing features described above; we do not transfer it to others except as necessary to provide those features, comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and humans do not read your Gmail data unless we have your consent for specific messages, it is necessary for security or to comply with law, or the data is aggregated and anonymized for internal operations.
6. How we share data and our subprocessors
We do not sell personal data. We share it only as needed to run novpha:
| Category | Purpose |
|---|---|
| Cloud hosting & database providers | Run the application and store your data securely |
| Email/deliverability & Google APIs | Send mail and detect replies on your behalf |
| AI / text-processing providers | Power drafting and enrichment features |
| Search / data-enrichment providers | Find and enrich prospect contacts |
| Payment processor | Process purchases and manage credits |
| Legal / safety | Comply with law, enforce terms, protect users |
Subprocessors may process data only on our instructions and under confidentiality and data-protection obligations. We may also disclose data in connection with a merger, acquisition, or sale of assets, subject to this policy.
7. International data transfers
We may process and store information in countries other than where you live, including the United States. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses, and take steps to ensure your data receives an adequate level of protection.
8. How we store and protect data
- OAuth access and refresh tokens are stored on our server so we can send and poll on your behalf, and are used only for that purpose.
- Data is stored in our managed PostgreSQL database on cloud infrastructure, with access restricted to operating the service.
- Connections to novpha are encrypted in transit (HTTPS/TLS).
- We apply access controls, logging, and least-privilege practices. No method of transmission or storage is 100% secure, but we work to protect your information and will notify you of breaches where required by law.
9. Your privacy rights
Depending on where you live, you may have the right to access, correct, update, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, disconnect in-app or email support@novpha.com. We will respond within the timeframe required by applicable law and may need to verify your identity. You also have the right to lodge a complaint with your local data protection authority.
10. U.S. state privacy rights
If you are a resident of California or another U.S. state with a privacy law (e.g., the CCPA/CPRA), you may have the right to know, access, delete, and correct your personal information, and to opt out of “sale” or “sharing.” novpha does not sell or share personal information for cross-context behavioral advertising. We do not discriminate against you for exercising your rights. Submit requests to support@novpha.com.
11. Your choices and data deletion
- Disconnect anytime. Use “Disconnect” in the app to revoke novpha’s access and delete your connected-account record and stored tokens. You can also revoke access at myaccount.google.com/permissions.
- Delete your data. Email us and we will delete your account data, including harvested contacts and sent-mail history tied to your account, except where retention is required by law.
- Manage email tracking. Disable open/click tracking on your campaigns where the option is provided.
12. Data of the people you contact
When you use novpha to find and email prospects, you act as the controller of those prospects’ personal data, and novpha acts as a processor handling it on your behalf and instructions. You are responsible for having a lawful basis to collect and contact those individuals and for honoring their rights and opt-out requests under applicable laws (including GDPR, CAN-SPAM, and CASL). If a prospect contacts us directly about their data, we will refer them to the relevant novpha user where appropriate.
13. Retention
We keep your data while your account is connected and for as long as needed to provide the service, then delete or anonymize it on request or after your account is disconnected, except where longer retention is required for legal, tax, security, or dispute-resolution purposes.
14. Children
novpha is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time; we will revise the “Last updated” date above and, for material changes, provide additional notice in the app or by email. Your continued use after changes take effect constitutes acceptance of the updated policy.
16. Contact us
Questions, requests, or complaints about privacy or your data: support@novpha.com. We will do our best to resolve your concerns.
This document is provided for transparency and does not constitute legal advice.