Privacy Policy

Last updated: 6 October 2026

This Privacy Policy explains how Novotech Alliance, L.L.C, a Delaware limited liability company ("NOVOX", "we", "us"), 2261 Market Street STE 31113, San Francisco, CA 94114, United States, collects, uses, shares and protects personal data when you use the NOVOX mobile apps, the web app at app.novo-x.app and this website (the "Service"). We are the controller of your personal data. Contact us at support@novo-x.app with any privacy question or request.

1. Data we collect

  • Account data: name, email address, phone number (if you sign in by SMS or WhatsApp), country of residence, sign-in identifiers (including Apple or Google identifiers if you use them), and two-factor authentication settings.
  • Connected-account data: balances, transactions, holdings and account details returned by the providers you connect (Plaid, SnapTrade, Finverse, Lean, Salt Edge), plus the access tokens that let us refresh them. We never receive your banking username or password.
  • Data you enter or upload: manual assets, liabilities, income and expenses, budgets, goals, Zakat settings, and bank statements you upload (which can include your name, address and account numbers).
  • Brokerage orders: if you use trading, the orders you send and their status.
  • NovoAI data: your questions and NovoAI's answers.
  • Subscription data: plan, trial and billing status from Apple, Google, Stripe and RevenueCat. Card details are handled by those payment providers, not by us.
  • Support data: messages you send us.
  • Device, usage and diagnostic data: device model, OS, app version, language, IP address and approximate location derived from it, push-notification tokens, crash and error logs.
  • Marketing-measurement data: advertising identifiers and install/conversion events (see section 5).

2. How we use it, and our legal bases

Where the EU or UK GDPR applies, we rely on the legal basis shown for each purpose.

  • Providing the Service — accounts, syncing, dashboards, calculations, reports and brokerage orders you request — (performance of our contract with you).
  • NovoAI features, including AI categorisation and statement import (your consent, which you can withdraw at any time).
  • Billing and managing subscriptions (contract; legal obligation for tax and accounting records).
  • Security, fraud and abuse prevention, including blocking abusive sign-ups (legitimate interests in protecting users and the Service; legal obligation).
  • Support and service messages, such as security alerts and changes to these terms (contract; legitimate interests).
  • Improving the Service through aggregated analytics and crash diagnostics (legitimate interests).
  • Reminders and product notifications you can switch off in Settings (legitimate interests, or consent where the law requires it).
  • Measuring our own marketing campaigns (consent where required, such as iOS App Tracking Transparency; otherwise legitimate interests).

We do not use your data to make decisions that produce legal or similarly significant effects about you solely by automated means.

3. NovoAI and AI processing

NovoAI features are opt-in. Until you turn on AI data sharing — in the app's Settings, or when the app asks before you first use an AI feature — none of your financial data is sent to an AI provider, and transactions are categorised only by rules (your own, and categories already saved for a merchant). With it on, NovoAI sends the data a task needs to our AI providers — Anthropic (primary) and OpenAI (fallback for chat):

  • Chat: your question plus relevant financial context, such as net worth, income and spending totals, holdings, a sample of recent transactions and institution names.
  • Categorisation: new bank transactions (merchant description, amount, date, currency) with your category list and country, to suggest categories automatically.
  • Statement import: the statement file you upload, to extract its transactions.
  • Insights: periodic summaries of your net worth and spending to generate insights in the app.

Separately, the text of support requests you send us may be processed by Anthropic to help us draft replies (our legitimate interest in answering you); it does not include your connected-account data.

These providers process the data on our behalf to return a result. Under their API terms they do not use it to train their models. Turning off the “AI data sharing” switch (in the app or the web app's Settings) stops any further AI processing of your financial data.

4. Who we share data with

We share personal data only with service providers that process it for us, and as described below. We do not sell personal data.

  • Hosting and infrastructure: Supabase (database, authentication, storage) and Railway (application servers).
  • Account aggregation: Plaid, SnapTrade, Finverse, Lean and Salt Edge — when you choose to connect an account. SnapTrade also transmits brokerage orders you confirm.
  • AI: Anthropic and OpenAI (section 3).
  • Payments and subscriptions: Apple, Google, Stripe and RevenueCat.
  • Communications: Resend (email) and Twilio (SMS and WhatsApp sign-in codes); Apple and Google push-notification services.
  • Sign-in: Apple and Google, if you use them.
  • Marketing measurement: AppsFlyer and Google Ads (section 5).
  • Legal and safety: authorities or others where required by law, or to protect rights, property or safety.
  • Business transfers: a buyer or successor if NOVOX is involved in a merger, acquisition or sale of assets, subject to this Policy.

5. Marketing measurement and cookies

We do not show third-party ads in NOVOX. To learn which of our own ads lead to installs, sign-ups and subscriptions, the mobile apps use AppsFlyer (with RevenueCat forwarding subscription events), and the web app at app.novo-x.app may use Google Ads conversion tracking. These tools receive device or advertising identifiers and events such as an install, a sign-up or the start of a trial; AppsFlyer may also receive an internal NOVOX user ID. They do not receive your financial data.

On iOS, the advertising identifier is shared only if you allow tracking (Settings → Privacy & Security → Tracking). On Android you can reset or delete your advertising ID in device settings. To opt out of all marketing measurement linked to your account, email support@novo-x.app. The NOVOX website uses only essential cookies and does not load analytics or advertising tags. Our services do not respond to browser "Do Not Track" signals, but we honour the opt-outs described here.

6. Where your data is stored and international transfers

Our primary database and application servers are in Singapore (Supabase on AWS ap-southeast-1, and Railway). Several of our service providers, including our AI, payment and communications providers, process data in the United Statesand other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on the Standard Contractual Clauses (and UK addendum) in our providers' data-processing terms, or another lawful transfer mechanism. Contact us for more information.

7. How long we keep data

We keep your data while your account is open. When you delete your account in the app’s Settings, deletion is scheduled after a 30-day grace period during which you can sign back in to cancel it. After that we delete or anonymise your personal data, except where we must keep certain records longer for legal, tax, accounting or fraud-prevention reasons. Copies in encrypted backups expire on our backup schedule. Disconnecting an account stops new syncing; data already imported stays in your history until you delete it or your account.

8. Your rights

Wherever you live, you can ask to access, correct, export or delete your personal data, and many of these controls are in the app’s Settings. Email support@novo-x.app for anything else; we may need to verify your identity and will respond within the time the law requires (usually one month).

  • EEA and UK: you also have the rights to restrict or object to processing (including processing based on legitimate interests), to data portability, to withdraw consent at any time, and to complain to your local data-protection authority.
  • California: you have the rights to know, delete and correct personal information, to opt out of its "sale" or "sharing", and not to be discriminated against for using these rights. We do not sell personal information. Our marketing-measurement tools (section 5) may count as "sharing" for cross-context behavioural advertising under California law; to opt out, email us or use the device controls in section 5. You may use an authorised agent.
  • GCC and other countries: you have the rights your local data-protection law gives you, including under the UAE PDPL, Saudi PDPL and Qatar's Law No. 13 of 2016 where they apply.

9. Security

We encrypt data in transit (TLS, with HSTS) and at rest (AES-256), use providers with SOC 2 Type II reports, limit internal access by role, and offer two-factor authentication, biometric app lock and an account freeze. NOVOX itself has not completed a SOC 2 or ISO 27001 audit. No system is completely secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

10. Children

The Service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact support@novo-x.app and we will delete it.

11. Changes to this Policy

We will post any changes on this page and update the date above. For material changes we will also notify you in the app or by email before they take effect.

12. Contact