Politique de confidentialité

Last updated: 15 October 2026

Ce document est actuellement fourni en anglais. Les versions traduites sont en cours de préparation.

This Privacy Policy explains how Novotech Alliance, LLC, a Delaware limited liability company ("NOVOX", "we", "us"), 2261 Market Street STE 31113, San Francisco, CA 94114, United States, collects, uses, shares and protects personal data when you use the NOVOX mobile apps, the web app at app.novo-x.app and this website (the "Service"). We are the controller of your personal data. We have not appointed a Data Protection Officer; send any privacy question or request to support@novo-x.app or the other contact details in section 14.

Where NOVOX is offered. NOVOX is not offered to residents of the European Union, the European Economic Area, Switzerland or the United Kingdom, and we do not accept new sign-ups from these regions. Some accounts were opened there before this restriction; if you are an existing user located there, this Policy still applies to you and you keep the rights described in section 9.

1. Data we collect

  • Account data: name, email address, phone number (if you sign in by SMS or WhatsApp), country of residence, sign-in identifiers (including Apple or Google identifiers if you use them), and two-factor authentication settings. If you have not chosen a country, we infer it from your confirmed phone number's dialling code, your app-store country or your display currency; you can ask us to correct it.
  • Connected-account data: balances, transactions, holdings and account details returned by the providers you connect (Plaid, SnapTrade, Finverse), plus the access tokens that let us refresh them. We never receive your banking username or password.
  • Data you enter or upload: manual assets, liabilities, income and expenses, budgets, goals, Zakat settings, and bank statements you upload (which can include your name, address and account numbers).
  • Brokerage orders: if you use trading, the orders you send and their status.
  • NovoAI data: your questions and NovoAI's answers, and a record of when you turned AI data sharing on or off.
  • Subscription data: plan, trial and billing status from Apple, Google, Stripe and RevenueCat. Card details are handled by those payment providers, not by us.
  • Support data: messages you send us.
  • Referral data: your referral code and, if you invite someone or were invited, the link between the two accounts.
  • Device, usage and diagnostic data: device model and name, OS, app version, language, IP address (which can indicate your approximate location), the devices you sign in from, push-notification tokens, crash and error logs.
  • Marketing-measurement data: advertising identifiers and install/conversion events (see section 5).

2. How we use it, and our legal bases

Where the EU or UK GDPR applies (for existing users located there), we rely on the legal basis shown for each purpose.

  • Providing the Service — accounts, syncing, dashboards, calculations, reports and brokerage orders you request — (performance of our contract with you).
  • NovoAI features, including AI categorisation and statement import (your consent, which you can withdraw at any time).
  • Billing and managing subscriptions (contract; legal obligation for tax and accounting records).
  • Security, fraud and abuse prevention, including bot checks at sign-up and sign-in, blocking abusive sign-ups and alerting you to sign-ins from a new device (legitimate interests in protecting users and the Service; legal obligation).
  • Support and service messages, such as security alerts and changes to these terms (contract; legitimate interests).
  • Improving the Service through aggregated analytics and crash diagnostics (legitimate interests).
  • Reminders, product emails and notifications (including optional market news and tips, which are off unless you turn them on), which you can switch off in Settings or unsubscribe from in any email (legitimate interests, or consent where the law requires it).
  • Measuring our own marketing campaigns (consent where required, such as iOS App Tracking Transparency; otherwise legitimate interests).

We do not use your data to make decisions that produce legal or similarly significant effects about you solely by automated means.

3. NovoAI and AI processing

NovoAI features are opt-in. Until you turn on AI data sharing — in the app's Settings, or when the app asks before you first use an AI feature — none of your financial data is sent to an AI provider, and transactions are categorised only by rules (your own, and categories already saved for a merchant). With it on, NovoAI sends the data a task needs to our AI providers — Anthropic (primary) and OpenAI (fallback for chat):

  • Chat: your question plus relevant financial context, such as net worth, income and spending totals, holdings, a sample of recent transactions and institution names.
  • Categorisation: new bank transactions (merchant description, amount, date, currency) with your category list and country, to suggest categories automatically.
  • Statement import: the statement file you upload, to extract its transactions.
  • Insights: periodic summaries of your net worth and spending to generate insights in the app.

Separately, the support requests you send us (subject and conversation) are processed by Anthropic — or by OpenAI as a back-up — to answer you automatically or to help our team reply, and a person on our team takes over when needed (our legitimate interest in answering you). This does not include your connected-account data.

These providers process the data on our behalf to return a result. Under their API terms they do not use it to train their models, and they keep API inputs and outputs only for a limited period — currently up to 30 days — to monitor for abuse and safety before deleting them, unless the law requires them to keep it longer or they need it longer to investigate a breach of their usage policies. Turning off the “AI data sharing” switch (in the app or the web app's Settings) stops any further AI processing of your financial data.

4. Who we share data with

We share personal data only with service providers that process it for us, and as described below. We do not sell personal data.

  • Hosting and infrastructure: Supabase (database, authentication, storage) and Railway (application servers).
  • Account aggregation: when you choose to connect an account — Plaid to connect bank accounts, SnapTrade to connect brokerage accounts, and Finverse to connect bank accounts in Asia-Pacific. We give them only an internal NOVOX user ID, not your name or contact details. SnapTrade also transmits brokerage orders you confirm. Each provider also handles your data under its own policy: Plaid's End User Privacy Policy (plaid.com/legal/#end-user-privacy-policy), SnapTrade's Privacy Policy (snaptrade.com/privacy-policy) and Finverse's End User Privacy Policy (finverse.com/legal/privacy-policy).
  • AI: Anthropic and OpenAI (section 3).
  • Payments and subscriptions: Apple, Google, Stripe and RevenueCat.
  • Communications: Resend (email); Twilio (United States), which receives your phone number to deliver SMS and WhatsApp sign-in codes for our authentication provider Supabase; Expo, Apple and Google push-notification services.
  • Sign-in and security: Apple and Google, if you use them; Cloudflare Turnstile, which checks sign-ups and sign-ins for bots and receives your IP address and browser or device signals.
  • App delivery and diagnostics: Sentry (United States) for crash and error reports, with names, emails, phone numbers, amounts and account numbers removed before sending; Expo (United States) for app updates and app-launch statistics.
  • Market data: providers such as Finnhub, Twelve Data and Financial Modeling Prep receive the market symbols we look up, not your name, contact details or account data. Some prices and logos load directly from a provider, which then sees your device's IP address.
  • Marketing measurement: AppsFlyer and Google Ads, and through AppsFlyer the ad networks Google, Meta and Apple Search Ads (section 5).
  • Usage statistics: PostHog (United States) — anonymous page-view counts for this website and the web app, from 14 November 2026 (section 5).
  • Legal and safety: authorities or others where required by law, or to protect rights, property or safety.
  • Business transfers: a buyer or successor if NOVOX is involved in a merger, acquisition or sale of assets, subject to this Policy.

5. Marketing measurement and cookies

We do not show third-party ads in NOVOX. To learn which of our own ads lead to installs, sign-ups and subscriptions, the mobile apps use AppsFlyer (with RevenueCat forwarding subscription events), and the web app at app.novo-x.app uses Google Ads conversion tracking, which sets Google advertising cookies in your browser. These tools receive device or advertising identifiers and events such as an install, a sign-up or the start of a trial; AppsFlyer may also receive an internal NOVOX user ID. AppsFlyer passes these identifiers and events on to the ad networks that run our ads — Google, Meta and Apple Search Ads — so they can report which ads worked. None of these companies receives your financial data.

On iOS, the advertising identifier is shared only if you allow tracking (Settings → Privacy & Security → Tracking). On Android you can reset or delete your advertising ID in device settings. In a browser you can block or delete cookies in its settings. To opt out of all marketing measurement linked to your account, email support@novo-x.app. The NOVOX website (novo-x.app) uses only essential cookies and does not load advertising tags.

From 14 November 2026, this website and the web app count anonymous page views with PostHog (United States). No cookies or local storage are used for this, no name, email or account ID is sent, and page addresses are shortened so they contain no personal identifiers or search terms. If your browser sends a "Do Not Track" or Global Privacy Control signal, no page views are counted. Apart from this, our services do not yet respond to browser "Do Not Track" or Global Privacy Control signals (for example, the Google Ads tag on the web app loads whether or not your browser sends them), but we honour the opt-outs described here.

6. Where your data is stored and international transfers

Our primary database and application servers are in Singapore (Supabase on AWS ap-southeast-1, and Railway). Several of our service providers, including our AI, payment, communications and diagnostics providers, process data in the United States; SnapTrade is based in Canada and Finverse in Hong Kong; and providers may also process data in other countries. If you live outside Singapore — including in Saudi Arabia, the United Arab Emirates, Qatar or the Philippines — your data is therefore transferred outside your country.

Wherever you live, we protect data transferred abroad in the same way: the service providers that process it for us do so under data processing agreements (or data-processing terms) with us, which limit them to processing it on our instructions and require them to keep it confidential and secure; we apply the security measures in section 11; and we follow the rules on transfers abroad in the data-protection law of your country where they apply. For existing users in the EEA, UK or Switzerland, we rely on the Standard Contractual Clauses (and UK addendum) in our providers' data-processing terms, or another lawful transfer mechanism. Contact us for more information.

7. How long we keep data

We keep your data while your account is open. When you delete your account (section 8), we delete or anonymise your personal data, except where we must keep certain records longer for legal, tax, accounting or fraud-prevention reasons: for example, records of paid transactions are kept with your identity removed. Other time limits:

  • Database backups: made daily and kept for 7 days, so data you delete is gone from our backups within 7 days.
  • Crash and error reports (Sentry): deleted after 90 days.
  • Server and application logs (Railway), which can include IP addresses: kept for up to 30 days.
  • Unused sign-ups: sign-ups that are never confirmed and never used are deleted after 30 days.

Disconnecting an account stops new syncing; data already imported stays in your history until you delete it or your account.

8. How to delete your account and data

You can delete your NOVOX account and its data at any time, with or without the app:

  • In the mobile app: tap your profile picture at the top of the screen to open Settings, then choose Privacy → Delete account, type DELETE and confirm.
  • In the web app: sign in at app.novo-x.app, open Settings and, under Your data, choose Delete account, type DELETE and choose Permanently delete my account.
  • Without the app: email support@novo-x.app from the email address on your account (or tell us the phone number you sign in with) and ask us to delete your account. We may ask you to confirm it is you, then we schedule the deletion in the same way.

What is deleted. Your account and the data in it: profile and sign-in details, connected accounts with the balances, transactions and holdings imported from them, the assets, liabilities and transactions you entered (including property photos), budgets and goals, NovoAI conversations and insights, support messages, referral links, notifications and the devices you signed in from. We also remove your connections at Plaid, SnapTrade and Finverse, delete your record at RevenueCat and cancel any web (Stripe) subscription.

What is kept. Records of paid transactions, with your identity removed, for tax and accounting; a record that our staff acted on your account, with the details removed; and anything else the law requires us to keep. Copies in our database backups disappear within 7 days, and logs and error reports expire as described in section 7. Deleting your account does not cancel an App Store or Google Play subscription — cancel it in the store.

How long it takes. Deletion is scheduled after a 30-day grace period, during which you can sign back in and cancel it. Our deletion run happens daily, so your account is deleted within a day after the grace period ends, and the last backup copies expire 7 days after that.

9. Your rights

Wherever you live, you can ask to access, correct, export or delete your personal data. You can delete your account yourself (section 8), and download a copy of your data with Export my data in Settings (under Privacy in the mobile app, under Your data in the web app). Email support@novo-x.app to make any request, including deletion, or for anything else; we may need to verify your identity and will respond within the time the law requires (usually one month).

  • EEA, UK and Switzerland: NOVOX is no longer offered there, but if you are an existing user located there, you keep these rights as well: to restrict or object to processing (including processing based on legitimate interests), to data portability, to withdraw consent at any time, and to complain to your local data-protection authority.
  • California: you have the rights to know, delete and correct personal information, to opt out of its "sale" or "sharing", and not to be discriminated against for using these rights. We do not sell personal information. Our marketing-measurement tools (section 5) may count as "sharing" for cross-context behavioural advertising under California law; to opt out, email us or use the device controls in section 5. You may use an authorised agent.
  • GCC, the Philippines and other countries: you have the rights your local data-protection law gives you, including under the Saudi PDPL, the UAE PDPL, Qatar's Law No. 13 of 2016 and the Philippines' Data Privacy Act of 2012 where they apply, and you can complain to your data-protection authority (for example SDAIA in Saudi Arabia or the National Privacy Commission in the Philippines).

10. Notice for US users

If you live in the United States, this notice summarises how we handle the nonpublic personal information we hold about you:

  • What we collect: account data (such as your name, email address and phone number), connected-account data (balances, transactions, holdings and account details from the providers you connect) and transaction data (the transactions you import or enter, and any brokerage orders you send), as described in section 1.
  • What we do not do: we do not sell it, and we do not share it with non-affiliated third parties for their own marketing.
  • Who we share it with: only the service providers that help us run the Service (section 4), under contracts that limit their use of it; a buyer or successor in a business transfer (section 4); and others where the law requires or permits it, such as to comply with legal process or to prevent fraud. The ad networks used for marketing measurement (section 5) receive device identifiers and events such as an install, never your financial data.
  • How we protect it: with the security measures in section 11.
  • Questions: contact us using the details in section 14.

11. Security

We encrypt data in transit (TLS, with HSTS) and at rest (AES-256), use providers with SOC 2 Type II reports, limit internal access by role, and offer two-factor authentication, biometric app lock and an account freeze. The biometric app lock (Face ID, Touch ID or fingerprint) is checked on your device by its operating system: NOVOX only learns whether the check succeeded and never receives or stores your biometric data. NOVOX itself has not completed a SOC 2 or ISO 27001 audit. No system is completely secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

12. Children

The Service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact support@novo-x.app and we will delete it.

13. Changes to this Policy

We will post any changes on this page and update the date above. For material changes we will also notify you in the app or by email before they take effect.

14. Contact