Novo Agents Privacy Policy

Effective date: July 10, 2026

Novo Industries, Inc. ("Novo," "we," "us") operates Novo Agents, a hosted service for running AI agents through a server-side SDK, an HTTP API, and a web console. This policy describes how we collect, use, share, and protect information when you use Novo Agents.

Information we collect

• Account and workspace information, such as email address, name, authentication identifiers, role, and workspace details.
• Configuration data, meaning the resources you create through the API or console, including agent definitions, connection settings, and credentials for endpoints you configure.
• Customer Data, meaning content submitted to or produced by your agents, including prompts, messages, files, tool inputs and results, generated outputs, and any personal information that content contains.
• Usage and diagnostic data, such as API activity, usage metering, operational logs, and security events.
• Billing information, which is processed by our payment provider. We do not store full payment card numbers.

Your applications and end users

Novo Agents is a building block for your own products. You control what your application sends to the service and what your agents are configured to do. Where Customer Data includes personal information about your end users, we process it on your behalf to provide the service; you are responsible for giving your end users any required notices and for having a lawful basis to process their information.

How we use information

We use information to provide and operate the service, authenticate requests, run agent workloads, meter usage and bill workspaces, secure the service and prevent abuse, provide support, improve the service, and send service communications.

We do not sell personal information. We do not use Customer Data to train or improve AI models that Novo develops or fine-tunes.

AI processing

Novo Agents sends Customer Data to AI providers as needed to perform requested work. Providers process this data on our behalf under terms that restrict their use of it, and requests are routed only to providers named in the Novo Agents subprocessors list. If you select a stricter data-handling option offered in the product, covered processing is further restricted to configurations verified for that option, as described in the product documentation.

Customer-configured destinations

If you configure your own execution environments, tool servers, webhooks, or storage destinations, the service delivers data to them at your direction. Those destinations are controlled by you, not by Novo.

How we share information

We share personal information and Customer Data only:

• with the subprocessors and service providers that help us operate the service, under contracts that limit their use of the information;
• with destinations and third-party services you configure or direct the service to use;
• to comply with law or a valid legal request, or to protect the rights, safety, or security of Novo, our customers, or the public;
• in connection with a merger, acquisition, financing, or sale of assets, in which case this policy continues to apply to previously collected information until it is updated; and
• at your direction or with your consent.

We do not sell personal information and do not share it for advertising purposes.

Cookies

The console uses cookies and similar storage for authentication, session management, security, product operation, and first-party product analytics. We do not use third-party advertising cookies.

Retention

Configuration data and Customer Data are retained while your workspace is active or until you delete them through the API or console; deleting a resource destroys the managed state associated with it. Generated artifacts and temporary download links expire on the schedules documented in the product. Operational logs and backups are retained for limited periods. Billing and compliance records are retained as required by law.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to our processing of personal information. To exercise these rights, email privacy@novoindustries.co. If your end users send us requests about their information, we will refer them to you or handle the request on your instruction.

International transfers

We operate from the United States and may process information there and in other countries through the providers in our subprocessor list. Where your region requires safeguards for international transfers, we rely on recognized transfer mechanisms such as the Standard Contractual Clauses.

Children

Novo Agents is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Security

We protect information with encryption in transit and at rest, workspace isolation, scoped credentials, and operational monitoring. See Novo Agents Security.

Changes

We may update this policy from time to time. We will post updates on this page and provide additional notice of material changes through the service or by email where required by law.

Contact

• Privacy requests: privacy@novoindustries.co
• Security reports: security@novoindustries.co
• Mail: Novo Industries, Inc., Wilmington, Delaware, United States