Privacy Policy

Effective date: September 25, 2026

Novo Industries, Inc. ("Novo," "we," or "us") operates Novo North. This policy explains how we handle personal information about visitors, members, meeting participants, and others whose information is used in North.

When an organization uses North, it decides what its workspace contains, and we process that content on its behalf. Novo is responsible for its own processing, such as accounts, billing, security, and running the service.

1. Information we collect

• Account information: name, email address, profile details, timezone, workspace membership, and sign-in details, from you, your organization, or a sign-in provider.
• Billing information: subscription and payment details. Stripe processes payment cards; we do not store full card numbers.
• Workspace content: tasks, messages, files, records, Apps, Memory, Workflows, repository material, and helper results. Content can include personal or sensitive information.
• Meetings: audio and video, which we process in real time to create transcripts and recaps, plus invitations and participant details. Uploaded audio and video files are processed for transcription.
• Connections and saved information: data from services you connect, and logins, keys, and other private values you save. Helper browser sessions process the pages, cookies, and login state they use.
• Support communications: messages you send us.
• Technical and usage information: device, browser, network, app version, and usage information, and logs. If you use Face ID in the iOS app, we receive only whether confirmation succeeded, not biometric data.

If you use optional onboarding research, we send your workspace name and public website to search and AI providers to draft workspace context.

2. How we use information

We use information to provide North and the work you request, keep useful context, manage subscriptions and usage, provide support and service messages, secure the service and prevent abuse, fix problems, and improve North.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use workspace content, including inputs, outputs, conversations, and files, to train AI models. Section 3 describes the matching commitment from our AI providers.

Where EU or UK data protection law applies, we rely on:

• Contract: to provide the service you or your organization signed up for, including account access, requested work, and billing.
• Legitimate interests: to operate North for organizations and their members, secure accounts, provide support, and improve North. You may object to this processing.
• Legal obligation: to keep required records and respond to lawful requests.
• Consent: where the law requires it. You may withdraw consent at any time.

3. Service providers and other recipients

Helper runtime

Your helper runs on Novo Agents, Novo's hosted runtime. The providers it uses are listed in the Novo Agents subprocessors disclosure, which is incorporated here. Not every task uses every provider.

AI providers

North also sends content directly to the AI providers below. We use them under terms or account settings that do not allow them to train models on your content. Providers may retain data under their own terms, for example for abuse monitoring.

Other service providers

Independent third-party services

Google Maps Platform receives map requests directly from your browser when you use map-enabled Apps. Google acts as an independent controller under its Controller–Controller Data Protection Terms and Privacy Policy.

Customer-directed destinations

Work you request can send information to services you connect, custom tools, and websites, which follow their own terms. When you connect repositories, GitHub receives repository contents and commit metadata through the Novo GitHub App.

4. Sharing within North and other disclosures

Your task conversations are not visible to other members through workspace membership. Members can share files, Apps, records, and Memory, and public links make content available outside the workspace. Meeting notes are available to the host and the North members who attended. The person arranging a meeting is responsible for telling participants about transcription.

We may also disclose information to professional advisers, to comply with law or valid legal requests, to protect people or legal rights, or in connection with a merger, acquisition, or sale of assets.

5. Cookies and analytics

We use cookies and similar storage for sign-in, preferences, security, and product analytics. We do not use advertising cookies or pixels. After you sign in, PostHog session replay records how you use North, configured to mask text and form inputs. We do not respond to browser Do Not Track signals. Blocking necessary cookies can prevent sign-in.

6. Retention and deletion

We keep information as long as needed for the purposes above.

• Workspace content stays until it is deleted or its workspace is deleted. Trash and version history keep recoverable copies for a time. Content you shared with a workspace can remain after you leave it.
• Canceled workspaces stay available for export of supported files for 30 days after cancellation. We begin permanent deletion 90 days after cancellation unless the workspace is reactivated.
• Your account: you can delete your account in the app. We keep billing, security, and legal records as long as needed for those purposes.
• Backups and logs can keep copies for a limited time after deletion.

7. International processing

Novo is based in the United States. We and our providers process information in the United States and other countries. Where the law requires a safeguard for international transfers, we use one, such as the Standard Contractual Clauses.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to processing, and to withdraw consent. California and other US state laws may give you similar rights. In the terms of those laws, we collect identifiers, commercial information, internet activity, audio and visual information, professional information, and sensitive information contained in content or saved logins, for the purposes and recipients described above.

Email privacy@novonorth.com to make a request or appeal a decision. We may need to verify your identity or an authorized agent's authority. We respond within the time the law requires and will not discriminate against you for exercising your rights. For content an organization controls, we may refer your request to that organization. You may also complain to your data protection authority.

9. Children

North is for adults 18 or older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us.

10. Changes and contact

We will post updates here and notify you of material changes as required by law. Before we use personal information for a new purpose, we will tell you, and ask for consent where the law requires it.

Novo Industries, Inc.

• Email: privacy@novonorth.com
• Mail: 169 Madison Ave, #67931, New York, NY 10016
• Phone: (929) 207-7393