Nova Production ("Nova", "we", "us", or "our") is a business management software platform serving small and medium-sized businesses. This Privacy Policy explains how we collect, use, store, and protect information when businesses and their customers interact with our platform, including through WhatsApp Business and Gmail integrations.
1. Who we are
Nova Production is a software-as-a-service platform developed and operated by Santiago Rodriguez. Nova provides business management tools including order tracking, client management, invoicing, financial reporting, payment automation, and unified communications (including WhatsApp Business messaging) to business clients in Colombia and internationally.
For questions about this policy, contact us at: legal@novaproduction.tech
2. Scope of this policy
This policy applies to:
- Business clients — companies and individuals who subscribe to and use the Nova platform to manage their operations.
- End users — customers of our business clients who send messages to those businesses via WhatsApp or other channels received and processed through Nova.
- Visitors — anyone who visits our website or landing pages.
Nova operates as a data processor on behalf of its business clients, who are the data controllers for information about their own customers. Our business clients determine the purposes and means of processing their customer data; Nova processes that data on their instructions.
3. Information we collect
From business clients (platform users)
- Account information: name, email address, company name, phone number
- Billing information: payment method details (processed by our payment provider — we do not store full card numbers)
- Business data: orders, client records, invoices, production data, and other operational information entered into Nova
- Usage data: how the platform is used, feature interactions, login activity
- Communication credentials: WhatsApp Business Account identifiers and phone number IDs provided during integration setup
- Gmail credentials: OAuth tokens provided when a business client connects their Gmail account for payment automation (see Section 6)
From end users (customers of our business clients) via WhatsApp
- Phone numbers of individuals who send WhatsApp messages to a business using Nova
- Message content: the text content of WhatsApp conversations between end users and our business clients
- Message metadata: timestamps, delivery status, message identifiers provided by the WhatsApp Business Platform
- This data is processed solely on behalf of and under the instruction of the relevant business client
Automatically collected information
- Log data: IP addresses, browser type, pages visited, time and date of visits
- Device information: device type, operating system
- Cookies and similar tracking technologies (see Section 10)
4. How we use information
Business client data
- To provide, operate, and improve the Nova platform
- To process payments and manage subscriptions
- To provide customer support
- To send service-related communications (updates, security alerts, billing notices)
- To comply with legal obligations
End user data (WhatsApp and messaging)
- To deliver WhatsApp messages to the correct business client inbox within Nova
- To enable business clients to view, manage, and respond to conversations
- To maintain conversation history on behalf of the business client
- To link messages to existing client records within the business client's database
We do not use end user message content for advertising, marketing, or any purpose other than delivering the messaging service described above. We do not sell end user data to any third party.
5. WhatsApp Business Platform integration
Nova integrates with the WhatsApp Business Platform, provided by Meta Platforms, Inc. When a business client connects their WhatsApp Business Account to Nova:
- Nova receives inbound WhatsApp messages sent to that business via a webhook registered with Meta
- Nova sends outbound messages on behalf of the business client through the WhatsApp Business API
- Message data is stored in our Firebase/Google Cloud infrastructure on behalf of the business client
- The business client retains full ownership of their WhatsApp Business Account and phone number
- Nova's use of WhatsApp data complies with Meta's WhatsApp Business Terms of Service and the WhatsApp Business Solution Provider Agreement
End users who message a business through WhatsApp should be aware that their messages are received and managed by that business using Nova as their platform tool. The business client is responsible for informing their customers about how their data is used in accordance with applicable law.
6. Gmail data
Nova offers an optional Gmail integration that allows business clients to automate payment reconciliation by reading payment confirmation emails from their Gmail inbox.
What we access
- Email subject lines, sender addresses, and body content of emails labeled "pagos" (payments) in the connected Gmail account
- Email metadata: message IDs, timestamps, and label information
How we use Gmail data
- To extract payment details (amount, date, payer, bank) from payment confirmation emails
- To record those payments in the business client's Nova account for reconciliation
- To relabel processed emails within the connected Gmail account to prevent duplicate processing
Gmail data is never used for advertising, never sold or shared with third parties, and never used for any purpose other than the payment automation service described above. Nova's use of Gmail data complies with the
Google API Services User Data Policy, including the Limited Use requirements.
Storage and retention of Gmail data
- Extracted payment data (amount, date, payer, bank) is stored in Firestore as part of the business client's Nova account
- Raw email content is not stored — only the structured payment fields extracted from it
- Gmail OAuth tokens are stored securely in Google Secret Manager and are never logged or exposed
- Business clients may revoke Gmail access at any time from their Nova settings or directly via their Google Account permissions page
7. Data storage and security
Nova stores data using Google Firebase and Google Cloud infrastructure. Google Cloud's security practices, certifications, and data processing terms apply and are available at cloud.google.com/security.
We implement appropriate technical and organizational measures to protect personal data including:
- Encryption in transit (TLS) and at rest
- Role-based access controls limiting who can access client data
- API key and OAuth token management through Google Secret Manager
- Regular security reviews of our codebase and infrastructure
Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to individuals, we will notify affected parties as required by applicable law.
8. Data retention
- Business client account data is retained for the duration of the subscription and for 90 days after account termination, after which it is permanently deleted upon request.
- WhatsApp message data is retained for as long as the business client's account is active. Business clients may delete individual conversations or request full data deletion at any time.
- Gmail-derived payment data is retained for as long as the business client's account is active or until the client requests deletion. Raw email content is not stored.
- Billing records are retained for 7 years as required by Colombian tax law (DIAN requirements).
- Log data is retained for 90 days for security and debugging purposes.
9. Sharing of information
We do not sell personal data. We share data only in the following circumstances:
- Service providers: We share data with Google (Firebase/Cloud infrastructure), Meta Platforms, Inc. (WhatsApp Business Platform), and payment processors strictly to deliver our service. These providers are bound by data processing agreements.
- Business client instructions: We process end user data on the instructions of our business clients. If a business client requests an export or deletion of their customer data, we comply.
- Legal requirements: We may disclose data if required by Colombian law, court order, or to protect the rights and safety of our users or the public.
- Business transfers: If Nova is acquired or merged, data may transfer to the acquiring entity, subject to the same privacy protections described here.
10. Cookies
Our platform uses essential cookies required for authentication and session management. We do not use advertising or tracking cookies. Business clients who are logged into Nova will have session cookies placed by Firebase Authentication.
11. Your rights
Under Colombia's data protection law (Ley 1581 de 2012 and Decreto 1377 de 2013), you have the right to:
- Know what personal data we hold about you
- Update or correct inaccurate data
- Request deletion of your data (right to be forgotten)
- Revoke consent for data processing where consent is the legal basis
- File a complaint with the Superintendencia de Industria y Comercio (SIC)
If you are an end user whose messages were processed through Nova (i.e., a customer of one of our business clients), your primary contact for data rights is the business you were messaging. You may also contact us directly and we will coordinate with the relevant business client.
To exercise any of these rights, contact us at legal@novaproduction.tech. We will respond within 10 business days.
12. International data transfers
Nova is operated from Colombia and primarily serves Colombian businesses. Data is stored on Google Cloud infrastructure. Google maintains Standard Contractual Clauses and other transfer mechanisms for international data transfers. By using Nova, business clients acknowledge that their data may be processed outside Colombia subject to Google's data processing terms.
13. Children's privacy
Nova is a business management platform intended for use by businesses and adults. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that a minor's data has been collected without appropriate consent, we will delete it promptly.
14. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify business clients via email or an in-platform notice at least 14 days before the changes take effect. The effective date at the top of this page will be updated. Continued use of Nova after changes take effect constitutes acceptance of the updated policy.