Privacy
policy.

Version 0.6 (DRAFT FOR LEGAL REVIEW, NOT YET IN EFFECT)
Effective date: October 26, 2026 · Last updated: October 26, 2026

This draft has not been reviewed by a lawyer. Have counsel review it before publishing, especially the legal bases, the international-transfer mechanism, and the state-law sections.

1. Who we are

Novesai ("Novesai", "we", "us") is a company organized in Illinois, USA. We provide Novesai Microsoft Frontier Advisory Services (consulting, assessments and enablement) and software products, including PRISM, our AI cost, quality and observability service. These may be offered directly or through Microsoft Marketplace.

This policy explains how we collect, use, store and share personal information when you visit noves.ai, contact us, buy or try our offers (including through Microsoft Marketplace), or use our services and software.

• Mailing address: Novesai, 432 E Juniper Drive, Palatine, IL 60074, USA
• Privacy contact: [email protected]

For most website, marketing and sales data, Novesai is the controller (the party that decides why and how the data is used). When we process data on a customer's behalf while delivering an assessment or running PRISM, the customer is the controller and Novesai is a processor (or "service provider") acting on the customer's instructions under our agreement with them.

2. Information we collect

a. Information you give us. When you email us at [email protected] or otherwise contact us: your name, email address, company, job title, and whatever you choose to include in your message.

b. Information Microsoft shares with us through Microsoft Marketplace. When you request contact, start a trial, or buy one of our offers on Microsoft Marketplace, Microsoft shares lead and transaction details with us, such as your name, email, company, country, phone number (if provided), the offer and plan you chose, and subscription, billing-status and tenant identifiers needed to activate and manage your subscription. Microsoft handles payment; we do not receive your full payment card details. Microsoft's own processing is covered by the Microsoft Privacy Statement.

c. Account and usage data for our software. When you use PRISM or other Novesai software: account details (name, work email, role, organization and tenant identifiers), sign-in and access records, settings, and service logs and telemetry about how the service runs (for example, errors, performance and feature usage).

d. Customer data we process to deliver our services. To deliver assessments, advisory work or PRISM, customers may give us access to, or send us, data from their systems, such as AI usage and cost records, billing exports (for example, FOCUS-format cost data), OpenTelemetry traces and metrics, configuration details, and related user identifiers. We process this data only to provide the services the customer asked for, under our agreement with that customer.

e. Website analytics and cookies. When you visit noves.ai, our hosting provider may automatically collect technical information such as your IP address, browser type and pages requested, for security and operations. We also use Plausible Analytics, a privacy-friendly analytics tool that uses no cookies and collects no personal data; it reports only aggregate statistics such as page views, referring sites, and country and device type. See section 8.

We do not intentionally collect sensitive categories of personal data (such as health data or biometric identifiers) and ask customers not to send them to us unless our agreement covers it.

3. How we use information, and our legal bases

Purpose	Examples	Legal basis (GDPR / UK GDPR)
Responding to inquiries	Answering emails, scheduling calls	Legitimate interests; steps before entering a contract
Providing and managing our offers	Activating Marketplace subscriptions, delivering assessments, running PRISM, support	Performance of a contract
Processing customer data for customers	Analyzing AI cost, quality and usage data for the customer	On the customer's instructions (the customer determines the legal basis)
Operating, securing and improving our services	Monitoring, troubleshooting, preventing abuse, improving features	Legitimate interests
Business communications	Sending service updates and, where permitted, information about our offers	Legitimate interests, or consent where the law requires it
Billing, legal and compliance	Records, tax, responding to lawful requests, enforcing our terms	Legal obligation; legitimate interests
Website analytics (non-essential cookies)	Understanding site usage	Consent, where the law requires it

We do not sell personal information, do not "share" it for cross-context behavioral advertising as defined in California law, and never use customer data to train AI models.

4. How we share information

We share personal information only as described here:

• Service providers (subprocessors) that help us run our business and services, under contracts that limit their use of the data. Our main hosting provider is Microsoft Azure (United States regions). We also use Plausible Analytics for cookieless website analytics. A current list of subprocessors is available at [PLACEHOLDER: subprocessor list URL, or "on request from [email protected]"].
• Microsoft, as marketplace operator, to list, sell, bill and support offers bought through Microsoft Marketplace.
• Partners, only when you or your organization asks us to work with them on an engagement, or with your consent.
• Legal and safety, when required by law or to protect rights, safety and security.
• Business transfers, if Novesai is involved in a merger, acquisition or sale of assets, subject to this policy.

5. International data transfers

Novesai is based in the United States, and our service providers may process data in other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful mechanism. We currently host customer data in the United States only. We may offer other hosting regions (for example, the UK or the EU) in the future and will update this policy when we do.

6. How long we keep information

We keep personal information only as long as we need it for the purposes above:

• Inquiries and leads: kept while we are actively in contact. Leads with no engagement may be purged during our monthly cleanup, and we delete lead data within 30 days of your request.
• Account and contract records: for the life of the relationship, plus as long as needed for legal, tax and accounting requirements.
• Customer data: for the term of the customer agreement; deleted within 30 days after the agreement ends or the customer asks us to delete it, unless the agreement or the law requires otherwise.
• Logs and telemetry: deleted within 30 days after the related contract ends or a deletion request is made. A monthly cleanup removes data that is past its retention period.

7. Security

We use administrative, technical and physical safeguards appropriate to the risk, including encryption in transit and at rest, access controls based on least privilege, tenant isolation for multi-customer services, and monitoring. No system is completely secure, and we will notify affected customers and individuals of a personal data breach as the law and our agreements require.

8. Cookies and analytics

noves.ai uses only the cookies and similar technologies needed to run the site, and we do not use advertising or tracking cookies. Our analytics tool, Plausible Analytics, is cookieless and does not collect personal data, so no cookie consent banner is needed. You can also block or delete cookies in your browser settings. Our software services may use cookies needed for sign-in and security.

9. Your rights

EEA and UK (GDPR / UK GDPR). You may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner's Office (ICO).

California (CCPA/CPRA). California residents may have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing (we do not sell or share it). We will not discriminate against you for using these rights. You may use an authorized agent.

Illinois and other US states. We comply with applicable Illinois law, including the Personal Information Protection Act. We do not collect biometric identifiers or biometric information covered by the Illinois Biometric Information Privacy Act (BIPA). Residents of other US states with consumer privacy laws may have similar rights to those above.

How to make a request. Email [email protected] with "Privacy request" in the subject. We may need to verify your identity before acting. We will respond within the time the law requires. If your request concerns data we process for one of our customers, we will refer you to that customer and help them respond.

10. Children

Our website and services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date and, for material changes, give notice where the law requires it.

12. Contact us

Questions or requests about this policy or our privacy practices:

• Email: [email protected]
• Mail: Novesai, 432 E Juniper Drive, Palatine, IL 60074, USA

Novesai Privacy Policy · Version 0.6