Privacy policy
Last updated: 8 September 2026
This policy explains what personal data we process, why, who it is shared with and what rights you can exercise. It covers two distinct things: the app-nove.com website as it works today, and the novE application, whose processing described below will apply from the moment it becomes available.
Who the controller is
Nove App SRL, Rue des Brigades d’Irlande 24, 6010 Couillet, Belgium
Company number: 1040.631.440
Contact for any question or request about your data:
marketing@app-nove.com
We have not appointed a data protection officer: the nature of our processing does not require one. Your requests are handled directly by the company.
The website: waiting list
What we collect
When you join the waiting list, we record:
- your email address (required);
- the type of profile you indicate, homeowner or professional (optional);
- your consent, if given, to receive news beyond the launch announcement;
- the language of the page and the date you signed up;
- where your visit came from when the link you followed said so — for example “instagram” — or otherwise the name of the site you arrived from. We use this only to know which channels work.
Why, and on what basis
To let you know when the application becomes available and to send you information related to that launch. The legal basis is your consent (Article 6(1)(a) GDPR), collected through an email confirmation: your address is only added to our list once you have clicked the confirmation link.
For how long
Until you withdraw your consent, and at the latest 24 months after you signed up if the application has not become available by then. Every email we send contains an unsubscribe link that takes effect immediately.
Cookies and analytics
The site sets no cookies. It loads no resource from a third-party server: the fonts are served from our own domain, precisely so that no third party receives your IP address when the page loads.
We use Cloudflare Web Analytics to measure traffic. It works without cookies and without any persistent identifier. It tells us how many pages were viewed, which pages, which site visitors arrived from, the country and the type of device. It does not record URL parameters and cannot recognise you from one visit to the next: we cannot identify you from these measurements.
That is why you see no consent banner — no cookie is set and none of the data collected can identify you.
Our host keeps technical connection logs, which are necessary for the security and availability of the service.
The application
The processing described here will apply to the use of the novE application.
What we will process
- Account: email address, password stored as an irreversible hash, display preferences.
- Your project content: project names, budget line items, expenses, quotes, amounts, grants, notes, tasks and deadlines.
- Documents you upload: quotes, invoices, certificates, permits, plans, deeds, grant paperwork. These documents may contain personal data about you or about third parties, in particular your contractors.
- Photos you add to a project.
- People you invite: their email address and the rights you grant them.
- Billing data: needed for your subscription, handled by our payment provider. We never have access to your card details.
Why, and on what basis
- Providing the service you subscribed to: performance of the contract (Article 6(1)(b)).
- Invoicing and accounting: compliance with our legal obligations (Article 6(1)(c)).
- Keeping the service secure, preventing abuse, keeping technical logs: legitimate interest (Article 6(1)(f)).
- Sending you commercial information: your consent (Article 6(1)(a)), which you can withdraw at any time.
We carry out no automated decision-making with legal effect for you, and we build no advertising profiles. Your data is never sold, rented or traded.
Automatic reading of your documents
When you ask for a quote or invoice to be read automatically, the document is sent to a specialist provider that extracts the amounts and returns them. This happens only when you trigger it, document by document. The provider acts as a processor, on our instructions, and is not permitted to use your documents for any other purpose.
Who your data is shared with
We use the following processors. Each is bound by a contract that limits what it may do with your data.
| Provider | Role | Location |
|---|---|---|
| Brevo (Sendinblue SAS) | Sending emails and managing the waiting list | France |
| Cloudflare, Inc. | Website hosting, delivery, traffic measurement, storage of documents and photos | United States, delivery and storage in the European Union |
| Mistral AI SAS | Automatic reading of quotes and invoices | France |
| Stripe Payments Europe, Ltd. | Subscription payments and invoicing | Ireland, group established in the United States |
| Our application host | Running the application and its database | European Union |
Some of these providers belong to groups established outside the European Union. Any transfers are covered by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical measures.
We may also have to disclose data to a public authority where the law requires it.
How long we keep your data
- Account and project content: for as long as your account exists, then 30 days after its deletion, after which the data is erased from our active systems.
- Backups: encrypted backups are kept for at most 35 days, then overwritten in rotation.
- Accounting and invoicing records: 7 years, as required by Belgian law.
- Technical security logs: 12 months.
- Waiting list: see above.
Your rights
You have the right to access, rectify, erase, restrict processing of, and object to the processing of your personal data, as well as the right to data portability — that is, to receive your data in a usable, machine-readable format. You may also withdraw your consent at any time, without affecting the lawfulness of processing already carried out.
To exercise these rights, write to marketing@app-nove.com. We respond within one month. We may need to verify your identity first, so as not to disclose your data to someone else.
If our response does not satisfy you, you may lodge a complaint with the Belgian supervisory authority:
Data Protection Authority
Rue de la Presse 35, 1000 Brussels
dataprotectionauthority.be
Security
Exchanges with the site and the application are encrypted in transit (HTTPS). Passwords are stored as non-reversible hashes. Access to production systems is restricted to those who need it. The documents you upload are accessible only to you and to the people you have explicitly invited, within the rights you gave them.
No system is infallible. In the event of a data breach presenting a risk to your rights and freedoms, we will inform the supervisory authority and, where the risk is high, you as well.
Minors
The service is not intended for people under 16 and we do not knowingly collect their data.
Changes
We may update this policy, in particular when the application becomes available. The date of the last update appears at the top of this page. In the event of a substantial change, people on the list will be informed by email.