Privacy policy

Last updated: 2 November 2026

This policy explains what personal data we process, why, who it is shared with and what rights you can exercise. It covers two distinct things: the app-nove.com website as it works today, and the novE application (my.app-nove.com and the phone apps), open for testing since September 2026 and to the public on 2 November 2026.

Who the controller is

NOVE SRL, Rue des Brigades d’Irlande 24, 6010 Charleroi, Belgium
Company number: 1040.631.440
Contact for any question or request about your data: info@app-nove.com

We have not appointed a data protection officer: the nature of our processing does not require one. Your requests are handled directly by the company.

The website: waiting list

Until 1 November 2026, the site let you join a waiting list to be told when the application opened. Signing up is no longer offered: this section concerns the people who had joined it.

What we collect

When you joined the waiting list, we recorded:

• your email address (required);
• the type of profile you indicate, homeowner or professional (optional);
• your consent to receive product news, collected through the confirmation you give by email;
• the language of the page and the date you signed up;
• where your visit came from when the link you followed said so, for example “instagram”, or otherwise the name of the site you arrived from. We use this only to know which channels work.

Why, and on what basis

To let you know when the application becomes available and to send you information related to that launch. The legal basis is your consent (Article 6(1)(a) GDPR), collected through an email confirmation: your address was only added to our list once you had clicked the confirmation link.

For how long

Until you withdraw your consent, and at the latest until 1 November 2027, when the list will be deleted. Every email we send contains an unsubscribe link that takes effect immediately.

Cookies and analytics

The site sets no cookies. The fonts are served from our own domain, so that no third party receives your IP address when the page loads. The only resource loaded from outside our domain is the analytics script of Cloudflare, our host, served by static.cloudflareinsights.com and described below: Cloudflare then receives your IP address, just as it already does to serve you every page of the site.

We use Cloudflare Web Analytics to measure traffic. It works without cookies and without any persistent identifier. It tells us how many pages were viewed, which pages, which site visitors arrived from, the country and the type of device. It does not record URL parameters and cannot recognise you from one visit to the next: we cannot identify you from these measurements.

To know where a sign-up comes from, the site keeps where your visit came from (for example “instagram”) in your browser’s session storage, for as long as the tab is open: it is erased when you close the tab, cannot identify you and is only sent along with your sign-up, if you sign up.

That is why you see no consent banner: no cookie is set and none of the data collected can identify you.

Our host keeps technical connection logs, which are necessary for the security and availability of the service.

The application, for its part, stores on your device what it needs to work: your sign-in session, and the language and theme you have chosen. None of this is used to track you, and nothing is shared.

The application

The processing described here applies to the use of the novE application.

What we process

• Account: email address, first and last name, password stored as an irreversible hash, display preferences, and, if you provide them, phone number, company and date of birth. If you sign in with Google or Apple, the identifier that service sends us to recognise you.
• Your project content: project names, budget line items, expenses, quotes, amounts, grants, notes, tasks and deadlines.
• Documents you upload: quotes, invoices, certificates, permits, plans, deeds, grant paperwork. These documents may contain personal data about you or about third parties, in particular your contractors.
• Photos you add to a project. They are kept as you send them, with their metadata: a photo taken with a phone may contain the date, the device model and, if location was turned on, the place where it was taken. This information travels with the photo to the people you give access to the project and into its exports.
• People you invite: their email address and the rights you grant them. The invitation email tells them where their address came from and how to have it erased.
• Billing data: needed for your subscription, handled by our payment provider. We never have access to your card details.
• Newsletter: your choice (yes or no) and, if you said yes, the date you agreed.

Why, and on what basis

• Providing the service you subscribed to: performance of the contract (Article 6(1)(b)).
• Invoicing and accounting: compliance with our legal obligations (Article 6(1)(c)).
• Keeping the service secure, preventing abuse, keeping technical logs and the log of actions taken in our administration tool: legitimate interest (Article 6(1)(f)).
• Writing to you about the service (important new feature, maintenance, change to the terms, help getting started): performance of the contract and legitimate interest (Article 6(1)(b) and (f)).
• Sending you our newsletter (news, tips and offers), only if you asked for it: your consent (Article 6(1)(a)).

We carry out no automated decision-making with legal effect for you, and we build no advertising profiles. Your data is never sold, rented or traded.

Automatic reading of your documents

Automatic reading relies on an artificial intelligence system. When you ask for a quote or invoice to be read automatically, the document is sent to a specialist provider (Mistral AI, in France), whose artificial intelligence model extracts the amounts and returns them. The application tells you so before anything is sent, next to the switch that controls automatic reading. It is offered by default when you add a document, and you can turn it off at that moment or in the application’s Settings (the choice is remembered). The provider acts as a processor, on our instructions, and is not permitted to use your documents for any other purpose, nor to train its models. It may keep the request for up to 30 days to detect abuse of its service, and then erases it.

Signing in with Google or Apple

If you choose to sign in with Google or Apple, that service authenticates you and sends us your email address, your name and an identifier specific to your account; we never receive your password. Google and Apple then act as controllers of their own processing, under their own policies. To display these buttons, the application’s sign-in page loads elements provided by Google and Apple, which receive your IP address and your browser’s technical information at that moment, even if you do not use these buttons.

Subscription taken out in an app

If you subscribe in the iPhone or Android app, payment is handled by Apple or Google, which act as controllers of their own processing, under their own policies. Through our provider RevenueCat, we receive the status of your subscription (plan, dates, renewal, cancellation, refund), linked to your novE account identifier; never your payment details. This information is erased at RevenueCat when you delete your account.

Emails and newsletter

Once your email address is confirmed, your account is recorded in our email tool (Brevo) with: your email address, your first and last name, the language of the application, the state of your subscription (trial, subscribed or expired), the date you signed up, and your newsletter choice with its date. Nothing else: not the content of your projects, not your documents, not your phone number. This information is used to write to you about the service, in your language.

The newsletter is optional: the box is unticked when you sign up, and you can turn it on or off at any time in the application’s Settings. Every email sent from this tool contains an unsubscribe link that takes effect immediately. Unsubscribing does not stop the emails your account needs (address confirmation, password, subscription, security).

The other members of a shared project

When a project is shared, its members see the names and email addresses of the people who have access to it, and who added what. The project owner decides who has access to it.

Who your data is shared with

We use the following processors. Each is bound by a contract that limits what it may do with your data.

This table covers every provider in use, for the website and for the application alike.

Some of these providers belong to groups established outside the European Union, mainly in the United States. Cloudflare, Functional Software (Sentry) and Stripe are certified under the EU-US Data Privacy Framework, which allows these transfers on the basis of a decision of the European Commission; any other transfers are covered by the Commission’s standard contractual clauses. At Sentry, technical errors are stored in Germany, but the data of our own account with that provider is stored in the United States.

We may also have to disclose data to a public authority where the law requires it.

How long we keep your data

• Account and project content: for as long as your account exists. An account with no subscription and no sign-in for 24 months may be deleted, after a warning email sent at least 30 days beforehand. When you delete your account or a project, the data is erased immediately from our active systems, and the files (documents, photos) from our storage within minutes.
• Sign-up never confirmed: an account whose email address has not been confirmed is deleted after 7 days, with everything attached to it, including the record created at our payment provider.
• Backups: the database is backed up every day and backups are kept for 7 days, then overwritten. Deleted data therefore disappears from them within 7 days at the latest.
• Technical error logs of the application: 30 days.
• Technical server logs of the application: 7 days at our host.
• Notifications in the application: 90 days.
• Project exports (archives ready to download): 7 days.
• Invitations: the link is valid for 7 days; the invitation, with the invited person’s address, is erased 30 days after the link expires, whether or not it was accepted. If you accept an invitation with an account opened under another address, the invited address is kept with your access to the project, so that removing that access also applies to it: it disappears with the access, and appears in the “Download my data” file.
• Sign-in sessions: 30 days after they end or expire.
• Administration log: when the novE team views or changes an account from its administration tool, the action is recorded with the email address of the account concerned. This log is used to keep the service secure and is kept for 12 months, including after the account is deleted.
• Customer record at our payment provider: deleted with your account if you have never paid anything; otherwise kept with the invoices (see below).
• Accounting and invoicing records: 10 years, as required by Belgian law. They are kept even after your account is deleted.
• Contact record in our email tool: as long as your account exists; it is deleted with it. Your agreement to the newsletter lasts until you withdraw it.
• Waiting list: see above.

Your rights

You have the right to access, rectify, erase, restrict processing of, and object to the processing of your personal data, as well as the right to data portability, that is, to receive your data in a usable, machine-readable format. You may also withdraw your consent at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to info@app-nove.com. We respond within one month. We may need to verify your identity first, so as not to disclose your data to someone else.

If our response does not satisfy you, you may lodge a complaint with the Belgian supervisory authority:

Data Protection Authority
Rue de la Presse 35, 1000 Brussels
dataprotectionauthority.be

Getting your data

In My profile, the Download my data button gives you a machine-readable file of what novE keeps on your account. From the dashboard of each of your projects, the Export button gives you an archive of all your files, organised as in the application, and a PDF summary. For any other data, write to us at info@app-nove.com: we respond within one month.

Deleting your account

You can delete your account at any time from the application, under My profile, or just one project, from its Edit page. Deletion is permanent, and your subscription is cancelled immediately. Documents and photos you added to someone else’s project stay in that project, without your name. The details, and what to do if you can no longer access your account, are on the Delete your account page.

Security

We put in place appropriate technical and organisational measures to protect your personal data against accidental or unlawful alteration or loss, and against any unauthorised use, disclosure or access. We take all reasonable steps, in line with the principles of privacy protection, to put the necessary safeguards in place and secure the processing of your data. On request at info@app-nove.com, NOVE SRL describes the security measures in place to protect the personal data it processes.

In practice, exchanges with the site and the application are encrypted in transit (HTTPS). Passwords are stored as non-reversible hashes. Access to production systems is restricted to those who need it. The documents you upload are accessible only to you and to the people you have explicitly invited, within the rights you gave them.

No system is infallible. In the event of a data breach presenting a risk to your rights and freedoms, we will inform the supervisory authority and, where the risk is high, you as well.

Minors

The waiting list is not intended for people under 16, and the application is reserved for adults. We do not knowingly collect the data of a minor.

Changes

We may update this policy, in particular when the application becomes available. The date of the last update appears at the top of this page: that date is what counts, and we invite you to check it from time to time. Should a change alter the very nature of what we do with your data, for instance using it for a new purpose, we would tell you by email and you could unsubscribe in one click.

Applicable law and jurisdiction

This policy is governed by Belgian law. Any dispute relating to its interpretation or performance is subject to the courts of the judicial district of Hainaut, Charleroi division, without prejudice to your right to bring proceedings before the courts of the European Union Member State where you live (Article 79 of the GDPR) and to lodge a complaint with a supervisory authority.

← Back to the home page