.png&w=256&q=75){kind=small}
1.Who is responsible for your data
NOVA is provided by Bridgeye Private Limited, Ponda, Goa, India (Bridgeye, we). We decide how and why your personal data is processed for the Services, which makes us the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (and the “controller” in the language of other privacy laws).
This policy covers NOVA, NOVA CLI, NOVA Web, the NOVA API and this website. It forms part of our Terms of Service. Questions about it go to our Chief Information Security Officer, Wallace DSouza, at ciso@bridgeye.com.
For data that users of an app you publish store in it, you decide what is collected and why, and we process it on your behalf. See section 12.
2.What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, profile picture, and your GitHub or Google account identifier. Your onboarding answers, such as your role, and preferences such as theme. | The sign-in provider you choose, and you |
| What you create in NOVA | Projects and their files, version history and snapshots, chat messages with NOVA, files and images you attach, published sites and apps, and collaborators you invite. Secrets you store for a project are kept encrypted. | You |
| What the CLI sends | For each request: your instruction and the code or file context NOVA selected for it. We pass it to the AI model and do not keep it (section 3). | The CLI on your computer |
| Usage records | For each request or charge: time, feature, model used, request size in tokens, and credits charged. Not the prompt or reply. | Generated as you use NOVA |
| Model call log (NOVA) | For each model request NOVA makes for you: the model, timing, cost, whether it succeeded, and the first part of the prompt and of the reply — clipped, never the whole text. Requests from NOVA CLI are not logged this way. | Generated as you use NOVA |
| Billing | Billing name and address, GST number if you give one, what you bought, invoices, and payment references from Razorpay. | You, at checkout, and Razorpay |
| Connected services | If you connect GitHub repositories or a connector (for example Google Sheets, Gmail, Figma or Shopify): the access token that service issues, stored encrypted, and the data you ask NOVA to read from it. | You, when you connect |
| Domains | If you buy a domain: the registrant contact details you enter. | You |
| Technical | IP address, browser and device type, operating system, CLI version, error reports and security logs. | Your browser, the CLI and our servers |
| Messages | Emails you send us, and delivery status of emails we send you. | You, and our email provider |
3.How AI requests are handled
This is the part most people want to understand, so here it is step by step.
- You ask. In the CLI, NOVA reads your project on your computer and selects only the context the task needs. In Play, it uses your project’s files and the conversation so far.
- We route. The NOVA API checks your plan and credits and sends the request over an encrypted connection to the model that will do the work — the one you picked, or NOVA’s default for that task.
- The model provider processes it. Most models are reached through OpenRouter, which forwards the request to the model’s provider (for example Anthropic, OpenAI, Google, Moonshot AI or DeepSeek). Some are called directly, including Groq, NVIDIA and OpenAI.
- The answer comes back. In the CLI, changes are applied to your files on your machine. In Play, results are saved to your project.
- We record the charge, not the content. The NOVA API keeps the model, size and credits used, never the prompt or reply. For requests made from NOVA, we also keep a clipped excerpt of the prompt and reply (section 2) to investigate problems and costs.
What model providers do with it
- Each provider processes the request under its own terms and privacy policy, and may keep it for a limited time for abuse monitoring or as its policy states.
- We use settings and providers that do not allow your data to be used for model training wherever that choice exists. We do not allow training on your data ourselves. We cannot control every provider’s practices, so avoid sending anything you are not allowed to share with a third party.
- Providers may process requests outside India, including in the United States, Europe and China, depending on the model.
Using NOVA means your Input is sent to an AI model provider — there is no way to use an AI model without it. If you work with sensitive or regulated code or data, choose what you share accordingly, or ask us about it first.
4.What we don't collect or keep
- Your GitHub or Google password. We never see it.
- Card numbers, CVVs or bank credentials. Razorpay handles those under PCI-DSS.
- The content of CLI requests. It passes through to the model provider and is not stored on our servers.
- Your whole repository. The CLI sends only the context a task needs, when you run it.
- Anything from your computer when NOVA isn’t running, your clipboard, screen or browsing, or files outside the project you point NOVA at.
- Advertising data. We don’t run ads, and NOVA and this website load no third-party analytics or ad trackers (section 11 covers the sign-in page on NOVA Web).
The CLI keeps its sign-in and settings on your own computer, in a .nova folder in your home directory.
5.How we use your data, and why we're allowed to
| Purpose | Basis |
|---|---|
| Sign you in, run your requests, store and publish your projects, and show your usage and invoices | To provide the Services you asked for, and your consent when you sign up |
| Charge credits, take payments, issue tax invoices and keep financial records | Legal obligation (tax and accounting law) and the contract with you |
| Keep the Services secure: prevent fraud, abuse and account misuse, and fix errors | Legitimate use for the safety and integrity of the Services, and legal obligation |
| Send service emails: receipts, security alerts, changes to these policies, and notices about your account | To provide the Services; you cannot opt out of these while you have an account |
| Send product news and offers | Your consent; unsubscribe from any such email at any time |
| Understand how NOVA is used, in aggregate, to improve it | Legitimate use, using counts and usage records rather than your content |
| Respond to lawful requests from authorities | Legal obligation |
We do not use your content to train AI models, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
7.Where your data is stored
- NOVA — including your projects, files, chat history and published sites — and this website run on servers in Boston, USA.
- The NOVA API and NOVA Web run on servers in Boston, USA.
- Account, plan and billing records are stored with Google Cloud (Firebase).
- AI requests are processed by model providers in the countries where they operate, including the United States, Europe and China.
Where data leaves India, we rely on the protections of our contracts with these providers and on encryption in transit, and we follow any restriction the Indian government places on transfers to particular countries.
8.How long we keep it, and deleting your account
When you delete your account, your data is deleted at the same time. The only exceptions are listed below.
| Data | Kept |
|---|---|
| Account and profile | Until you delete your account |
| NOVA projects, files, history and chat | Until you delete them, or your account |
| Published sites and apps, and their users’ data | Until you unpublish or delete them, or your account |
| Content of CLI requests | Not stored by us |
| Usage and credit records | Until you delete your account |
| Model call log excerpts (NOVA) | Until you delete your account |
| Connected-service tokens | Until you disconnect the service, or delete your account |
| Invoices and payment records | For the period Indian tax and accounting law requires, even after your account is deleted |
| Security logs | For a short period, then deleted |
| Backups | Our database backups are a small rolling set that is continually overwritten, so deleted data disappears from them as they roll over |
To delete your account, email support@bridgeye.com from the email address on your account with “Delete my account”. Data already sent to a model provider is subject to that provider’s retention.
9.How we protect it
- Encryption in transit (TLS) for every connection to NOVA and to model providers.
- Project secrets, connected-service tokens and GitHub tokens are encrypted at rest.
- Sign-in cookies are HTTP-only, so page scripts cannot read them, and session tokens are rotated.
- Access to production systems is restricted to people who need it, and is logged.
- Published sites run on separate domains from your NOVA session, so a site cannot act as you.
- Rate limits protect sign-in against abuse.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India as the law requires. To report a security issue, email ciso@bridgeye.com.
10.Your rights
Under the Digital Personal Data Protection Act, 2023 and other laws that may apply to you, you can:
- Access a summary of the personal data we hold about you and how we use it.
- Correct, complete or update it. Much of it you can see and change in your account at your account page.
- Erase it, by deleting your account (section 8).
- Withdraw consent at any time. This does not affect what was done before, and may mean we cannot keep providing the Services.
- Get a copy of your data in a portable format.
- Nominate someone to exercise your rights if you die or become unable to.
- Complain to us (section 15) and, if you are not satisfied, to the Data Protection Board of India or your local authority.
Email ciso@bridgeye.com from the address on your account. We will confirm who you are before acting and respond within the time the law requires.
12.Apps you build and their users
If an app you publish with NOVA lets its own users sign up, submit forms or upload files, that data belongs to your app. You decide what it collects and why, and you are responsible to those users for it, including giving them a privacy notice. We store and process that data only on your instructions, to run your app, and keep it secure as described here. We do not use it for anything else.
If one of your app’s users contacts us, we will refer them to you. Contact ciso@bridgeye.com if you need our help responding to a request.
13.Children
NOVA is not for children under 13. Users between 13 and 18 may use it only with the verifiable consent and supervision of a parent or legal guardian. We do not track or target advertising at children. If you believe a child has given us data without that consent, email ciso@bridgeye.com and we will delete it.
14.Changes to this policy
We will update this policy when our practices or the law change. For material changes we will email you or tell you in the product at least 30 days before they take effect. The date at the top shows the latest version.
15.Contact and grievances
Our Chief Information Security Officer handles privacy questions, data requests and grievances:
| Name | Wallace DSouza, Chief Information Security Officer |
| ciso@bridgeye.com | |
| Post | Bridgeye Private Limited, Ponda, Goa, India |
| General support | support@bridgeye.com |
Include your name, the email on your account, what happened, and what you would like us to do. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.