Privacy Policy

1. Introduction

novaplan ("novaplan", "we", "us", or "our") provides financial planning and analysis (FP&A) software to finance teams. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform at app.getnovaplan.com (the "Service") and our marketing site at getnovaplan.com. We take the confidentiality of financial data extremely seriously and have designed our platform with data-minimization and security-by-default principles.

2. Information We Collect

Account information. When you or your organization creates an account, we collect names, email addresses, job titles, and authentication identifiers (including Google SSO subject IDs when you sign in with Google).

Customer financial data. As part of delivering the Service, we process data your organization uploads or connects, including general ledger transactions, headcount and compensation records, budgets, forecasts, vendor data, and other financial information ("Customer Data"). Customer Data is owned by your organization and processed on its behalf.

Integration data. When you connect third-party systems (e.g., NetSuite, HiBob, Google Drive, Slack), we receive data from those systems using credentials you authorize. We only request the scopes strictly needed to deliver the functionality you enable.

Usage data. We collect product telemetry such as pages visited, features used, performance metrics, and error logs to operate and improve the Service.

Cookies. We use strictly necessary cookies for authentication and session management, and limited analytics cookies to measure product usage.

3. How We Use Information

• To provide, operate, and maintain the Service for your organization.
• To authenticate users and enforce role-based access controls.
• To process Customer Data strictly according to your organization's instructions and the subscription agreement.
• To monitor performance, detect abuse, and improve reliability and security.
• To communicate with you about the Service, including security notices and product updates.
• To comply with legal obligations and respond to lawful requests.

We do not sell Customer Data. We do not use Customer Data to train third-party machine learning models. Any AI features that process Customer Data (for example, Nova, our embedded assistant) operate under zero-retention agreements with our model providers.

4. Legal Bases for Processing (GDPR)

For users in the European Economic Area or United Kingdom, we process personal data on the legal bases of: (a) performance of a contract with your organization, (b) our legitimate interests in operating and securing the Service, (c) compliance with legal obligations, and (d) your consent where required.

5. Sharing and Disclosure

We disclose information only in the following circumstances:

• Sub-processors. We rely on vetted infrastructure providers to operate the Service, including cloud hosting, database, authentication, email, and observability vendors. A current list of sub-processors is available on request.
• Your organization. Users within your organization may access Customer Data according to the permissions granted by your administrators.
• Legal requirements. We may disclose information when required by law, subpoena, or to protect our rights, users, or the public.
• Business transfers. In the event of a merger, acquisition, or asset sale, information may be transferred, subject to standard confidentiality protections.

6. Data Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access controls, audit logging, dependency and vulnerability scanning, and isolated per-tenant data boundaries. No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security, but we continuously invest in strengthening our controls.

7. Data Retention

We retain Customer Data for the duration of your subscription and for a limited period thereafter to allow for export or account recovery, as specified in the subscription agreement. Upon written request after termination, we will delete or return Customer Data within thirty (30) days, except where retention is required by law.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port personal data we hold about you, and to object to certain processing. Because novaplan acts as a processor on behalf of your organization, we will typically route such requests to your organization's administrator. To exercise your rights, contact us at the address below or reach out to your organization's novaplan administrator.

9. International Data Transfers

novaplan is based in the United States and may process data in the United States and other countries where our sub-processors operate. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms to protect international transfers of personal data.

10. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, data-subject requests, or security concerns, contact:
privacy@getnovaplan.com