Privacy

1. Who we are and what this policy covers

Novamind Labs is building Novie, the enterprise agentic AI platform: the platform organisations use to build, run and govern their AI workforce. Your agents. Your models. Your cloud. The platform has three products: Novie Control, Novie Build and MyNovie.

This Privacy Policy is issued by Novamind Labs Limited (NZBN 9429053272461), 34 Tritton Drive, Rosedale, Auckland 0632, New Zealand ("Novamind", "we", "us"). It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

It applies to:

• the website at novamindlabs.ai and any other site that links to this policy (the "Website");
• the Novie Control, Novie Build and MyNovie products, our APIs, and related support and professional services (together with the Website, the "Services");
• our marketing, events, recruitment and business communications.

It does not apply to third-party websites, models or services that you reach through the Services. Their own privacy notices govern them.

1.1 Two roles we play

We handle personal information in two distinct roles, and which role applies changes what this policy means for you.

Novamind as the responsible agency (controller). When you browse the Website, contact us, attend an event, apply for a job, or evaluate the Services, we decide how and why your information is used. This policy applies in full.

Novamind as a processor (service provider) for an Enterprise customer. When your employer or another organisation (an "Enterprise Customer") gives you access to the Services, that organisation decides what data is connected, who can see it, and how it is used. We process that data on the Enterprise Customer's instructions under our agreement with them. In that case:

• the Enterprise Customer's privacy policy governs how your information is used;
• questions and requests about your information should go to the Enterprise Customer first;
• your administrator can access, export, restrict and delete data in your workspace.

This policy still describes the practices we apply to everyone's data (sections 8 and 9), and it applies in full to the account and usage information we hold about you as an individual user.

2. Personal information we collect

2.1 Information you give us

• Account information. Name, work email address, job title, organisation, password or single sign-on identifier, profile photo, language and notification preferences.
• Contact and enquiry information. What you tell us when you fill in a form, book a meeting, email hello@novamindlabs.ai, or message our team.
• Payment information. Billing name, billing address and tax details. Where payment is taken by card, card details are collected and stored by our payment processor, Stripe. We receive a token, the card type and the last four digits only.
• Inputs and Outputs. The prompts, instructions, files, agent definitions, workflow configurations and other content you submit to the Services ("Inputs"), and the responses, agent actions, summaries and other results the Services generate ("Outputs"). Inputs and Outputs may contain personal information about you or others.
• Feedback. Ratings, survey responses, comments and other feedback you choose to provide.
• Event and research participation. Registration details for events, webinars, customer research and design partner sessions, including recordings where you consent to them.
• Recruitment information. CV, employment history, references and interview notes if you apply to work with us.

2.2 Information from systems you or your organisation connect

The Services work on data from the systems your organisation already runs. Depending on what your organisation chooses to connect, this can include Microsoft 365, Slack, Jira, Confluence, Databricks, ServiceNow, Salesforce, Linear, and model providers such as Anthropic, OpenAI, GitHub, xAI or self-hosted models ("Connected Systems").

Connected Systems data may include documents, messages, tickets, calendar entries, records and metadata, and any personal information they contain. Our commitments for this data are:

• You choose what is in scope. Nothing is read from a Connected System until an authorised administrator connects it and sets its scope. What is in scope is visible to the people it covers.
• Masked before processing. Where masking rules are configured, data matching them is masked before it is processed.
• Role-aware permissions. The Services respect the permissions of the source system. A person sees through the Services only what they are already permitted to see at the source.
• Read-first oversight. Novie Control reads usage, cost and policy signals and changes nothing in your Connected Systems.

2.3 Information we collect automatically

• Usage information. Features used, agents built and run, models selected, tokens and spend recorded, workflows executed, pages viewed, actions taken in the Services and when.
• Device and connection information. IP address, browser and operating system, device identifiers, time zone, language, and referring pages.
• Logs and telemetry. Server logs, error reports, latency and performance metrics, and security event logs.
• Cookies and similar technologies. See section 10.

2.4 Information from other sources

• Your organisation. An Enterprise Customer may provide your name, role and email address to create your account, and an administrator may set your permissions and view your usage.
• Identity providers. If you sign in with single sign-on, your identity provider sends us your name, email address and group memberships.
• Business and marketing partners. Publicly available professional information and information from data providers, event organisers and resellers, used to understand our market and to contact organisations that may be interested in the Services.
• Public sources. Company websites and professional networks, used for the same purpose.

3. Why we use personal information

We use personal information for the following purposes. The corresponding legal bases under the GDPR and UK GDPR appear in section 12 for people in the EEA and United Kingdom.

1. To provide the Services. Create and manage accounts, authenticate you, run agents and workflows, return Outputs, record usage and cost, and provide support.
2. To run our business. Bill and collect payment, manage subscriptions and contracts, keep accounting and tax records.
3. To keep the Services secure and reliable. Detect and prevent fraud, abuse and security incidents, debug errors, monitor performance and capacity.
4. To improve the Services. Understand how features are used, test and improve product quality, and develop new features. Where we use Inputs, Outputs or Connected Systems data for this purpose we do so in aggregated or de-identified form.
5. To communicate with you. Send service notices, security alerts, invoices and responses to your enquiries.
6. To market our Services. Send information about our products, research, events and writing to people we reasonably believe are interested, subject to your right to opt out (section 6).
7. To enforce our terms and protect rights. Investigate breaches of our Terms of Service, protect the rights, property and safety of Novamind, our customers and others, and establish, exercise or defend legal claims.
8. To comply with the law. Respond to lawful requests, meet regulatory and reporting obligations, and comply with court orders.
9. To recruit. Assess applications and manage the hiring process.

3.1 What we do not do

• We do not train foundation models on your data. Novamind has no model of its own to sell. We do not use your Inputs, Outputs or Connected Systems data to train or fine-tune large language models, ours or anyone else's.
• We do not sell personal information, and we do not share it with third parties for their own advertising.
• We do not make decisions about you by solely automated means that produce legal or similarly significant effects. The Services surface information and recommendations to people. Decisions that produce legal or similarly significant effects on you stay with named people in your organisation.

4. Third-party model providers

The Services let your organisation route work to the models it selects, including commercial providers, open-weight models and models hosted inside your own environment. When an agent or workflow runs, the relevant Inputs are sent to the selected provider to generate an Output.

• Your organisation chooses which providers are available, and Novie Control lets it set policy on which models can be used for which work.
• Each provider processes data under its own terms. We connect to commercial providers such as Anthropic, OpenAI, GitHub and xAI through their business and API services, whose terms provide that customer content is not used to train the provider's models. Providers publish and may change their own terms, and we encourage you to review them.
• For self-hosted and private models, Inputs never leave your organisation's environment.

For the current list of model providers and other service providers we use, contact legal@novamindlabs.ai.

5. Who we share personal information with

We share personal information only as described here.

• Your organisation. If you use the Services through an Enterprise Customer, that organisation's administrators can see your account details, permissions, usage and cost data, and the content in workspaces they administer.
• Service providers. Companies that host our infrastructure, process payments, send email, provide analytics, customer support tooling and security monitoring, acting on our instructions under contract. A current list is available on request from legal@novamindlabs.ai.
• Model providers. As described in section 4, according to your organisation's selection.
• Connected Systems. When you or an agent acting on your instructions writes to a Connected System (for example, creating a ticket), the relevant data is sent to that system under its own terms.
• Professional advisers. Lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Authorities and other parties where required by law. To comply with a legal obligation, court order or lawful request; to protect the rights, property or safety of Novamind, our customers or the public; or to enforce our terms.
• Corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.
• With your consent or at your direction.

6. Marketing communications

We send marketing only to people who have asked to hear from us, or where we have a reasonable basis to believe a business contact is interested in our Services, consistent with the Unsolicited Electronic Messages Act 2007 (New Zealand), the Spam Act 2003 (Australia) and equivalent laws.

Every marketing email includes an unsubscribe link. You can also opt out at any time by emailing legal@novamindlabs.ai. Opting out of marketing does not stop service, security and billing notices, which we must send to run your account.

7. International transfers

We are based in New Zealand and work with organisations across New Zealand and Australia. The Services are hosted with established cloud providers, and our service providers may process data in other countries, including Australia, the United States and the European Union. For current hosting locations, and to discuss in-region hosting for your organisation, contact legal@novamindlabs.ai.

New Zealand has been recognised by the European Commission as providing an adequate level of data protection. Where we transfer personal information from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on Standard Contractual Clauses (and the UK Addendum where relevant) and supplementary measures.

Where we disclose personal information outside New Zealand, we take reasonable steps to ensure the recipient is subject to comparable privacy safeguards, as required by Information Privacy Principle 12 of the Privacy Act 2020. Enterprise Customers can agree data residency requirements with us in their agreement.

8. Retention

We keep personal information for as long as we need it for the purposes in section 3, and then delete or de-identify it. As a guide:

Backups are deleted on a rolling schedule. Aggregated or de-identified data that no longer identifies anyone may be kept indefinitely. For our detailed retention schedule, contact legal@novamindlabs.ai.

9. Security

We protect personal information with technical and organisational measures appropriate to its sensitivity, including encryption in transit and at rest, role-based access control, multi-factor authentication for our staff, logging and monitoring, and secure development practices. Our security programme is described on our Security page at novamindlabs.ai/security.

No system is completely secure. If we become aware of a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act 2020, and meet any other notification obligations that apply, including the 72-hour requirement under the GDPR where relevant. For Enterprise Customers we notify the customer without undue delay so that they can meet their own obligations.

10. Cookies and similar technologies

We use cookies and similar technologies on the Website and in the Services.

Strictly necessary cookies cannot be switched off. You can accept or decline analytics and marketing cookies through the cookie banner where one is shown, and change your choice at any time from the cookie settings link in the Website footer. You can also block or delete cookies in your browser, though parts of the Services may then not work. Google describes how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.

11. Your rights and choices

11.1 Everyone

Wherever you are, you can:

• Access and correct the personal information we hold about you. Under the Privacy Act 2020 you have a right to request access to, and correction of, your personal information. We respond within 20 working days.
• Update your account details in the Services at any time.
• Delete your account and its content by asking your administrator, or by emailing us.
• Opt out of marketing (section 6) and of non-essential cookies (section 10).
• Complain. If you are unhappy with how we have handled your information, contact us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

If you use the Services through an Enterprise Customer, please direct requests to your organisation. We will help them respond.

11.2 Australia

If you are in Australia, we handle your personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). You may access and correct your information and complain to us and, if unresolved, to the Office of the Australian Information Commissioner (oaic.gov.au).

11.3 European Economic Area, United Kingdom and Switzerland

You have the rights to access, rectify, erase and port your personal information; to restrict or object to processing, including processing based on legitimate interests and any direct marketing; to withdraw consent at any time without affecting earlier processing; and not to be subject to solely automated decisions with legal or similarly significant effects. You may lodge a complaint with your local supervisory authority. Our legal bases appear in section 12.

11.4 Other regions

Residents of other jurisdictions may have similar rights under local law. We honour any right the law grants you. Contact us using the details in section 15.

11.5 How to make a request

Email legal@novamindlabs.ai or write to the address in section 15. We may need to verify your identity before acting. We do not charge for requests unless the law allows it and the request is manifestly excessive. We aim to respond within 20 working days (New Zealand), 30 days (Australia, EEA, UK) or sooner where the law requires.

12. Legal bases for processing (EEA, UK and Switzerland)

13. Children

The Services are for organisations and working professionals. They are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, contact legal@novamindlabs.ai and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will post the new version here with a new effective date, and notify account holders by email or in the Services at least 30 days before the change takes effect where practicable. Earlier versions are available on request.

15. Contact us

Novamind Labs Limited
34 Tritton Drive, Rosedale, Auckland 0632, New Zealand
Privacy and legal enquiries: legal@novamindlabs.ai
General: hello@novamindlabs.ai

Office of the Privacy Commissioner (New Zealand): privacy.org.nz, 0800 803 909.
Office of the Australian Information Commissioner: oaic.gov.au.