Privacy Policy & Data Protection

1. Commitment to Data Sovereignty

Novum Tech Lab LLC ("Company", "we", "us", or "our") operates the Nova Voice AI voice receptionist platform. We believe voice data and customer communications are strictly confidential business assets belonging solely to our subscribers. This Privacy Policy explains what information we collect, how it is processed to provide real-time telephony services, and our stringent technical safeguards.

2. Categories of Information We Collect

• Caller Telephony Metadata: Caller ID (inbound phone number), call start/end timestamps, call duration, telephony carrier latency metrics, and dialed DID numbers.
• Audio Streams & Transcripts: Real-time bi-directional audio packets streamed during telephone or web voice sessions, machine-generated text transcripts, and automated call summary notes.
• Knowledge Base Content: Customer-uploaded business documents, fee schedules, operating hours, employee benefit matrices, and prompt directives utilized to ground the voice agent's conversational responses.
• Account & Billing Information: Subscriber contact names, corporate email addresses, and Stripe payment identifiers (payment card numbers are processed directly by Stripe and never touch our servers).

3. Enterprise AI Safeguards: Zero Model Training Pledge

4. How We Use Collected Information

We process caller data strictly to execute the services requested by the subscriber:

• Conduct real-time, low-latency conversational phone calls and appointment scheduling.
• Transcribe and summarize customer inquiries for CRM synchronization and email/SMS alerts.
• Calculate monthly billable voice minutes and detect telephony quality issues.
• Protect against telecommunications fraud, spam, and denial-of-service abuse.

5. Telephony Providers & Infrastructure Partners

To operate our real-time voice infrastructure, data is processed in conjunction with vetted enterprise infrastructure providers:

• Google Cloud Platform (GCP): Hosts our Cloud SQL PostgreSQL databases, Cloud Run microservices, and Vertex AI WebSocket endpoints in encrypted US regions.
• Telnyx & Google Dialogflow CX: Carrier partners that route telephone calls across the public telecommunications network and deliver 10DLC SMS confirmations.
• Stripe: PCI-DSS Level 1 certified payment processing and customer subscription portal.

We do NOT sell, rent, or monetize personal information or caller records to any third party.

6. Multi-Tenant Data Isolation & Security

Novum Tech Lab employs defense-in-depth security engineering to safeguard customer information:

• Multi-Tenant Isolation: Data models in Cloud SQL PostgreSQL enforce strict foreign-key tenant scoping (`tenant_id`), preventing cross-tenant data leakage.
• Encryption Standards: Data in transit is protected using TLS 1.3 / HTTPS. Data at rest is encrypted using FIPS 140-2 validated AES-256 encryption.
• Access Governance: Administrative access is protected by multi-factor authentication and role-based access control (RBAC).

7. Data Retention & Deletion Rights (GDPR / CCPA)

Subscribers maintain full control over their historical call logs and recordings. Administrators may delete individual call logs, recordings, and knowledge documents at any time from the dashboard.

Under California Consumer Privacy Act (CCPA/CPRA) and European General Data Protection Regulation (GDPR), individuals have the right to request access, correction, or permanent deletion of their personal data.

8. Contact Our Data Protection Officer

If you have questions regarding this Privacy Policy, wish to execute a Data Processing Addendum (DPA), or request data deletion, contact: