Privacy Policy

1. Introduction

Nova Atlas AI, operated by Clear Strategy, LLC ("we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing platform at novaatlas.ai.

By using Nova Atlas AI, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, company/brand name
• Brand Assets: Brand guidelines, logos, marketing assets, and content you upload
• Campaign Data: Campaign configurations, ad copy, creative assets, and scheduling preferences
• Payment Information: Billing details processed securely via Stripe (we do not store full card numbers)
• Communications: Messages you send to our support team or through the platform

2.2 Information from Third-Party Platforms

When you connect your social media or advertising accounts, we receive data from the following platforms:

• Meta (Facebook & Instagram): Page insights, ad account performance data, post engagement metrics, audience demographics, page/profile information, and content publishing status
• Google (Google Ads & Analytics): Ad campaign performance, keyword data, conversion metrics, and audience insights
• LinkedIn: Company page analytics, ad campaign performance, and engagement metrics
• TikTok: Content performance data, audience insights, trend data, and ad metrics
• Shopify: Store analytics, product catalog data, and sales performance relevant to marketing campaigns

2.3 Automatically Collected Information

• Device information (browser type, operating system)
• Usage data (pages visited, features used, session duration)
• IP address and approximate location
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our AI marketing platform and services
• Generate AI-powered marketing content, campaign strategies, and recommendations
• Display your advertising and social media performance analytics in unified dashboards
• Schedule and publish content to your connected platforms on your behalf
• Process payments and manage your subscription
• Send you service-related communications, updates, and support messages
• Analyze usage patterns to improve platform features and user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. Platform-Specific Data Practices

4.1 Meta (Facebook & Instagram)

We access Facebook and Instagram data through Meta's Graph API and Marketing API. Data collected includes:

• Page and profile insights (reach, engagement, views, follower metrics)
• Ad account insights (impressions, spend, clicks, conversions, CPM, CPC, CTR)
• Campaign, ad set, and ad-level performance data
• Instagram business account metrics (content interactions, audience demographics)
• Page Access Tokens (securely stored, used only for authorized API calls)

We do NOT:

• Sell or share your Meta data with third parties for their own purposes
• Use Meta data for purposes other than providing our marketing analytics and publishing services
• Store Meta data longer than necessary to provide our services (or as required by law)
• Use Meta data to discriminate against individuals or groups
• Transfer Meta data to data brokers or advertising networks

Data Deletion: You can disconnect your Facebook/Instagram accounts at any time from your Nova Atlas AI settings. Upon disconnection, we will delete your stored Meta Platform Data within 30 days. You may also request immediate deletion by contacting support@novaatlas.ai.

Meta may also notify us when a user deauthorizes our app or requests data deletion. We process these requests automatically via our Data Deletion Callback endpoint.

4.2 Google (Google Ads & Analytics)

We access Google data through Google's APIs. Our use complies with the Google API Services User Data Policy, including the Limited Use requirements. Data collected includes:

• Google Ads campaign performance metrics
• Keyword and search term performance data
• Conversion tracking data
• Audience and demographic insights

4.3 LinkedIn

We access LinkedIn data through the LinkedIn Marketing API. Data collected includes:

• Company page analytics and engagement metrics
• Ad campaign performance data (impressions, clicks, conversions)
• Audience demographics for advertising purposes

4.4 TikTok

We access TikTok data through TikTok's APIs. Data collected includes:

• Content performance metrics (views, likes, shares, comments)
• Trend and hashtag data for content strategy
• Ad campaign performance data
• Audience insights and demographics

4.5 Shopify

When connected, we access Shopify data to inform marketing strategies:

• Product catalog information (names, descriptions, images, pricing)
• Sales performance data relevant to marketing campaigns
• Store analytics for marketing attribution

4.6 Stripe (Payment Processing)

Payment processing is handled entirely by Stripe. We do not store complete credit card numbers, CVVs, or full bank account numbers on our servers. We only retain:

• Stripe customer ID (for managing your subscription)
• Last four digits of your payment method (for display purposes)
• Billing address and invoice history

5. AI and Your Data

Our platform uses artificial intelligence (AI) to generate marketing content, provide recommendations, and analyze campaign performance. Important details about AI and your data:

• No model training: We do NOT use your content, brand assets, or marketing data to train AI models
• Privacy by design: Your data is processed in isolated environments and is not visible to other users
• Third-party AI providers: We use AI services from Google (Gemini) and OpenAI for content generation. Data sent to these providers is governed by their respective enterprise data processing agreements, which prohibit them from using your data for model training
• Generated content ownership: All AI-generated content created through your account belongs to you

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service Providers: Third-party companies that help us operate our platform (hosting, databases, email, payment processing). These providers are contractually obligated to protect your data and use it only for providing services to us.
• Connected Platforms: When you authorize content publishing, we share content with your connected social media platforms (Meta, LinkedIn, TikTok, etc.) on your behalf.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction.

6.1 Data Processors

The following service providers process data on our behalf:

• Supabase Inc. — Database hosting, authentication, and file storage (US)
• Stripe Inc. — Payment processing (US)
• Google LLC — AI content generation services (US)
• OpenAI Inc. — AI content generation services (US)
• Cloud hosting provider — Application hosting and delivery (US)

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Secure token storage with encryption for all platform access tokens
• Role-based access controls and principle of least privilege
• Regular security monitoring and vulnerability assessments
• Multi-factor authentication available for user accounts
• Automatic session timeouts and token rotation

While we strive to use commercially acceptable means to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your data according to the following schedule:

• Account data: Retained while your account is active and for 30 days after deletion request
• Platform analytics data: Retained for 24 months from collection, then automatically purged
• Platform access tokens: Deleted immediately upon disconnection of a platform
• Generated content: Retained while your account is active; deleted upon account closure
• Payment records: Retained for 7 years as required for tax and legal compliance
• Server logs: Retained for 90 days for debugging and security monitoring

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Disconnect: Revoke access to any connected platform at any time
• Opt-out: Unsubscribe from marketing communications

9.2 European Economic Area (GDPR)

If you are located in the EEA, you additionally have the right to:

• Restrict processing of your personal data
• Object to processing based on legitimate interests
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with your local data protection authority

Our legal basis for processing personal data includes: performance of a contract (providing our services), legitimate interests (improving our platform), and consent (where explicitly given).

9.3 California Residents (CCPA/CPRA)

California residents have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by us
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

10. Facebook & Instagram Data Deletion

You can remove your Facebook and Instagram data from Nova Atlas AI in the following ways:

• In-app: Go to Settings > Connected Accounts and click "Disconnect" next to Facebook/Instagram
• From Facebook: Go to Facebook Settings > Apps and Websites > Remove Nova Atlas AI
• Direct request: Email support@novaatlas.ai with subject "Data Deletion Request"

Upon receiving a deletion request (either directly or via Meta's Data Deletion Callback), we will:

• Delete all stored Meta access tokens immediately
• Delete all Facebook/Instagram insights data, page data, and ad account data within 30 days
• Provide a confirmation URL where you can check the status of your deletion request

11. Cookies and Tracking

We use cookies and similar technologies to:

• Essential cookies: Maintain your session and authentication state
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Understand how users interact with our platform

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of our platform.

12. Children's Privacy

Nova Atlas AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us immediately at support@novaatlas.ai.

13. International Data Transfers

Your data may be transferred to and processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where required.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

For Meta-specific data inquiries or deletion requests, you may also contact us at privacy@novaatlas.ai.