Privacy Policy

Controller

Sebastian Faber

Einzelunternehmen / NOVAVO

Am Pichelssee 57c

13595 Berlin

Germany

Email: support@novavo.uk

General Processing And Legal Bases

We process personal data only as needed to provide this website and web app, create user access, operate trials, process purchases, deliver digital access, communicate with customers, prevent misuse, and meet legal obligations.

Legal bases include Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, Art. 6(1)(a) GDPR for consent-based processing, and Art. 6(1)(f) GDPR for legitimate interests in secure and reliable operation.

Account, Trial, And App Data

When a user creates an account, starts an email-based trial, restores access, or buys access, we may process email address, user ID where available, hashed email reference, access tier, selected collections, trial start and end dates, purchase/access status, app preferences, saved meal plans, favorites, custom recipes, and shopping-list state.

Users can request deletion or use the account deletion function in the app where available. Some records may be retained where legal retention duties or payment documentation require it.

Hosting Through Vercel

This website is hosted through Vercel. When the website is accessed, technically necessary access data may be processed, such as IP address, date and time, requested page or file, browser type, operating system, and referrer URL.

Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel privacy information: https://vercel.com/legal/privacy-policy

Cloudflare

Cloudflare may be used for domain, DNS, security, and delivery functions. Cloudflare may process technical access data and security events where needed for secure and reliable operation.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare privacy information: https://www.cloudflare.com/privacypolicy/

Firebase / Google Cloud

The app may use Firebase Authentication and Firestore to provide login, account, trial, and app-sync functionality. Processed data may include email address, user ID, access tier, app settings, saved planner data, favorites, custom recipes, and technical timestamps.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Firebase privacy information: https://firebase.google.com/support/privacy

Stripe Checkout

Payments are processed through Stripe Checkout. Stripe processes the data needed for payment handling, which may include name, email address, payment data, billing information, payment amount, currency, and transaction-related technical data.

Provider in Europe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe privacy information: https://stripe.com/privacy

Email

Transactional emails may be sent for trial start, account, purchase, access, or support purposes. Marketing emails are sent only where a user has consented and can be unsubscribed from.

If you contact Novavo by email, your message and contact details are processed to handle the request. Data is deleted when it is no longer needed, unless statutory retention obligations apply.

Cookies, Local Storage, And Tracking

The app uses local storage for technically useful app state such as language, unit preference, planner data, favorites, trial status, and access cache.

If analytics/marketing consent is accepted, Novavo may use first-party product analytics to understand app usage and improve the user experience. This may include pseudonymous session ID, screen or tab views, approximate time spent on app sections, recipe-open events, trial or checkout intent events, campaign parameters, referrer, device viewport, timestamps, and app tier/status. These events are stored in Novavo-controlled Firebase/Firestore and are not used to identify users personally unless legally required or needed to investigate abuse.

Pinterest Tag is used for consent-based marketing and conversion measurement only after the user accepts marketing tracking in the cookie/consent banner. Without this consent, the Pinterest script is not inserted and there is no noscript Pinterest pixel before consent.

If accepted, Pinterest may process technical usage data such as page visits, referrer, device/browser data, timestamps, campaign parameters, pseudonymous IDs, trial-start events, checkout-start events, and purchase/conversion events. Where an email address is used for a trial or purchase and marketing tracking consent is active, it may be hashed locally before being used for enhanced matching.

Technically necessary cookies or similar technologies may be used by hosting, security, authentication, database, email, or payment providers where required for operation, fraud prevention, or checkout.

Retention

Personal data is stored only as long as needed for the relevant purpose or as required by law. Tax and commercial records may be retained for statutory retention periods.

Your Rights

Under the statutory conditions, you may have rights of access, rectification, deletion, restriction of processing, data portability, objection, and withdrawal of consent with future effect.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority for Berlin is the Berliner Beauftragte fuer Datenschutz und Informationsfreiheit: https://www.datenschutz-berlin.de