Privacy Policy

1. 1) Account information. Your email address and any profile details you provide, such as name and title, together with sign-in data handled by our authentication provider.
2. 2) Content you provide. Datasets and files you upload, prompts and instructions you enter, and the analyses, code, figures, and summaries generated from them.
3. 3) Billing information. Payment card and billing details are collected and processed by our payment processor. We receive limited billing metadata — such as your plan, payment status, and card brand and last four digits — and we do not store full card numbers.
4. 4) Usage information. Logs, device and browser data, and activity such as runs started and features used, collected to operate, secure, and improve the Service.

We use your information:

1. 1) To provide, maintain, secure, and improve the Service, including running the analyses you request.
2. 2) To communicate with you about your account and the Service.
3. 3) To enforce usage limits, prevent abuse, and protect the Service and its users.
4. 4) To process payments and manage subscriptions.
5. 5) To comply with legal obligations.

We do not sell or share your personal information as "sell" and "share" are defined under California law, and we have not done so in the preceding 12 months.

We may create aggregated or de-identified data that no longer identifies you, use it to operate and improve the Service, and we commit not to re-identify it.

The Service generates and runs analysis code using large language models operated by third-party AI providers. To do this, your prompts, instructions, and derived results — such as summaries, metrics, figures, and code — are transmitted to those providers to produce responses.

By design, large research datasets you upload (for example, sequencing reads or single-cell matrices) are never loaded whole into a model's context, though head-sample rows of uploaded datasets may be included in model context to plan analyses or answer questions. Datasets are stored in managed cloud storage and analyzed inside isolated, sandboxed compute environments; derived results are returned to the model, as described in Section 6 of the Terms.

We do not use Your Content to train, fine-tune, or develop AI models, and our agreements with AI providers do not permit them to use Your Content to train theirs, except in each case as described in Section 5.3 of the Terms.

We rely on trusted third parties to operate the Service, and your information may be processed by them on our behalf:

1. 1) Authentication and database hosting.
2. 2) File storage and cloud infrastructure.
3. 3) Managed compute for running analyses.
4. 4) AI model inference by third-party large-language-model providers.
5. 5) Application hosting and delivery.
6. 6) Payment processing.

These providers are authorized to process information only as needed to provide their services to us, except that our payment processor also processes payment data as an independent controller — for example, for fraud prevention and legal compliance — as described in its own privacy policy. An up-to-date summary of our sub-processors is available on request at support@novaflow.ai.

We disclose personal information only:

1. 1) To the service providers described above.
2. 2) Within your organization — if you use the Service under a team, organizational, or enterprise account, administrators may access and view activity, settings, and billing for the accounts under it (see Section 3.2 of the Terms).
3. 3) For legal and safety reasons — to comply with law or valid legal process, or to protect the rights, safety, or property of Novaflow, our users, or others.
4. 4) In a corporate transaction — in connection with a merger, acquisition, financing, or sale of assets, in which case your information may be transferred subject to this Policy.
5. 5) With your direction or consent.

We retain your information for as long as your account is active or as needed to provide the Service, and afterwards as required to comply with legal obligations, resolve disputes, and enforce our agreements.

You may request deletion of content or account data by emailing support@novaflow.ai. We delete or de-identify the associated data from active systems and backups, except where longer retention is legally required. Export anything you want to keep before closing your account.

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and isolated compute environments for analysis runs. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to:

1. 1) Know and access the personal information we hold about you.
2. 2) Correct inaccurate personal information.
3. 3) Delete personal information.
4. 4) Receive a portable copy of your personal information.
5. 5) Opt out of any sale or sharing of personal information (as stated in Section 2, we do not sell or share it).
6. 6) Exercise these rights without discriminatory treatment.

To exercise these rights, email support@novaflow.ai from the address on your account. We may need to verify your identity, and where the law allows you may use an authorized agent. If we decline a request, you may appeal by replying to our decision, and we will respond within the period required by law.

Sensitive information. We do not seek to collect sensitive personal information. Our Terms (Section 9) prohibit uploading identifiable health, genetic, or biometric data without a separate written agreement, and we do not use or disclose sensitive personal information except as permitted by law. Note that pseudonymized (key-coded) research data may still be personal data under some laws; you are responsible for the datasets you upload.

Opt-out preference signals. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how we process your data, and we do not respond to browser Do Not Track signals.

We are based in the United States, and your information is processed and stored in the United States, which may have different data-protection rules than your country.

If you are in the European Economic Area, United Kingdom, or Switzerland, we process personal information on these legal bases:

1. 1) Performance of our contract with you (providing the Service you signed up for).
2. 2) Our legitimate interests in operating, securing, and improving the Service.
3. 3) Your consent, where we ask for it — which you may withdraw at any time.
4. 4) Compliance with legal obligations.

Where we transfer personal information out of these regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You also have the right to lodge a complaint with your local supervisory authority.

We use only cookies and similar technologies necessary to keep you signed in and to operate the Service securely, including fraud-prevention cookies set by our payment processor. We do not use advertising cookies, and we do not use cookies to track you across unrelated sites.

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, and we will update the effective date above.

Questions about this Privacy Policy or your data? Contact Novaflow, Inc. at support@novaflow.ai.