Privacy Policy

1. Who & what this covers

Nova Studios operates as a South African sole proprietorship and is responsible for deciding how information collected for its website, enquiries and business administration is used. Contact hello@novastudios.co.za about this notice or a privacy request.

Nova is preparing for commercial launch. Public online subscriptions are currently closed. Payment, onboarding and customer-management functionality has been implemented in a protected TEST environment; it is not a claim that commercial customers have already been onboarded. This notice distinguishes those features from ordinary visits and enquiries.

For personal information entrusted to Nova as part of a client project, responsibilities depend on the work and the client’s instructions. Where Nova acts as an operator or processor for a client, an appropriate project-specific arrangement may be required. A separate notice may apply to a product delivered for that client.

2. Information collected & its sources

• Visits: hosting and request information such as IP address, browser/device details, requested pages, timestamps and security events; analytics information described below.
• Enquiries: the name, work email, company, plan interest and message you provide in the contact form or correspondence. Name, a valid email and a message are needed to respond through the form; company is optional. Unconfigured delivery can prevent a message being sent, as the site explains.
• Payments, when checkout is available: purchase email, selected plan, agreed price and currency, transaction references, payment status, subscription allocation, pause/cancel actions and recurring-consent records. Paystack supplies verification and payment-method information. Where recurring authorisation is given, Nova can retain a provider-issued reusable authorisation reference and related customer/method information; this is different from holding your full card details.
• Onboarding and projects, when used: contact and business names, website, contact/Trello email, company introduction, priorities, first request, references, instructions, project communications and deliverables. Materials or files you share through agreed project channels may contain personal information. The current onboarding form has no file-upload feature.
• Access and operations: access-link and session records, expiry and revocation information, notification contents and delivery attempts, project-board assignments and operational audit records. Necessary request information is also used for abuse prevention.

Information generally comes from you, someone authorised to act for your organisation, or the providers involved in your payment or project. Do not send another person’s information unless you have a lawful reason to do so, and share only what the work needs. Do not include passwords, full card numbers, CVV codes, one-time passcodes or unnecessary sensitive information in forms or ordinary project messages.

3. Why information is used

Information is used to answer enquiries; discuss and provide agreed services; verify payments and manage paid days; record authorisations and cancellations; provide secure access; coordinate requests; send transactional messages; investigate service or billing problems; maintain records; secure systems; and understand website use.

The lawful ground depends on the purpose: steps you request before a contract, performance of an agreement, legal obligations, legitimate interests subject to applicable protections, or consent where required. Legitimate interests do not override a consent requirement for electronic direct marketing or particular tracking technologies.

You can decline optional information. Without information necessary for a request, payment, identity check or project, Nova may be unable to complete that activity. Withdrawing marketing consent does not stop transactional messages needed for a service, payment, security or legal obligation.

4. Providers & other recipients

Relevant providers receive the information needed for their role:

• Vercel: website hosting, request handling and Web Analytics.
• Supabase: the protected TEST database for billing, onboarding, access, notification and audit records. This is not a public customer-authentication portal.
• Paystack: hosted checkout, payment authorisation, transaction verification and payment-provider records. Full card entry is handled on Paystack’s checkout; Nova’s application does not collect or store full card numbers or CVV codes.
• Resend: outgoing contact and transactional emails, including message contents, recipient details and delivery information. Ordinary mailbox providers also process email correspondence.
• Trello / Atlassian: project requests, board membership, comments and materials shared in that workspace when it is used. Board preparation and invitation checks are currently operator-assisted, not an automatic public signup process.
• Google Analytics: website audience and interaction measurement on the public marketing site.

Provider handling is also described in their notices: Vercel, Supabase, Paystack, Resend, Atlassian and Google. A provider may have its own legal obligations as well as processing information for Nova.

Information may also be disclosed where necessary to an authorised project collaborator, a professional adviser, a regulator or another recipient required by law or for resolving a dispute. No sale of personal information or advertising-list brokerage is implemented by Nova’s website systems.

5. Necessary cookies & analytics

Protected TEST checkout and customer-management pages use a secure first-party cookie to recognise the purchase or authenticated session. The purchase cookie can last up to one year; email-link sessions are issued for seven days. The private operator session is issued for eight hours. Signing out clears the customer cookie; browser settings can block or remove cookies, but that may prevent secure access. Cookie expiry and database-record deletion are separate.

Secure access links are single-use and normally expire after 30 minutes. The page requires an explicit confirmation before exchanging a link for access. These are necessary access controls, not marketing opt-ins. Separate providers, such as Paystack or Vercel’s protected-preview login, may use their own cookies.

The marketing site includes Vercel Web Analytics and Google Analytics 4. Measurement includes pages, referrers, device/browser characteristics, approximate location and interactions such as plan clicks, enquiry submission events and video milestones. Nova’s event code does not send the text of your enquiry or your email as event properties.

Vercel describes Web Analytics as using aggregated measurements without third-party cookies, with a short-lived visitor hash. This does not mean all hosting or analytics processing is free of personal information. Google Analytics uses first-party cookies such as _ga and _ga_…, normally with a two-year default lifetime subject to settings and browser limits, and sends measurement information to Google.

The current site does not offer an on-page analytics consent or rejection control. You can restrict cookies and tracking through your browser or blocking tools; this is not a substitute for consent where the law requires it. Necessary access cookies and optional analytics serve different purposes. This notice does not treat continued browsing as consent.

6. Prospect research & marketing

Nova does not currently keep prospect lists, send marketing or outreach, or use additional tools outside the systems described here to process customer project data. The website has no newsletter signup, marketing-subscription control or automated prospect-outreach feature. Enquiry and transactional messages are not an automatic subscription to marketing.

If Nova researches a business contact through a company website, professional profile, referral or other public business source, that source and the relevance of the information must be considered. Public availability does not by itself permit unsolicited marketing. Any electronic direct marketing must have the consent or qualifying existing-customer basis required by applicable law, identify the sender and provide an appropriate way to object.

You may object to direct marketing or ask about the source of your contact details by emailing hello@novastudios.co.za or replying to the message. A limited record of an objection may be needed to avoid contacting you again. This notice does not authorise a future outreach campaign.

7. International processing

Nova operates from South Africa, but its providers can process information in other countries. The configured TEST database is in the United States and the transactional-email service uses an Ireland region; provider support, backups and subprocessors may involve other locations. Website hosting, analytics, payment and project-management information can also cross borders.

Transfers are subject to applicable requirements, including POPIA section 72 and any relevant foreign law. They require an appropriate permitted ground or protection, such as adequate legal or contractual safeguards where applicable; using this website is not blanket consent to unrestricted transfers. Ask hello@novastudios.co.za for information about the processing relevant to your request.

8. Retention & deletion

Retention depends on the purpose, the service relationship, record-keeping obligations, disputes and legitimate security needs. Financial and authorisation records may need to be retained after cancellation; cancelling renewal does not delete project or billing information.

Nova does not currently apply a single automatic deletion deadline to its database, correspondence and project records. Access-link or session expiry limits access but does not automatically erase the record. Deletion and correction requests are reviewed manually; there is no self-service account-deletion feature.

Applicable law limits how long identifiable information may be kept. Once retention is no longer justified, records must be deleted, de-identified or otherwise handled as the law requires. Provider backups and logs can follow separate retention cycles, so removal from an active system is not a promise of immediate erasure from every backup. Ask about the records relevant to you.

9. Security & confidentiality

The implemented customer TEST systems use restricted server-side database access, secure access cookies, limited-life links, hashed access secrets and encryption for selected stored payment-authorisation and notification information. Payment verification and request controls help prevent unauthorised changes. These safeguards do not mean every field is individually encrypted or every risk has been eliminated.

Keep secure links and authorised workspace access private. Notify hello@novastudios.co.za if information appears exposed or access is compromised. Necessary notifications to affected people and regulators must follow applicable breach-notification law. Nova does not claim a security certification or guarantee that no incident can occur.

Project information is used for the agreed work and administration. Where a project needs special confidentiality, sensitive-data handling or a client data-processing agreement, agree the appropriate arrangements before sharing the information.

10. Your rights & requests

Subject to applicable law, you may ask whether Nova holds your personal information, request access, correct inaccurate information, request deletion or restriction where retention is not justified, object to processing where permitted, or withdraw consent for a consent-based use. Withdrawal does not invalidate earlier lawful processing. Other rights, including portability where applicable, may arise under the law relevant to you.

Email hello@novastudios.co.za with the request and enough context to identify the relevant records. Reasonable identity or authority verification may be needed before information is released or changed. Do not send identity documents or sensitive credentials unless an appropriate method has been arranged. Requests are handled through correspondence, not an automated privacy dashboard.

Applicable response periods, permissible fees, exemptions and review rights depend on the request and governing law. A refusal or limitation must have an appropriate legal basis; billing-record obligations do not justify retaining unrelated information indefinitely. A formal PAIA request for records may require its prescribed process. Contact Nova for the applicable access procedure; this Privacy Policy is not a PAIA manual.

Nova’s billing system makes automated payment-verification and capacity calculations. No credit scoring or comparable eligibility-profiling feature is implemented. Contact Nova for review of an apparent billing or access error; this does not restrict any applicable rights concerning automated decisions.

11. Complaints & updates

You may contact Nova about a privacy concern, or complain directly to South Africa’s Information Regulator. You do not have to complete Nova’s support process before using an available regulatory remedy. If another jurisdiction’s mandatory privacy law applies, the relevant local rights and supervisory-authority remedies also remain available.

Updates will show a revised date. A new notice does not retrospectively supply consent or remove rights already held. Material changes in processing require appropriate notice and any further lawful authorisation needed.

See also the Terms of Service and Refund & Cancellation Policy.