Privacy Policy

This policy explains what Neurasoft Limited does with personal data in Nova Agents. It covers two different relationships, and the difference matters:

• Our customers. The businesses who hold a Nova account. We decide how their account data is used, so for that data we are the controller and this policy applies directly.
• Their callers. People who ring a customer's number and speak to an assistant. That conversation belongs to the customer, not to us — they are the controller and we only process it on their instructions. If you have spoken to an assistant and want your data removed, contact the business you called; they can do it themselves, and we will help them if asked.

Who we are

Neurasoft Limited, a company registered in England and Wales with company number 16575467, registered office Northgate House North Gate, New Basford, Nottingham, United Kingdom, NG7 7BQ. We are registered with the Information Commissioner's Office under ZC060423. For anything in this policy, contact support@neurasoft.ltd.

What we collect

Account data. Name, email address, a bcrypt hash of your password (never the password itself), and — if you enable two-factor — an encrypted authenticator secret and hashed recovery codes.

Organisation and billing data. Your organisation name, plan, prepaid credit balance and a ledger of credit movements. Card details are handled by Stripe and never reach Nova.

Call data. For each call: the caller's phone number, the number dialled, start and end times, duration, outcome, the conversation transcript, and an AI-written summary. Calls are never recorded.

Appointment data. Where an assistant takes bookings: the caller's name and phone number, the appointment time, the service requested and any notes taken during the call. Kept until you delete them; past appointments are cleared by your retention window.

Taken messages. Where an assistant takes messages: the caller's name, phone number and what they asked for. Messages deliberately survive the end-of-call anonymisation — asking the assistant to take a message is asking to keep one — and are kept until you delete them or your retention window removes them.

Operational logs. A record of sensitive administrative actions and of technical failures, used for security and support. These name the account that acted, not your callers.

Why we are allowed to hold it

• To perform our contract with you — running your assistants, connecting your calls, taking payment.
• Our legitimate interests — keeping the service secure, investigating faults, preventing abuse, and improving what we offer. We keep these narrow: we do not profile you and we do not advertise to you.
• Legal obligation — retaining billing records for the periods tax law requires.

For call content, the lawful basis is the customer's to establish, not ours. Our terms require them to tell callers what is happening.

AI disclosure, and no recording

Calls are never recorded — Nova does not offer recording on any plan or setting. By default, every assistant starts each call by telling the caller they are speaking to an AI assistant. A customer can reword that notice or switch it off if they disclose it another way — the obligation to inform callers remains theirs either way.

How long we keep it

Account and billing records are kept while the account is open, and for as long afterwards as tax and accounting rules require.

Call data is different: the customer chooses. New organisations start with a 30-day window after which transcripts, summaries and caller numbers are erased automatically; they can lengthen it, shorten it, or keep call history until they delete it themselves. They can also switch history off entirely, in which case every call is anonymised the moment it ends and no transcript, summary or caller number is stored on the call — messages and bookings the caller asked for are kept until deleted or expired, as described above. An organisation can also erase a single call, or everything about one caller, at any time. Deleting an organisation removes its data from our systems.

Who else sees it

We use the following processors. Those marked optional are only involved if a customer chooses that feature.

• Voice AI processing — Turning speech into text, generating the assistant's replies, and speaking them during the call. Call audio and the conversation transcript, erased immediately after every call — retention there is not offered on any plan or setting. The caller's phone number reaches this supplier only in an encrypted form it cannot read. Knowledge-base documents you upload remain until you delete the knowledge base.
• Twilio — Telephony: receiving and placing calls, and sending appointment confirmation texts. Caller and recipient phone numbers, call metadata, SMS content.
• Telnyx (optional) — Telephony, as an alternative to Twilio. Caller and recipient phone numbers, call metadata.
• Plivo (optional) — Telephony, as an alternative to Twilio. Caller and recipient phone numbers, call metadata.
• Stripe — Payments, subscriptions and invoicing. Billing contact details. Card details are held by Stripe and never reach Nova.
• Resend — Transactional email: password resets, alerts and the daily digest. Customers' own account email addresses only — alert emails are written to carry no caller data (a missed-call notice names the assistant, never the caller).
• Render — Application hosting and the Nova database. Everything Nova stores.
• Google (Calendar API) (optional) — Mirroring appointments into your own Google Calendar. Appointment times, caller name and phone number.
• Cal.com (optional) — Mirroring appointments into your own Cal.com account. Appointment times, caller name and phone number.

One of these is described by what it does rather than by name: the supplier that performs the voice AI processing. Business customers can ask us to name it and we will — see the Data Processing Agreement.

Some of these process data outside the UK. Where they do, the transfer relies on the UK International Data Transfer Addendum or an adequacy decision. We do not sell personal data, and we never use call content to train AI models of our own.

Cookies

Nova sets only the cookies it needs to work: one that keeps you signed in, one that protects sign-in forms against cross-site request forgery, and — for our own support staff only — one that records which customer account is being viewed. There are no third-party analytics, no advertising and no tracking cookies on this site, which is why you are not being asked to accept any. We count page visits anonymously on our own servers — no cookies involved, and nothing that could identify you is stored. Your theme and accent-colour choices are stored in your browser and never sent to us.

How we protect it

• Passwords are stored as bcrypt hashes, never in readable form.
• API keys, calendar credentials and similar secrets are encrypted at rest with AES-256-GCM.
• Optional two-factor authentication, and changing a password immediately signs out every other session.
• Every request from a telephony provider is signature-verified before it is acted on, and sign-in attempts are rate limited.
• Each organisation's data is isolated: every query is scoped to the organisation making it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Write to support@neurasoft.ltd and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

If your request concerns a conversation with one of our customers' assistants, we will pass it to that customer, since the data is theirs to act on.

Changes

If we change this policy materially we will tell account holders by email before it takes effect.

Last updated 21 August 2026.