Privacy Policy

1. INTRODUCTION

Galaxa Nova ("we," "us," "our," or "Galaxa Nova") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Nova Agent service (the "Service").

This Privacy Policy applies to:

• Business customers who subscribe to Nova Agent.
• End-users who interact with Nova Agent on our customers' websites or applications.

By using the Service, you consent to the data practices described in this Privacy Policy.

2. DATA CONTROLLER AND PROCESSOR ROLES

2.1 When We Are a Data Processor

When providing the Service to Customers, Galaxa Nova acts as a Data Processor with respect to End-User Personal Data contained in conversations. The Customer determines the purposes and means of processing End-User Personal Data.

2.2 When We Are a Data Controller

Galaxa Nova acts as a Data Controller with respect to Personal Data of Customer's authorized users who access the Nova Agent dashboard, and aggregated data used for Service improvement.

3. INFORMATION WE COLLECT

3.1 Information Collected Automatically (Service Data)

When you use the Service, we automatically collect technical information (IP address, browser type, device type) and usage information (date/time of access, performance metrics).

3.2 Information from End-Users

When End-Users interact with Nova Agent on a Customer's website, we collect conversation data (messages, queries), product context (via Sales Data Engine), and session metadata.

3.3 Information from Third-Party Sources

Real-Time Product Data: We access product information (names, specs, prices) via real-time public search and retrieval from the Customer's website. We do not store a permanent copy of the Customer's full database but retrieve data on-demand to ensure accuracy.

Meta / WhatsApp API Data (Tech Provider role): When we act as a WhatsApp Tech Provider, this also includes data received via Meta/WhatsApp APIs — client WhatsApp Business Account (WABA) assets, phone numbers, message templates, and webhook payloads — processed strictly to provide the Service to the respective Customer.

4. HOW WE USE INFORMATION

4.1 Providing the Service

We use End-User conversation data to generate AI-powered responses, provide product recommendations, and maintain conversation context across sessions.

4.2 Service Improvement & Quality Assurance

We use aggregated data to improve our AI models and enhance service performance. Through Nova Sentinel, we audit conversation logs to detect hallucinations and ensure response accuracy.

5. HOW WE SHARE INFORMATION

5.1 No Sale of Data

Galaxa Nova does not sell Personal Data to third parties. We do not monetize user data through advertising.

5.2 Sharing with Customers

End-User conversation data is shared with the Customer who operates the website where the conversation took place. This is necessary to provide the Service.

5.3 Service Providers

We share information with trusted third-party providers who assist in operating the Service (e.g., cloud hosting, AI model providers). These providers are contractually obligated to protect data and comply with applicable laws.

6. DATA RETENTION

Conversation Logs: Retained for 90 days for quality assurance purposes, then archived.

Customer Data: Upon termination, we retain Customer Data for 30 days to allow retrieval, after which it is permanently deleted.

7. DATA SECURITY

We implement industry-standard security measures, including:

• Encryption: TLS 1.3 for data in transit and AES-256 for data at rest.
• Access Controls: Role-based access control (RBAC) and multi-factor authentication (MFA).
• Monitoring: 24/7 security monitoring and regular vulnerability assessments.

While we implement robust security, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

8. YOUR RIGHTS

8.1 Rights Under Indian Law (DPDP Act 2023)

Data principals have the right to access, correct, erase, and withdraw consent for their Personal Data.

8.2 How to Request Deletion

To request deletion of your Personal Data, email security@galaxa.in with the subject line "Data Deletion Request" from the email address associated with your account, specifying what you'd like deleted. We will confirm receipt and complete verifiable requests within 30 days, subject to lawful retention obligations described in §6.

8.3 Grievance Officer

For privacy complaints or concerns regarding processing of your Personal Data, contact our Grievance Officer at security@galaxa.in. We will acknowledge your complaint and respond within 30 days.

9. CONTACT INFORMATION

For questions about this Privacy Policy or our data practices:

Email: security@galaxa.in

---