Speak Nova Privacy Policy

This Privacy Policy explains how Speak Nova collects, uses, discloses, and protects personal information related to our websites, dashboard, APIs, voice/chat agents, and related services (the "Platform"). If you or your organization have accepted the Speak Nova Services Agreement (the "MSA") and Data Processing Agreement (the "DPA"), those documents govern commercial terms and personal data processing between Speak Nova and the Client. In case of any inconsistency regarding personal data processing, the DPA controls.

We collect the categories of information described below, which may include personal information:

• Account & Profile: name, business contact details, company name, role, authentication credentials.
• Billing & Payments: billing contact, plan details, and tokenized payment info via our payment processor (we do not store full card numbers).
• Service Usage & Telemetry: logs, device and browser data, IP address, timestamps, diagnostic information.
• Content & Communications: prompts, scripts, call recordings, voicemails, transcripts, chat/SMS messages, and related metadata as configured by the Client.
• Support & Ops: tickets, feedback, problem reports, and related attachments.
• Third-Party Integrations: data exchanged via integrations you enable (e.g., CRM/Helpdesk), in accordance with the integration's settings and permissions.
• Cookies & Similar Technologies: as described in Section 11.

• You / Your Organization: when creating an account, configuring agents, uploading content, or contacting support.
• Automated Means: via the Platform (usage logs, telemetry, cookies).
• Third Parties: service providers (e.g., telephony, analytics, payment), and integrations you connect.
• Public Sources: where lawful and relevant to fraud prevention or business contact enrichment.

We use information to:

• Provide & Operate the Platform: account provisioning, routing calls/messages, generating transcripts, analytics, and automations.
• Maintain & Secure: monitor for abuse, prevent fraud, enforce policies, and ensure network integrity.
• Quality Monitoring & Improvements: allow a limited number of trained support personnel to review a sample of Client calls (transcripts and — within 60 days — audio) to monitor call quality and improve Client's agents. Reviews use least-privilege, time-limited access with logging and confidentiality obligations. QA access is enabled by default and managed by Speak Nova's back-end administrative controls (not visible in your dashboard). If your organization prefers to restrict ongoing QA reviews, an authorized admin can email privacy@speaknova.com to request restriction; we will honor within 5 business days (except where access is required for security/fraud/abuse investigations or legal obligations).
• Support & Improve: troubleshoot, analyze performance, and develop new features (often using de-identified or aggregated data).
• Communicate: send transactional notices (e.g., billing, security, product updates). Marketing messages are sent only with the required consent.
• Comply with Law: tax, accounting, lawful requests, and other legal obligations.

Where required (e.g., under EU/UK GDPR), our legal bases include performance of a contract, legitimate interests (to secure and improve the Platform), compliance with legal obligations, and consent where applicable.

We may disclose information to:

• Service Providers/Subprocessors: cloud hosting, telephony carriers, analytics, customer support, payment processing — bound by confidentiality and data protection obligations.
• Third-Party Integrations You Enable: CRMs, helpdesks, and other tools you connect to your account.
• Legal & Safety: to comply with law, legal process, or to protect rights, safety, and security.
• Business Transfers: in connection with a merger, acquisition, financing, or sale of assets.
• Aggregated/De-identified Data: that cannot reasonably identify an individual.

A current list of subprocessors is available upon request or as posted in our documentation.

We may process information in countries other than where you reside. Where required, we use appropriate safeguards such as Standard Contractual Clauses (and UK Addendum) or other transfer mechanisms described in the DPA.

We implement commercially reasonable technical and organizational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission or storage is 100% secure.

We retain information as long as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements.

Audio Call Recordings. Audio call recordings are retained for 60 days from the date of creation. During this 60-day period, Clients may download the audio files from the dashboard for their own records. After 60 days, audio call recordings are permanently deleted from the Platform and are no longer accessible on the Client dashboard or recoverable by Speak Nova.

Transcripts and Metadata. Unless otherwise stated in your administrative settings or the MSA/DPA, transcripts, summaries, and non-audio metadata related to calls may be retained for longer periods to support analytics, audit trails, and service improvement, subject to the safeguards described in this Privacy Policy and the DPA.

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, and port your data. You may also opt out of marketing communications at any time (see message footers or your account settings). To exercise rights, contact us at privacy@speaknova.com or via the dashboard; we may request verification of identity and will respond within the time required by law. If we process data on behalf of a client, we may direct your request to that Client consistent with the DPA.

The Platform is not directed to children and should not be used to collect personal information from children under 13 (or the age defined by local law) without appropriate parental consent and our prior written agreement.

We use cookies, SDKs, and similar technologies for authentication, preferences, analytics, and security. Where required (e.g., EU/UK), we display a consent banner that allows you to manage non-essential cookies. You can also control cookies through your browser settings; disabling certain cookies may limit Platform functionality.

The Platform may enable call recording/monitoring and automated calling/messaging. Clients are responsible for providing legally required notices and obtaining consents from their end users in relevant jurisdictions. We provide configurable prompts and tools to assist with compliance.

Recording Retention Reminder. Audio call recordings are available for download for 60 days from creation and are permanently deleted thereafter. Clients who require longer retention must export and store copies outside the Platform within the 60-day window and ensure compliance with applicable laws for any such storage.

The Platform may link to or interoperate with third-party websites and services. Their privacy practices are governed by their own policies, not this Privacy Policy.

We may update this Privacy Policy from time to time by posting a new Version Date. Material changes will be presented for acknowledgment (and consent where legally required) in the dashboard. Continued use after the Version Date constitutes acknowledgment of non-material changes.

Privacy & Data Protection

Email: privacy@speaknova.com (or legal@speaknova.com)

Mail: 1001203965 Ontario Inc. o/a Speak Nova, 68 Tycos Drive, Unit 1, Toronto, Ontario M6B 1V9, Canada

• Canada (PIPEDA): You may contact us to access or correct personal information, or to file a complaint with the Office of the Privacy Commissioner of Canada.
• United States (e.g., CA/VA/CO/CT/UT): Residents may have rights to know/access, delete, correct, and opt-out of certain processing and "sales"/"sharing" of personal information; we do not sell personal information as defined by these laws.
• EU/UK GDPR: For Platform usage where Speak Nova acts as Processor for the Client, the Client is the Controller and the DPA governs. For Speak Nova's own website operations and account administration, Speak Nova is Controller. You may lodge a complaint with a supervisory authority (EU) or the ICO (UK).