Privacy Policy

1. Scope; Relationship to Other Agreements

This Privacy Policy explains how Speak Nova collects, uses, discloses, and protects personal information related to our websites, dashboard, APIs, voice/chat agents, and related services (the "Platform"). If you or your organization have accepted the Speak Nova Services Agreement (the "MSA") and Data Processing Agreement (the "DPA"), those documents govern commercial terms and personal data processing between Speak Nova and the Client. In case of any inconsistency regarding personal data processing, the DPA controls.

SpeakNova Social, our marketing workspace in Omni, and the Google and Meta accounts businesses connect to it are covered in Sections 17 to 22.

2. Information We Collect

We collect the categories of information described below, which may include personal information:

• Account & Profile: name, business contact details, company name, role, authentication credentials.
• Billing & Payments: billing contact, plan details, and tokenized payment info via our payment processor (we do not store full card numbers).
• Service Usage & Telemetry: logs, device and browser data, IP address, timestamps, diagnostic information.
• Content & Communications: prompts, scripts, call recordings, voicemails, transcripts, chat/SMS messages, and related metadata as configured by the Client.
• Support & Ops: tickets, feedback, problem reports, and related attachments.
• Third-Party Integrations: data exchanged via integrations you enable (e.g., CRM/Helpdesk), in accordance with the integration's settings and permissions.
• Cookies & Similar Technologies: as described in Section 11.

3. Sources of Information

• You / Your Organization: when creating an account, configuring agents, uploading content, or contacting support.
• Automated Means: via the Platform (usage logs, telemetry, cookies).
• Third Parties: service providers (e.g., telephony, analytics, payment), and integrations you connect.
• Public Sources: where lawful and relevant to fraud prevention or business contact enrichment.

4. How We Use Information

We use information to:

• Provide & Operate the Platform: account provisioning, routing calls/messages, generating transcripts, analytics, and automations.
• Maintain & Secure: monitor for abuse, prevent fraud, enforce policies, and ensure network integrity.
• Quality Monitoring & Improvements: allow a limited number of trained support personnel to review a sample of Client calls (transcripts and — within 60 days — audio) to monitor call quality and improve Client's agents. Reviews use least-privilege, time-limited access with logging and confidentiality obligations. QA access is enabled by default and managed by Speak Nova's back-end administrative controls (not visible in your dashboard). If your organization prefers to restrict ongoing QA reviews, an authorized admin can email privacy@speaknova.com to request restriction; we will honor within 5 business days (except where access is required for security/fraud/abuse investigations or legal obligations).
• Support & Improve: troubleshoot, analyze performance, and develop new features (often using de-identified or aggregated data).
• Communicate: send transactional notices (e.g., billing, security, product updates). Marketing messages are sent only with the required consent.
• Comply with Law: tax, accounting, lawful requests, and other legal obligations.

Where required (e.g., under EU/UK GDPR), our legal bases include performance of a contract, legitimate interests (to secure and improve the Platform), compliance with legal obligations, and consent where applicable.

5. How We Share Information

We may disclose information to:

• Service Providers/Subprocessors: cloud hosting, telephony carriers, analytics, customer support, payment processing — bound by confidentiality and data protection obligations.
• Third-Party Integrations You Enable: CRMs, helpdesks, and other tools you connect to your account.
• Legal & Safety: to comply with law, legal process, or to protect rights, safety, and security.
• Business Transfers: in connection with a merger, acquisition, financing, or sale of assets.
• Aggregated/De-identified Data: that cannot reasonably identify an individual.

A current list of subprocessors is available upon request or as posted in our documentation.

6. International Transfers

We may process information in countries other than where you reside. Where required, we use appropriate safeguards such as Standard Contractual Clauses (and UK Addendum) or other transfer mechanisms described in the DPA.

7. Security

We implement commercially reasonable technical and organizational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission or storage is 100% secure.

8. Retention

We retain information as long as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements.

Audio Call Recordings. Audio call recordings are retained for 60 days from the date of creation. During this 60-day period, Clients may download the audio files from the dashboard for their own records. After 60 days, audio call recordings are permanently deleted from the Platform and are no longer accessible on the Client dashboard or recoverable by Speak Nova.

Transcripts and Metadata. Unless otherwise stated in your administrative settings or the MSA/DPA, transcripts, summaries, and non-audio metadata related to calls may be retained for longer periods to support analytics, audit trails, and service improvement, subject to the safeguards described in this Privacy Policy and the DPA.

9. Your Choices & Rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, and port your data. You may also opt out of marketing communications at any time (see message footers or your account settings). To exercise rights, contact us at privacy@speaknova.com or via the dashboard; we may request verification of identity and will respond within the time required by law. If we process data on behalf of a client, we may direct your request to that Client consistent with the DPA.

10. Children's Privacy

The Platform is not directed to children and should not be used to collect personal information from children under 13 (or the age defined by local law) without appropriate parental consent and our prior written agreement.

11. Cookies & Similar Technologies

We use cookies, SDKs, and similar technologies for authentication, preferences, analytics, and security. Where required (e.g., EU/UK), we display a consent banner that allows you to manage non-essential cookies. You can also control cookies through your browser settings; disabling certain cookies may limit Platform functionality.

12. Call Recording & Telephony Notices

The Platform may enable call recording/monitoring and automated calling/messaging. Clients are responsible for providing legally required notices and obtaining consents from their end users in relevant jurisdictions. We provide configurable prompts and tools to assist with compliance.

Recording Retention Reminder. Audio call recordings are available for download for 60 days from creation and are permanently deleted thereafter. Clients who require longer retention must export and store copies outside the Platform within the 60-day window and ensure compliance with applicable laws for any such storage.

13. Third-Party Sites & Services

The Platform may link to or interoperate with third-party websites and services. Their privacy practices are governed by their own policies, not this Privacy Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time by posting a new Version Date. Material changes will be presented for acknowledgment (and consent where legally required) in the dashboard. Continued use after the Version Date constitutes acknowledgment of non-material changes.

15. Contact Us

Privacy & Data Protection

Email: privacy@speaknova.com (or legal@speaknova.com)

Mail: 1001203965 Ontario Inc. o/a Speak Nova, 68 Tycos Drive, Unit 1, Toronto, Ontario M6B 1V9, Canada

16. Regional Disclosures (Summary)

• Canada (PIPEDA): You may contact us to access or correct personal information, or to file a complaint with the Office of the Privacy Commissioner of Canada.
• United States (e.g., CA/VA/CO/CT/UT): Residents may have rights to know/access, delete, correct, and opt-out of certain processing and "sales"/"sharing" of personal information; we do not sell personal information as defined by these laws.
• EU/UK GDPR: For Platform usage where Speak Nova acts as Processor for the Client, the Client is the Controller and the DPA governs. For Speak Nova's own website operations and account administration, Speak Nova is Controller. You may lodge a complaint with a supervisory authority (EU) or the ICO (UK).

17. SpeakNova Social and Connected Accounts

SpeakNova Social is the marketing workspace in Omni, available at social.speaknova.ai. Businesses, and the agency team that serves them, use it to create and schedule Facebook and Instagram posts, answer comments, look after their Google Business Profile, follow their website and search performance, review their Google and Meta advertising, and ask questions about their own data. On Google's sign-in screen the app appears under the name Omni. Sections 17 to 22 explain what we receive when a business connects its Google and Meta accounts and how we handle it. The rest of this Privacy Policy also applies.

A business connects each account itself, through Google's or Meta's own sign-in screen, and chooses which accounts to connect. The sign-in screen shows what we are asking for before anyone agrees. We never see or store your Google or Facebook password.

Information we receive from Google, depending on what the business connects:

• Google Ads (https://www.googleapis.com/auth/adwords): the ad accounts the business chooses, with their campaigns, ad groups, ads, keywords, search terms, budgets and performance (such as impressions, clicks, cost and conversions). Google offers no read-only version of this permission. We use it to read the accounts, and we make a change, such as a new budget or a draft campaign, only when a person on the business approves that specific change, or that the business has set to approve automatically in its settings.
• Google Analytics, read only (https://www.googleapis.com/auth/analytics.readonly): the properties the business chooses, and reports on visits, traffic sources, pages and key events (conversions). We never change Analytics settings.
• Search Console, read only (https://www.googleapis.com/auth/webmasters.readonly): the sites the business has verified, and reports on the searches that show the site, clicks, impressions, average position and the pages people land on. We never change Search Console settings.
• Google Business Profile (https://www.googleapis.com/auth/business.manage): the profiles the Google account manages, with each location's name, address, phone number, website, category, open or closed status, Maps link, rating and number of reviews, and, where the business uses review features, the reviews themselves (the reviewer's public name, rating and comment) and the business's replies. This permission also allows changes. We reply to a review or publish a profile update only when a person on the business approves it, or that the business has set to approve automatically in its settings.
• The name or email address of the Google account that connected, where Google provides it, so the business can see who authorized the connection.

Information we receive from Meta, depending on what the business connects:

• Facebook Pages (pages_show_list, pages_read_engagement): the Pages the business chooses, their posts, reach, engagement and insights, and comments on their posts (the commenter's public name and the comment text).
• Instagram (instagram_basic): the Instagram professional accounts the business chooses, their posts, reels, captions, engagement and insights, and comments on their posts (the commenter's username and the comment text).
• Meta ads (ads_read, ads_management): the ad accounts the business chooses, with their campaigns, ad sets, ads, budgets, spend and results, including how many leads instant forms collected. We do not receive the contact details people enter in lead forms. ads_management also allows changes, which we make only when a person on the business approves them, or that the business has set to approve automatically in its settings.
• Business assets (business_management): the Pages, Instagram accounts and ad accounts the person manages, so the business can pick which ones to connect.
• The name on the Facebook profile that connected (public_profile), so the business can see who authorized the connection.
• Where the business grants it, permission to publish posts and comment replies on its Pages and Instagram accounts (pages_manage_posts, pages_manage_engagement, instagram_content_publish). We publish only what a person on the business has approved, or that the business has set to approve automatically in its settings.

Information the business adds itself: photos and videos it uploads or imports into its library, its brand details, posts and replies it writes or edits, leads from its website forms that it sends to SpeakNova, and, if it connects WordPress, an application password for its site.

18. How We Use Connected-Account Data

We use information from connected accounts only to provide SpeakNova Social to the business that connected them:

• to show the business its dashboards, reports, posts, comments, reviews and leads;
• to draft posts, designs, captions, comment and review replies, and suggested changes for a person on the business to review;
• to answer questions a person on the business asks in Ask, using that business's own data;
• to publish posts and replies, and to make ad or profile changes, after a person on the business approves them, or that the business has set to approve automatically in its settings;
• to email people on the business about their workspace, such as items waiting for approval and performance summaries;
• to keep the service secure, prevent abuse, fix problems and comply with law.

Data from a business's connected accounts is shown only to people on that business's workspace. Our team sees it only when the business uses our managed service or asks us for help, when we need to investigate a security issue or abuse, or when the law requires it.

We do not sell connected-account data. We do not use it for advertising, to build advertising profiles, or for any purpose unrelated to the features described in these sections.

19. AI Processing

SpeakNova Social uses AI models to draft posts and designs, write captions and replies, describe photos, summarize performance and answer questions in Ask. To do that, we send the content and data each task needs, such as photos, brand details, post text, comments, reviews or report figures, to third-party AI model providers through OpenRouter, a service that routes each request to a model provider. The providers we use today include Z.ai, Google, OpenAI and MiniMax, and this list may change.

We send only what each task needs, and our OpenRouter account has provider data collection and model training switched off, so requests are routed only to providers that do not train on them. We require zero data retention from the providers that offer it (such as Google); others, such as the providers of image and video models, may keep request data for a short time under their own terms.

We do not use your data, or information received from Google APIs, to train generalized AI or machine learning models. AI output can be wrong, which is why nothing it drafts is published or changed on a connected account until a person approves it, unless the business has set that kind of action to approve automatically in its settings.

20. Storage, Security and Sharing

Connected-account data and access tokens are stored in our database, hosted by Neon in the United States. Photos are stored in our database. Videos, post covers and some copies of images are stored with Vercel Blob, our file storage provider. Media is served from unlisted links that are hard to guess, not from public listings, so that Facebook and Instagram can fetch what you publish.

We protect this information with:

• encryption in transit (HTTPS/TLS) between your browser, our servers, our database and the Google and Meta APIs;
• encryption at rest provided by our database and storage providers;
• access controls that keep each business's data separate, so a workspace reads only its own business's data;
• access tokens that stay on our servers and are never shown in the app or sent to your browser;
• access for our team limited to the people who need it to run the service.

We share connected-account data only with the service providers that help us run SpeakNova Social, under confidentiality and data protection obligations and only for that purpose: Neon (database), Vercel (hosting and file storage), OpenRouter and the AI model providers it routes to (AI processing), and Brevo (email notifications). Our site audit sends only public page addresses to Google PageSpeed Insights. We also send data to Google and Meta when a post, reply or change is approved. We may disclose information where the law requires it, as described in Section 5.

Requests from public authorities: if a government or law enforcement authority asks us for a business's connected-account data, we disclose it only where the law requires us to, we review each request for legal validity and scope, we disclose only what is required, and we tell the business unless the law prohibits it.

21. Retention, Disconnecting and Deletion

We keep connected-account data while the account stays connected and the business's workspace is active, so the business can see its history. Some data is kept for a set time instead: raw responses from Google and Meta for 21 days, intraday performance snapshots for 120 days, and leads for 24 months unless the business chooses a different period. When a business closes its workspace, we delete its connected-account data within 30 days.

Disconnect in the app: in SpeakNova Social, open Settings, then Integrations, and disconnect the account. We stop syncing it right away and delete most of the reporting data we synced from it. Some copies, such as your posts and their comments, stay until you ask us to delete them. Disconnecting a Google or Meta account in the app does not withdraw the access you granted; to do that, revoke our access as described below.

Revoke our access: you can remove our access at the source at any time. For Google, open your Google Account's Third-party apps and services page, select Omni and remove its access. For Meta, open Facebook Settings, then Business integrations, select our app and remove it. Our access through that connection ends as soon as you do.

Request deletion: email privacy@speaknova.com, or follow the steps on our Data Deletion page. We acknowledge every request by email, delete the access tokens and the data we hold for the account or workspace named in the request within 30 days of verifying it, and email you when it is done. Copies in backups are deleted within 30 days after that. We keep only what the law requires us to keep, such as billing records.

22. Google API Services User Data Policy and Meta Platform Terms

SpeakNova's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to Omni and SpeakNova Social, the name you see on Google's sign-in screen and the app you use.

In particular: we use Google user data only to provide and improve the user-facing features described in Sections 17 to 21; we transfer it to others only as needed to provide those features, for security, to comply with law, or as part of a merger, acquisition or sale of assets with notice to you; we do not use it to serve advertising, including retargeting or personalized advertising, and we do not sell it; and people on our team do not read it unless the business has given us permission (for example by asking us to manage its marketing or to help with a problem), it is needed for security purposes such as investigating abuse, it is needed to comply with law, or it has been aggregated and anonymized for internal operations.

Meta platform data: our use of information received from Meta, including Facebook and Instagram, follows the Meta Platform Terms and Developer Policies. We use it only to provide the features described in Sections 17 to 21, we never sell it, and we never use it for unrelated advertising.