Privacy Policy
Last updated: June 15, 2026
This Privacy Policy explains what data Novacademy (“we”, operated by [Novacademy — legal entity name]) collects and how we use it. We aim to collect as little as possible.
1. Data we collect
- Account: your email address (used for magic-link sign-in), and a user id.
- Learning progress: which modules you’ve read, quiz/exam scores, flashcard and scenario state — so your progress syncs across devices.
- Payment: handled entirely by Stripe. We receive a confirmation and your entitlement status, but never see or store your card details.
- Usage analytics: aggregate, privacy-friendly page analytics (no cross-site tracking, no ad cookies) to understand what’s used.
2. How we use it
- to provide the course, authenticate you, and sync your progress;
- to process purchases and grant/revoke access;
- to send essential account email (sign-in links, purchase receipts);
- to improve the product in aggregate.
We do not sell your personal data.
3. Service providers
We share data only with processors that run the Service:
- Supabase — authentication, database, and entitlement/progress storage.
- Stripe — payment processing.
- Vercel — application hosting and aggregate analytics.
- [Email provider] — delivery of sign-in and transactional email.
4. Cookies & local storage
We use a first-party cookie to keep you signed in, and your browser’s local storage to cache your theme preference and an offline copy of your progress. We don’t use advertising or cross-site tracking cookies.
5. Data retention
We keep your account and progress data while your account is active. You can request deletion at any time (see below); some records (e.g. payment/tax records) may be retained where required by law.
6. Your rights
Depending on your location (e.g. GDPR/UK GDPR, CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these, email support@novacademy.ai and we’ll respond within a reasonable time.
7. Security
Data is stored with our providers using industry-standard protections, and access to paid content and personal rows is enforced server-side. No system is perfectly secure, but we take reasonable measures to protect your data.
8. International transfers
Our providers may process data in countries other than yours. Where required, transfers rely on appropriate safeguards (such as standard contractual clauses).
9. Children
The Service isn’t directed to children under 16 and we don’t knowingly collect their data.
10. Changes & contact
We may update this policy; the “Last updated” date reflects changes. Questions or requests: support@novacademy.ai.