Privacy Policy

This Privacy Policy explains how dgMotion Mobile, doing business as Novou ("Novou", "we", "us"), collects, uses, and shares personal data when you use the Novou mobile app and the novou.app website (the "Service"). dgMotion Mobile is the data controller for this processing. It applies together with our Terms of Service.

1. Data we collect

1.1 Content you provide

• Room photos you upload from your camera or photo library. We only access photos you explicitly choose — we do not scan your library.
• Design preferences: room type, style, color palette, and budget for each design.
• Your designs: the AI renders generated for you, your design history, and products you save to your wishlist.
• Waitlist and support details. If you join the website waitlist or contact us, we collect your email address and the contents of any message you send.

1.2 Data created automatically

• Anonymous account identifier. When you first open the app, we create an account with a random ID. We do not require your name, email, or phone number.
• Purchase and subscription status. Subscriptions are processed by Apple; we and our subscription-management provider (RevenueCat) receive your subscription status, plan, renewal dates, and transaction identifiers — never your payment-card details.
• Usage analytics. We use PostHog to understand how the app and website are used: events such as screens or pages viewed, features used, waitlist interactions, and basic device or browser information. Website analytics are configured without PostHog cookies or persistent person profiles, and we do not send your waitlist email address to PostHog.
• Abuse-prevention data. Your IP address is recorded when your account is created, and we keep rate-limit counters (how many generations you attempt), to detect fraud and abuse and to keep the Service available. We may also use Apple device-integrity services (such as DeviceCheck/App Attest), which store a small per-device flag — for example, that a device has already used the free preview.
• Locale and market. Your device language and region, used to localize the app, prompts, currencies, and retailers.
• Website request data. Our website and waitlist providers may process basic request information such as IP address, browser or device type, submission time, and signup source for delivery, security, and rate limiting.

1.3 Data we do not collect

• No precise location (GPS) data.
• No contacts, microphone, or background camera access.
• No third-party advertising SDKs or cross-app tracking.

2. How we use your data

• To provide the Service: validate your photo, generate your design render, find matching products within your budget, and store your design history and wishlist.
• To process subscriptions and enforce design allowances.
• To prevent fraud and abuse: rate limiting, detecting account cycling, and protecting the Service from misuse.
• To improve the Service: aggregated analytics about feature usage, conversion, and errors.
• To support you when you contact us.
• To manage the waitlist and send launch updates when you choose to join. You can unsubscribe at any time.
• To comply with law and enforce our Terms.

We do not use your data for third-party advertising, and we do not sell or rent personal data.

3. How AI processes your photos

When you generate a design:

1. Your photo is uploaded over an encrypted connection and stored in our cloud storage (hosted on Supabase).
2. The photo is sent to our AI provider — currently Google (Gemini API) — to check that it shows a room, analyze its contents, and generate the design render.
3. Product searches are run through a shopping-search provider (Serper). Only text search queries (for example, "walnut coffee table under $200") are sent — never your photos and never your identity.
4. The finished render is stored with your design history so you can revisit it.

We do not use your photos or renders to train our own AI models, and we do not permit our AI providers to use them for training their models. AI providers process your photos as our service providers, under contracts that restrict use of the data to providing the service. Your photos are never made public and are never used for advertising.

4. Legal bases (GDPR / LGPD)

Where the EU/UK GDPR or Brazil's Lei Geral de Proteção de Dados (LGPD) applies, we rely on:

5. Who we share data with

We share personal data only with service providers that help us run Novou, under contracts limiting their use of it:

We may also disclose data if required by law or legal process, to protect the rights, safety, or property of users or the public, or as part of a merger, acquisition, or sale of assets (in which case this policy will continue to apply to your data).

6. Shopping links & affiliate tracking

Some product links in Novou are affiliate links: they include a tag identifying Novou as the referral source so the retailer can pay us a commission on purchases. Links to retailers we have no affiliate agreement with carry no such tag. In either case, the link identifies Novou, not you personally — we do not share your photos, name, or account data with retailers or affiliate networks.

When you tap a product link, you leave the app and the retailer's own privacy policy and cookies apply. For affiliate links, the retailer or its affiliate network may set cookies in your browser to attribute the purchase. We receive aggregated commission reports (e.g., items ordered and commission amounts); these are not tied back to your Novou account identity by us.

7. How long we keep data

• Photos, renders, design history, wishlist, preferences: kept while your account exists, so your designs remain available to you.
• Analytics events: retained per our analytics configuration and then deleted or aggregated.
• Abuse-prevention records (signup IP, rate-limit counters): kept only as long as needed for fraud prevention.
• Purchase records: retained as required for accounting, tax, and legal obligations.
• Waitlist email: retained until you unsubscribe, ask us to delete it, or it is no longer needed for launch communications.
• Backups: deleted data leaves our backups within a limited rotation window (approximately 30 days).

8. Deleting your account & data

You can delete your account at any time in the app: Profile → Delete account. This permanently deletes your photos, renders, design history, wishlist, and preferences, and unlinks analytics from your account.

After deletion we retain only:

• a minimal deletion record (so we can prove the deletion happened);
• purchase records that laws require us to keep; and
• a device-level anti-fraud flag (for example, "this device already used the free preview") that is not linked to your identity — kept under our legitimate interest in preventing abuse.

Note: deleting your account does not cancel an active subscription — cancel it in your device Settings → [your name] → Subscriptions. Because accounts are anonymous, we generally cannot identify which account is yours from an email alone, so in-app deletion is the reliable path; if you can no longer access the app, contact [email protected] and we will do our best to verify and assist.

9. Your privacy rights

Depending on where you live, you have rights over your personal data. We honor these rights for all users regardless of location wherever feasible:

• Access — confirmation of what data we process about you and a copy of it.
• Correction — fixing incomplete or inaccurate data.
• Deletion — erasure of your data (see Section 8).
• Portability — receiving your data in a usable format.
• Objection / restriction — objecting to or limiting processing based on legitimate interests.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any right, use the in-app controls or email [email protected]. We respond within the timelines required by applicable law and will never discriminate against you for exercising your rights.

Brazil (LGPD)

If you are in Brazil, you additionally have the rights set out in Article 18 of the LGPD, including information about public and private entities with which we have shared your data, anonymization or blocking of unnecessary data, and review of automated decisions. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Requests can be made in Portuguese.

California (CCPA/CPRA)

If you are a California resident, you have the rights to know, delete, correct, and port your personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Service. We have not sold or shared personal information in the preceding 12 months.

EEA / UK (GDPR)

If you are in the European Economic Area or the UK, you may also lodge a complaint with your local supervisory authority.

10. International data transfers

Our infrastructure and service providers are located primarily in the United States. If you use Novou from Brazil or elsewhere outside the US, your data (including photos) is transferred to and processed in the US and other countries where our providers operate. Where required, transfers rely on appropriate safeguards such as standard contractual clauses and, for Brazil, the transfer mechanisms provided by the LGPD.

11. Security

We protect your data with encryption in transit (TLS) and at rest, per-user access controls at the database level (row-level security), scoped credentials for our providers, and least-privilege access internally. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Children

Novou is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has used the Service, contact us at [email protected] and we will delete the data.

13. Changes to this policy

We may update this policy as the Service evolves — for example, if we add providers or markets. Material changes will be announced in the app or on this page before they take effect, and the "Last updated" date will change. Earlier versions are available on request.

14. Contact us

For any privacy question or request:

Novou is operated by dgMotion Mobile, State of São Paulo, Brazil.
Privacy inquiries: [email protected]