Last updated: April 27, 2026
Data Deletion Policy
You have the right to have your personal data deleted. This page explains exactly what we hold, what we delete, and how to submit a request. We comply with GDPR, CCPA, and other applicable privacy laws.
1.Overview
This Data Deletion Policy describes what personal data Nova holds about you, how you can request its deletion, and what happens when we process that request. We are committed to honoring your right to erasure under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.
2.What Data We Hold
Nova stores the following categories of personal data: account information (name, email address, hashed password, and registration date); billing records (payment method metadata via Stripe — we do not store raw card numbers); API usage metadata (request counts, token counts, model identifiers, timestamps, and costs); API key hashes (the actual key is shown only once and is not stored in recoverable form); and standard server logs (IP addresses, browser user agents, retained for up to 90 days). We do not store the content of your prompts or model outputs.
3.How to Request Deletion
To request deletion of your personal data, send an email to privacy@nova.ai from the email address associated with your Nova account with the subject line "Data Deletion Request." Include your full name and the email address on your account. We may ask you to verify your identity before processing the request. Alternatively, you can submit a deletion request directly from Console → Settings → Danger Zone → Delete Account, which initiates the full account and data deletion process automatically.
4.What Gets Deleted
Upon a verified deletion request we will permanently delete: your account profile (name, email, password hash); all API keys associated with your account; your billing payment method from our systems (Stripe retains its own records per its data retention obligations); your usage history and cost logs; and any stored preferences or settings. Image and video outputs stored on our infrastructure are already set to expire automatically within 1–7 days and will be deleted on that schedule if not already gone.
5.What Cannot Be Deleted
Certain records must be retained even after a deletion request due to legal obligations: aggregated, anonymized usage statistics that do not identify you personally; billing transaction records required for tax, accounting, and fraud prevention purposes (typically retained for 7 years per financial regulations); records of any abuse or policy violations investigated under our Acceptable Use Policy; and data we are required to preserve in connection with ongoing legal proceedings or law enforcement requests.
6.Retention Period After Request
We complete deletion of all deletable data within 30 days of receiving a verified request. In practice, most data is deleted within 7 days. You will receive an email confirmation once deletion is complete. Backups are purged on a rolling 30-day cycle, so residual copies in backup systems are fully removed within 30 days of deletion from primary systems.
7.Third-Party Data
Nova passes requests to third-party AI model providers to generate responses. These providers operate under their own data retention and deletion policies. When you make an API request through Nova, the third-party provider processes your input; we do not control how they handle that data beyond what is specified in our provider agreements. Where providers offer zero-data-retention (ZDR) modes, you can opt in from Console → Settings. For questions about specific provider data practices, refer to the provider's own privacy documentation.
8.GDPR Rights
If you are located in the European Economic Area, you have the following rights under GDPR: the right to access a copy of your personal data; the right to rectify inaccurate data; the right to erasure ("right to be forgotten"); the right to restrict processing; the right to data portability; and the right to object to processing. To exercise any of these rights, contact privacy@nova.ai. You also have the right to lodge a complaint with your local supervisory authority.
9.CCPA Rights
If you are a California resident, you have the right to know what personal information we collect and how it is used; the right to delete personal information we hold about you; the right to opt out of the sale of your personal information (Nova does not sell personal information); and the right not to be discriminated against for exercising your privacy rights. To submit a verifiable CCPA request, email privacy@nova.ai or use the Console → Settings → Delete Account flow.
10.Contact
For data deletion requests or privacy questions, contact us at privacy@nova.ai. For legal notices, write to: Nova, Inc., 123 Market Street, San Francisco, CA 94105, Attn: Privacy Team. We respond to all verified requests within 30 days.
To request deletion, email privacy@nova.ai · Privacy Policy · Acceptable Use