Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Nova Terms of Service between you (the operator) and Novanest Pro, Inc. ("Nova"). It explains how Nova processes personal data that flows through your Thumbtack account when you use Nova to handle customer conversations.

1. Roles

• You are the data controller of the personal data your customers share with you on Thumbtack.
• Nova is your data processor: we process that data only on your behalf and only to provide the service.
• Thumbtack, Inc. is the original controller of the platform relationship with the end customer.

2. What data we process

• Inbound and outbound messages exchanged through the Thumbtack Partner API.
• Lead form data Thumbtack collected from the customer (category, project description, zip, customer name).
• Photos and attachments your customers share in those messages.
• The customer's stated phone number or address, if and only if they typed it in the chat.

3. Purpose of processing

Strictly to deliver the Nova service: drafting replies on your behalf, detecting booking outcomes, generating booking summaries, and notifying you. We do not use customer data for any other purpose, including marketing or model training.

4. Sub-processors

We engage the following sub-processors to provide Nova:

Sub-processor	Purpose	Location
Amazon Web Services	Hosting (ECS Fargate)	USA
MongoDB Atlas	Database	USA
OpenRouter	LLM gateway	USA
Anthropic / Google / OpenAI	LLM inference (via OpenRouter)	USA
Scrapfly	Image proxy for Thumbtack attachments	USA
Telegram	Operator notifications + approval flow	Global
Retell AI	Booking-announcement phone calls (opt-in)	USA

We'll notify operators on file at least 30 days before adding or replacing a sub-processor.

5. Security

• All data transfers use TLS 1.2+.
• OAuth tokens and other secrets are encrypted at rest in AWS Systems Manager and MongoDB.
• Per-operator data isolation via business_id.
• Access to production systems is restricted to authorized Novanest Pro engineers.
• Plaintext credentials and tokens are never logged.

6. Data subject requests

If a customer asks you (the controller) to delete or export their data, forward the request to contact@novanestpro.com and we will action it within 30 days.

7. Incident notification

If we become aware of a security incident affecting your data, we'll notify you without undue delay (and in any case within 72 hours) with what happened, what data is affected, and what we're doing about it.

8. Deletion on termination

When you disconnect your Thumbtack account or close your Nova account, OAuth tokens are revoked immediately. All operator and customer data tied to your account is deleted within 30 days unless we are legally required to retain it (e.g. tax/audit records of billing, never message content).

9. International transfers

All processing occurs in the United States. If you require an EU or UK data residency arrangement (e.g. with Standard Contractual Clauses), contact us — we'll handle it on a per-operator basis.

10. Audits

Once per calendar year, on 30 days' notice, you may request a summary of our security controls and sub-processor list. We'll respond in writing within 30 days.

11. Contact

Novanest Pro, Inc.
San Francisco, California, USA
contact@novanestpro.com