Product Privacy Notice

This Product Privacy Notice explains how Nova8 collects and uses personal data in connection with the contract review and drafting service offered at products.nova8.co (the “Service”). It is a specific notice under, and supplements, our Group Privacy Policy; where there is any inconsistency in relation to the Service, this notice applies. Words defined in the Group Privacy Policy have the same meaning here. The group company providing the Service and coordinating data protection is Nova8 Pte. Ltd. (company registration no. 201543872K; EA Licence No. 17S8782), 105 Cecil Street, #22-88 The Octagon, Singapore 069534.

1. What this notice covers

The Service lets you submit commercial contracts and instructions for review or drafting, supported by AI and human quality-assurance review. This notice explains how we handle personal data in that context. Our general processing — including where we act as controller for your account, billing and marketing data — is described in the Group Privacy Policy.

2. The personal data we process

In connection with the Service we may process: account and contact details; order and billing information (card and payment details are collected and processed by our payment provider, not stored by us); website and usage data (see the Cookies section below); correspondence and support communications; and the content of the documents and instructions you submit. The documents you submit may contain personal data about you and about other individuals, for example counterparties, signatories or individuals named in a contract.

3. Our role: controller and processor

For your account, billing, website-usage and marketing data, Nova8 acts as a controller and determines how and why that data is processed.

For the content of the documents and instructions you submit for the Service, Nova8 acts as a processor (and, under the PDPA, as a data intermediary), processing that content on your behalf and on your instructions in order to provide the Service. As between you and Nova8, you are the controller of the personal data contained in those documents, and you are responsible for having a lawful basis to provide it to us and for any notices or consents required in relation to the individuals concerned.

4. Why we use it and our legal bases

We use personal data to provide and deliver the Service and the website; take payment and manage your account; provide support; ensure security and prevent misuse; comply with legal and regulatory obligations; and improve our technology, standard positions and Service. Where the UK GDPR applies, we rely on performance of a contract, our legitimate interests in operating, securing and improving the Service (balanced against your rights), consent (for optional marketing and non-essential cookies), and compliance with legal obligations. Where the Singapore PDPA or the Malaysia Personal Data Protection Act 2010 applies, we rely on your consent, deemed consent, or the applicable legitimate-interests and business-improvement bases.

5. Artificial intelligence

The Service uses technology, including AI, to assist with intake, issue identification, comparison and drafting, together with human quality-assurance review before delivery. Consistent with the Group Privacy Policy, we do not use your documents, their content or your personal data to train artificial-intelligence models; our AI providers act as our processors under contract and are not permitted to use your personal data to train their models, nor do we train models on your data ourselves. A deliverable is a commercial work product prepared for your own consideration and is not legal advice (see our Terms of Service).

6. Who we share it with and sub-processors

We share personal data only as necessary with: other companies in the Nova8 group; hosting and cloud infrastructure providers; the AI and model providers used to deliver the Service; our payment provider; analytics providers; and professional advisers, each under written contract. We do not sell your personal data. A list of our key sub-processors is available on request via privacy@nova8.co. International transfers are made under the safeguards described in the Group Privacy Policy, including the UK International Data Transfer Agreement or Addendum and standard contractual clauses, and comparable protections for transfers from Singapore and Malaysia.

7. How long we keep it

We keep the documents you submit and the deliverables we produce for the duration of your account and for 12 months after it is closed or last used (or, for one-off purchases made without an account, for 90 days after delivery), and your account and billing records for 7 years, to meet tax and accounting requirements, after which they are deleted or anonymised, unless we are required to retain them for longer to comply with a legal obligation or to establish, exercise or defend legal claims. Our general retention periods are set out in our Retention Schedule.

8. Cookies

The product website currently uses only strictly necessary cookies — for example, to keep the site secure, to balance load, to maintain your session and to remember your cookie choices. These are required for the site to work and do not require your consent under applicable law. We do not currently use analytics, advertising or other non-essential cookies on the product website. If we introduce non-essential cookies in future, we will display a cookie banner, publish a separate cookie policy, and obtain your consent before setting them. You can control cookies through your browser settings, although parts of the site may not work properly if you block strictly necessary cookies.

9. Your rights, contact and complaints

Your rights are as set out in the Group Privacy Policy. Where you have submitted documents to us as a processor, requests from individuals named in those documents should generally be directed to you as controller, and we will assist you as required. For any privacy question or to exercise your rights, contact our Data Protection Officer at privacy@nova8.co. You may complain to the Personal Data Protection Commission (Singapore), the Information Commissioner’s Office (United Kingdom) or the Personal Data Protection Department (Malaysia). Nova8 Pte. Ltd. has appointed Source Professional Support Limited (1 Cornhill, London EC3V 3ND) as its UK representative under Article 27 of the UK GDPR; individuals in the UK may contact the representative at that address or via privacy@nova8.co.

10. Changes to this notice

We may update this notice from time to time; the version date above shows when it was last changed, and the current version is available at products.nova8.co.