Privacy Policy

This policy explains how SOARR Pty Ltd ACN 696 424 898 trading as NOVON HQ (SOARR) handles personal information. We handle it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What we collect

Category	Examples	Why
Account	Name, email, password (hashed), role	To create and secure your account
Business profile	Business name, industry, size, revenue range, location, challenges, goals, systems used	To produce your analysis and match you to people
Specialist profile	University or open-board status, headline, skills, certificates, resume, availability, rate	To match you to roles and verify claimed skills
Payout and tax details (Specialists)	Legal name, date of birth, address, phone, ABN, bank details	To pay you, to withhold tax where the law requires, and to report payments to the ATO under the Sharing Economy Reporting Regime
Engagement records	Applications, acceptances, hours, ratings and reviews	To run the marketplace and calculate fees
Legal records	Executed deeds, your drawn signature, date and time, IP address, device type and approximate location (city, region, country) worked out from your IP address	To evidence who signed, when and where
Message metadata	Who messaged whom, when, and your public encryption key	To deliver messages. We cannot read message content (see section 2)
Compliance flags and conduct records	That a message was blocked and the category detected; warnings, notices, responses and decisions	To enforce platform rules fairly and keep the records the law requires
NOVON Automation Kits	Kit orders and plans, your hourly-value setting, and activity reports from your Kits (the action type, a system reference such as an email, lead, call or invoice number, an invoice or job value, and the time). Your customers' information inside Kits is handled for you under the Data Processing Schedule	To run and bill Kits and show estimated hours saved on the Money page
Certified Installer vetting	Identity confirmed, university enrolment confirmed, date a National Police Check was sighted, Kit certifications, supervised-install record	To decide who may access client systems
Marketing preferences	Whether you joined the founding list and whether you have unsubscribed	To send only what you agreed to
Technical	Device type, browser, IP address, log timestamps, notification subscription	Security, fraud prevention, diagnostics and notifications

We do not collect sensitive information as defined in the Privacy Act (such as health information or racial or ethnic origin) unless you volunteer it, and we ask you not to, with one exception: before a person can become a NOVON Certified Installer we sight their National Police Check, because installers are given access to clients' email, accounts and customer information. We do this only with their express consent, record only that the check was sighted and its date, keep no copy, and never ask about spent convictions.

2. Encryption and what we cannot see

2.1 Messages are end-to-end encrypted. Your device generates a private key that never leaves it, and we store only ciphertext and the initialisation vector, so message content is encrypted on your device and we do not hold the keys to read it. The exception is translation. If you tap Translate, the text being translated (including messages the other person sent you) leaves your device, passes through our servers and goes to our AI provider, Anthropic PBC in the United States, to be translated. We do not store it. We ask you before the first translation, and the other person is told when a conversation has been translated.

2.2 A consequence you should understand: if you lose your device and its stored key, past messages cannot be recovered by us.

2.3 Automated checks for off-platform contact details and abusive language run on your device before encryption. When a message is blocked we receive only the fact that it happened and the category detected, never the text.

3. How we use your information

We use personal information to operate the Platform: to create and secure accounts, produce analyses and matches, run engagements, calculate and collect fees, pay Specialists, verify certificates, comply with law (including tax withholding and ATO reporting), prevent fraud and misuse, and improve our services.

Model training. We use aggregated and de-identified information to improve our matching and analysis. We do not use the content of your encrypted messages for any purpose. We will not use identifiable business information to train models made available to other customers without your express consent.

4. Direct marketing

4.1 We may send you service messages about your account, engagements and legal documents. These are not marketing and you cannot opt out of them while you hold an account.

4.2 We only send marketing where you have consented, and every marketing message identifies us and contains a working unsubscribe link, as required by the Spam Act 2003 (Cth). You can opt out at any time with the unsubscribe link in any marketing email, or in Settings if you have an account. We act on an unsubscribe within 5 business days, usually immediately.

5. Who we disclose to

5.1 Other users: a Business you apply to sees your profile, skills, verified certificates and redacted resume. Contact details are removed automatically.

5.2 Service providers: hosting, payment processing, email delivery, notifications and AI processing, bound by contract to protect your information and use it only for the services they provide us. We do not use third-party analytics or advertising services.

5.3 Government: the ATO, for tax withholding and Sharing Economy Reporting Regime reports about payments to Specialists.

5.4 Law: where required by Australian law, a court order, or to prevent a serious threat to life, health or safety.

5.5 Business transfer: to an acquirer of our business, subject to this policy.

5.6 We do not sell your personal information.

6. Where your information goes

6.1 The NOVON app and its database are hosted on servers in Sydney, Australia.

6.2 Some service providers handle information outside Australia. Before disclosing personal information overseas we take reasonable steps under APP 8 to make sure they handle it consistently with the APPs. Current overseas recipients:

Provider	Country	What for
Anthropic PBC	United States	NOVONAI processing (see 6.3)
Resend	United States, with sending from Japan	Email delivery
Stripe	United States and other countries	Card payments and payouts
Google	United States and other countries	Our staff email, and browser notifications on Chrome and Android
Apple and Mozilla	United States	Browser notifications on Safari, iPhone and Firefox
ipwho.is	Overseas	Approximate location from your IP address when you sign a deed
Kit providers (Twilio, Vapi and others)	See the Data Processing Schedule	Running NOVON Automation Kits for Kit clients

6.3 NOVONAI. With your permission, which we ask for in the app before the first time, we send information to Anthropic PBC in the United States to: read your business brief and rank Specialists for you (your brief, industry and location, and each shortlisted Specialist's headline, profile summary, university, skills and ratings); check uploaded certificates (the certificate image); run the discovery interview and prepare your Blueprint; fill forms by voice; translate messages when you choose to; and, for Kit clients, to run Automation Kits as set out in the Data Processing Schedule. Under our agreement with Anthropic, this content is not used to train its models. You are told whenever you are dealing with NOVONAI rather than a person, you can withdraw permission at any time in Settings › Privacy and security › NOVONAI, and every NOVONAI feature has a non-AI alternative.

7. Security

Access controls and role separation; passwords hashed with scrypt and never stored in plain text; end-to-end encryption for messages; encryption in transit; automatic redaction of contact details in uploaded documents; and logging of administrative access. No system is perfectly secure. If a data breach is likely to cause serious harm, we will assess it promptly, and notify you and the Office of the Australian Information Commissioner, following the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

8. How long we keep it

8.1 Account and profile information: while your account is open, then removed from the Platform immediately when you close it and erased from backups within 30 days.

8.2 Executed deeds and financial records: at least 7 years. The law requires us to keep financial records, and we keep deeds as evidence of what was agreed. These survive account deletion.

8.3 Encrypted message ciphertext: deleted when either participant deletes the conversation or closes their account.

8.4 Compliance flags: 24 months. Conduct case records (warnings, notices, responses and decisions): 7 years.

9. Your rights

9.1 Access: request a copy of the personal information we hold about you, or download it from Settings.

9.2 Correction: correct anything inaccurate, from your profile or by asking us.

9.3 Deletion: close your account and delete your personal information at any time from Settings › Account management › Close account, subject to clause 8.2.

9.4 Complaint: contact us at privacy@novonhq.com.au. We respond within 30 days. If you are not satisfied, contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

10. Age

You must be 18 or older to use NOVON. We do not knowingly collect personal information from anyone under 18, and if we learn we have, we delete it.

11. Cookies, notifications and similar technology

11.1 We use a small number of strictly necessary cookies to keep you signed in and to remember which side of the Platform you are using. We do not use third-party advertising or analytics cookies.

11.2 If you turn on notifications, your browser gives us a subscription address for its push service (Google, Apple or Mozilla). Notification content is encrypted so the push service cannot read it. Turn notifications off at any time in your browser or device settings.

12. Automated decisions

Where available, some steps are taken, or substantially taken, by software using your personal information:

(a) Message checks: checks on your device detect contact details, off-platform payment arrangements and abusive language in messages, block those messages and record a written warning. We use the category detected and your warning history. Warnings can lead to a review, but any decision to suspend or remove access is made by a person after you have had the chance to respond (see our Acceptable Use Policy).

(b) Credential checks: NOVONAI reads an uploaded certificate and can grant a verification tick or refer it to a person. We use the certificate image and the skill you claimed. A person reviews anything NOVONAI is unsure about.

(c) Matching: software and NOVONAI rank Specialists for a Business, using profiles, skills, verified credentials and ratings.

You can ask a person to review any of these at appeals@novonhq.com.au.