Privacy Policy

Nova by HashMicro and the Nova mobile applications · Effective date: 21 October 2026 · Last updated: 21 October 2026

HashMicro Pte. Ltd. ("HashMicro", "we", "us", or "our") provides Nova by HashMicro, including the Nova web application, Android application, iOS application, APIs, integrations, and related services (together, Nova). This Privacy Policy explains what information we collect, why we use it, how we disclose and protect it, and the choices available to you.

Nova is a business and enterprise product. In many cases your employer, customer, or other organization (the Customer) controls the business information entered into Nova. If your organization provides your Nova account, contact that organization first for requests about its data; we will assist it as required by our agreement and applicable law.

Store notice. This policy applies to Nova downloaded from Google Play, the Apple App Store, or another authorized channel. It is intended to describe the same data practices for Google Play Data safety and Apple App Privacy disclosures. The exact permissions shown depend on the features enabled by your organization and the choices you make in the app.

1. Information we process

Category	Examples	How it is obtained
Account and identity	Name, work email, phone number, organization, tenant, role, access rights, password hash, SSO subject, MFA and trusted-device information.	You, your organization, or an identity provider when you sign in or are invited.
Business and user content	Invoices, payments, products, inventory, orders, customers, suppliers, employees, leads, conversations, notes, workflows, spreadsheets, signatures, images, PDFs, receipts, and other records or files.	You and other authorized users of your organization.
Communications and integrations	Support requests, email metadata, calendar information, WhatsApp messages and contacts, marketplace or accounting integration data, delivery and read status.	You, your organization, or an integration that you explicitly connect.
Camera, images and OCR	Images captured for barcode scanning, receipts, bills, documents, or other workflows, and text or fields extracted from them.	Only after you use a camera, scanner, upload, or OCR feature and grant the relevant permission.
Location	Approximate or precise latitude, longitude, timestamps, journey points, and derived route or place information.	Only when you start an enabled salesperson journey and grant location permission. Background location is used only for an active journey where your device and operating system permit it.
Device and technical data	IP address, browser or device type, operating-system version, app version, language, time zone, crash and diagnostic logs, security events, and a pseudonymous device or session identifier.	Automatically when Nova is used, for security, reliability, and service operation.
Notifications and local hardware	Push-notification token and notification preferences; connection status or identifiers for approved Bluetooth, USB, receipt-printer, scanner, or POS hardware.	When you enable notifications or connect supported hardware. Hardware data is used to perform the requested local action.
Voice and audio (optional)	Voice notes or audio submitted for transcription, plus the resulting transcript.	Only when you choose a voice or transcription feature and grant microphone access. Nova does not continuously record the microphone.

We do not knowingly collect sensitive personal information unless you or your organization chooses to place it in a business record. Do not enter information that Nova does not need for the relevant workflow.

2. How we use information

We use information for the following purposes:

Provide, authenticate, maintain, and improve Nova and the features requested by you or your organization.
Store, search, calculate, reconcile, export, print, sign, route, and audit business records according to the organization's configuration.
Deliver notifications, messages, support, service announcements, and security alerts.
Run integrations and user-requested communications, including email, WhatsApp, calendar, marketplace, payment, and accounting connections.
Detect fraud, abuse, unauthorized access, malware, and other security or reliability problems.
Measure service performance, diagnose failures, enforce limits, and produce aggregated or de-identified analytics.
Meet legal obligations, enforce agreements, resolve disputes, and protect the rights, safety, and property of HashMicro, our customers, and others.

We do not sell personal information. We do not use Nova business content for cross-context behavioral advertising, and Nova does not include advertising SDKs for that purpose.

3. Hashy and artificial intelligence

Nova includes optional AI features under the name Hashy. Hashy may search or summarize records, answer questions, draft text, classify or extract information, read images, transcribe audio, generate insights, recommend actions, or call an authorized Nova tool. It can process your prompt, conversation history, selected records, attachments, audio, images, and the minimum context needed to answer or complete the requested action.

Hashy follows the signed-in user's Nova permissions, tenant, branch, and other access restrictions. A prompt does not grant access to hidden data.
AI output is probabilistic and may be incomplete or wrong. Review it against the underlying record before relying on it, especially for financial, employment, legal, tax, safety, or customer decisions. Hashy does not replace professional advice or required human approval.
Depending on the Customer's configuration, requests may be sent to a selected AI provider or gateway, which may include Anthropic, OpenAI, Google, Hashy/XAI, or another provider configured by HashMicro or the Customer. Those providers process the request to return the result and may process limited technical metadata.
HashMicro does not use Customer content to train a general-purpose model that we operate. Provider retention, safety review, and training settings depend on the provider, contract, and tenant configuration. Customers should review the provider terms and avoid submitting information that is unnecessary for the requested result.
AI tool calls can create, change, send, or export data only where the user and organization have the required permission. Nova records relevant actions in audit history where the feature supports it.

4. Permissions in the mobile apps

You can deny or later revoke optional permissions in your device settings. Some workflows will not work without the related permission:

Camera: barcode scanning and capturing receipts, bills, or documents for OCR.
Location, including background location where enabled: recording an active salesperson journey after you start it. Nova does not use background location for advertising or when no journey is active.
Notifications: alerts, approvals, messages, security notices, and other updates you or your organization enables.
Bluetooth, USB, and local network access where the operating system requests it: supported scanners, printers, POS devices, and other hardware that you choose to connect.
Microphone: only for an explicitly selected voice-note or transcription workflow; the mobile app does not continuously listen.

5. When we disclose information

We disclose information only as needed for the purposes in this policy:

Customer and authorized users: to the organization that provides your account and people it authorizes, according to its access settings.
Service providers: hosting, databases, storage, email, messaging, support, security, analytics, OCR, transcription, AI, payment or integration providers that process information for HashMicro under contractual safeguards.
Connected services: a service you or the Customer chooses to connect, such as WhatsApp, a marketplace, calendar, accounting system, printer, or scanner. The connected service's policy also applies.
Corporate transactions: a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and legal protections.
Legal and safety requests: courts, regulators, law enforcement, or other parties when disclosure is required by law or reasonably necessary to prevent harm, fraud, or abuse.

We do not disclose personal information to data brokers or sell it for monetary consideration.

6. International processing

HashMicro and our providers may process information in countries other than the country where you live or where your organization is established. We use contractual, technical, and organizational measures appropriate to the transfer, such as data-processing agreements, approved transfer mechanisms, access controls, and encryption. Your organization may choose a regional hosting or provider configuration where Nova offers one.

7. Retention and deletion

We keep information for as long as needed to provide Nova, meet the Customer's instructions and contract, maintain audit and security records, resolve disputes, comply with tax or other legal obligations, and enforce agreements. Customer administrators control many records and may export or delete them subject to legal holds and technical limits. Backups and security logs may remain for a limited period while they age out through normal cycles.

To request account or personal-data deletion, contact your Nova administrator or email privacy@hashmicro.com. We will verify the request, coordinate with the Customer where it is the controller, and explain any information that must be retained by law or for legitimate security purposes. Deleting the app removes local app data and does not by itself delete server-side account or business records.

8. Security

We use safeguards appropriate to the risk, including encryption in transit, access controls, tenant and branch scoping, authentication and MFA features, audit trails, rate limiting, monitoring, backups, and incident response procedures. No internet service is completely secure. Keep credentials and one-time codes private, use supported device and operating-system versions, and report suspected unauthorized access promptly.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, withdraw consent, and lodge a complaint with a data-protection authority. You may also control optional notifications, camera, location, microphone, hardware, and integration permissions through Nova or your device settings.

Where an organization controls the data, we may direct your request to that organization and provide reasonable assistance. We will not discriminate against you for exercising a privacy right. We may need to verify identity and authority before completing a request.

Residents of California may have additional rights under the California Consumer Privacy Act, including the right to know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information. Nova does not sell or share personal information for cross-context behavioral advertising. Residents of the European Economic Area, United Kingdom, and Switzerland may contact us about GDPR or equivalent rights and may complain to their local supervisory authority.

10. Children

Nova is a business service and is not directed to children under 13, or the higher minimum age required in your jurisdiction. We do not knowingly collect children's personal information for independent use. If you believe a child provided information, contact us so we can investigate and delete it where appropriate.

11. Cookies and similar technologies

Nova uses essential cookies, local storage, session identifiers, and similar technologies to keep you signed in, preserve security, remember preferences, support the app shell, and understand reliability. We do not use these technologies for third-party behavioral advertising. Your browser can block cookies, but doing so may prevent sign-in or other core functions.

12. Third-party services and links

Nova may contain links, integrations, or sign-in options operated by third parties. Their privacy policies and terms govern their own processing. Review those policies before connecting a service or sending information to it. HashMicro is not responsible for a third party's independent practices.

13. Changes to this policy

We may update this policy when Nova, our processing, or applicable law changes. We will post the revised version here, update the effective date, and provide additional notice where required. If a change materially affects your rights, we will use a reasonable additional notice channel.

14. Contact us

For privacy questions, rights requests, complaints, or data-protection matters:

HashMicro Pte. Ltd.
Privacy team
Email: privacy@hashmicro.com
Website: https://hashmicro.com

Include “Nova privacy request” in the subject and tell us whether you use Nova through an organization, so we can route the request correctly. Do not send passwords, authentication codes, or unnecessary confidential documents by email.