Privacy & retention

NovaStraz privacy and retention notice — 26 October 2026 OrbiSignal Ltd, company 17512012, 8 James Road, Dartford, Kent, DA1 3NF, UK, is responsible for NovaStraz website, product fulfilment and support data. Contact privacy@novastraz.com. Stripe/Link independently processes payment and fraud information under its own privacy notices.

We process order references, purchased packs, price, consent/version records, country eligibility declarations and hashed access credentials to fulfil your contract. The purchase email is used for delivery and support. We do not receive full card details, wallet keys, exchange credentials or your local research CSV data. Cloudflare operates hosting, security and storage; Stripe/Link operates checkout; Resend sends transactional mail; support email is forwarded to the owner's Microsoft-hosted inbox. These providers may process data internationally under their applicable contractual safeguards. The application database uses a Western Europe location hint, which is not a guarantee of UK-only processing.

Contract performance is the basis for delivery and requested support. Legal obligations support required accounting records. Legitimate interests support proportionate fraud prevention, security, dispute handling and keeping evidence of the agreed licence. We do not enrol purchasers into marketing. Any future optional marketing requires a separate choice.

Planned commerce retention: abandoned pending orders are removed after 30 days; delivery email addresses and recovery records after 90 days; expired browser access hashes and checkout links are removed from operational use after 90 days. Minimal paid order and consent records are retained for seven years from purchase to support accounting and legal claims across financial years, then deleted. A documented dispute or legal hold pauses deletion for the affected record and is reviewed monthly. Support correspondence is reviewed for deletion 24 months after resolution unless needed for an unresolved issue or legal obligation. Provider backups and separately held payment/support records have their own deletion schedules; the daily application cleanup does not erase those systems automatically. We review provider settings and manual inbox retention monthly.

Browser storage holds private order access credentials for recovery until you remove them or clear browser storage. A session flag remembers offer dismissal. The free Cost Lab runs locally. We use no advertising pixels or analytics cookies. Technical rate-limit keys are hashed and time-scoped; application request logging is disabled. Hosting providers may still process technical request information for service operation and security.

You can request access, correction, deletion, restriction, objection or portability where applicable, and complain to the UK ICO or your local supervisory authority. We verify requests proportionately and explain any records we must retain. Do not send a private download code or sensitive identity document with your first request. Contact privacy@novastraz.com with your order reference if relevant.