Privacy Notice
How NOVA handles parent-account and learner information.
1. Who controls the data
NOVA operates the NOVA service and acts as the data controller for information described here.
NOVA is in pre-launch development. The legal operator's full business contact details will be added before paid public launch.
2. Information NOVA may hold
| Area | Examples |
|---|---|
| Parent account | Name, email, family/household name, authentication records and account settings. |
| Learner profile | Display name, year group, profile preferences and theme. |
| Learning | Timetable, lesson state, answers, progress, scores, mastery, hand-ins and feedback. |
| Projects & extras | Saved projects, worksheets, challenges and completion status. |
| Portfolio/evidence | Files, photos, PDFs or documents deliberately uploaded by the family. |
| Technical/security | Session information, essential cookies, error/security information and limited device/browser information created by hosting/authentication providers. |
3. Why we use it
- To create and secure the parent account.
- To keep each learner's work separate inside the family.
- To save timetables, progress, submissions, projects and evidence.
- To show parents the correct child's results and learning history.
- To prevent abuse, investigate errors and protect the platform.
- To respond to support, privacy or account requests.
4. Lawful bases
For adult account data, processing needed to create and operate the requested NOVA service will normally be based on performance of the contract with the adult account holder. Security, fraud prevention, service administration and some learner-data processing may rely on legitimate interests, with children's best interests and privacy given particular weight.
Where NOVA introduces genuinely optional processing that requires consent, it will ask separately. NOVA does not treat acceptance of this privacy notice as GDPR consent.
Because children's data needs extra care, NOVA will maintain a data-protection impact assessment and review these lawful bases before paid launch and when major features change.
5. Children's privacy
Child profiles are created inside an adult-managed family account. Privacy settings are designed to be protective by default. NOVA does not make learner profiles public, does not use learner data for behavioural advertising, and does not enable precise geolocation.
A shorter explanation written for learners is available at Privacy for learners.
6. Who data is shared with
NOVA uses service providers where necessary to operate the platform. Current core providers include:
- Supabase — authentication, database and private file storage.
- Vercel — web application hosting and delivery.
Providers may process technical information on NOVA's behalf under their own data-processing terms. Additional providers such as a payment processor or transactional-email provider will be added to this notice before those features are used.
7. International transfers
Some technology providers may process data outside the UK. Where this happens, NOVA will rely on lawful transfer safeguards required by UK data-protection law and review provider terms before production use.
8. How long data is kept
Live account and learning data is kept while the family account is active unless it is no longer needed sooner. When an account is closed or valid deletion is requested, data will be removed or anonymised from live systems subject to legal obligations, dispute/security needs and limited backup cycles.
NOVA will maintain a written retention schedule before paid launch rather than keeping child learning data indefinitely by default.
9. Your rights
Depending on the circumstances, UK data-protection law gives people rights including access, correction, erasure, restriction, objection and data portability. Children have data-protection rights in their own right even where a parent manages the account.
Parents can contact NOVA through the Contact page to make a request. You can also complain to the UK Information Commissioner's Office if you believe your data has been handled unlawfully.
10. Security
NOVA uses account authentication, row-level database access controls, private storage and family/profile separation. No internet service can promise zero risk, so security controls, backups and access policies are reviewed as the product develops.
11. Cookies and local storage
NOVA currently uses storage technologies needed for sign-in/session security and local interface preferences such as theme/profile selection. See the Cookies & local storage page. If analytics or advertising technologies are introduced later, NOVA will obtain consent first where UK law requires it.
12. Changes
This notice will be reviewed as new age groups, GCSE content, payments, email systems, community features or other significant processing are launched.