Privacy Policy

1. Information We Collect

When you use Novala, we collect several categories of information. Some information you provide directly to us: your name, email address, phone number, business information (business name, legal structure, tax registration numbers, business address), payment information (credit card numbers or bank account details, though these are processed by our payment processor and we do not store full card numbers), and profile information.

We also collect information generated through your use of the Services: business data you enter (payroll records, employee information, invoices, financial transactions, tax filings), documents and files you upload (receipts, forms, photos), and communications you have with our support team.

Additionally, we automatically collect certain technical information: IP address, browser type and version, operating system, device information, referring URLs, pages visited, time spent on pages, and other analytics data. We use cookies and similar technologies to collect some of this information.

2. How We Use Your Information

We use your personal information for several purposes, primarily to provide and improve our Services. Specifically, we use your information to: create and manage your account, process payments and manage subscriptions, provide customer support and respond to your inquiries, process payroll and generate tax filings on your behalf, deliver product updates and important service notifications, and improve our Services through analytics and feedback.

We may also use your information to communicate with you about new features, promotions, or other business opportunities, but only where you have opted in to receive such communications. You can opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us directly.

We use your information for security purposes: to detect and prevent fraud, abuse, and security incidents, to verify your identity, and to comply with legal obligations. We may use aggregated or de-identified data (data that does not identify you personally) for research, product development, and business analytics.

3. Legal Basis for Processing

Under PIPEDA and other applicable Canadian privacy laws, we process your personal information based on one or more legal grounds. Consent: We rely on your consent for many activities, including creating your account, providing our Services, and sending marketing communications. You have the right to withdraw consent at any time.

Contract performance: We process your information as necessary to perform our contract with you (i.e., to provide the Services you subscribed to). Legal obligation: We may process your information to comply with legal requirements, such as tax reporting, employment record retention, or responses to lawful requests from government authorities.

Legitimate interests: We may process information based on our legitimate business interests, provided these interests are not overridden by your privacy rights. Examples include fraud prevention, security monitoring, and business analytics.

4. How We Share Your Information

We do not sell your personal information. We do not rent your personal information. Novala's business model is based on subscription fees, not on selling data.

We share your information only in limited circumstances. With service providers who help us operate Novala (hosting providers, email delivery services, payment processors, customer support tools). These providers are bound by strict confidentiality obligations and can only use your data to provide services to us. With government authorities as required by law, such as tax authorities (CRA) for authorized payroll filings, or in response to valid legal process (court orders, subpoenas).

With your explicit consent for specific purposes you authorize (for example, if you connect a third-party accounting tool or authorize your accountant to access your data). In connection with a business transaction such as a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections. In emergency situations to protect the safety of a person or to prevent serious harm.

5. Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security measures include: 256-bit SSL/TLS encryption for all data transmitted between your device and our servers, AES-256 encryption for data stored in our databases, hosting in SOC 2 Type II compliant data centers with physical security controls, and multi-factor authentication for user accounts.

We also implement operational security controls: strict access controls limiting employee access to personal data on a need-to-know basis, regular security audits and penetration testing, employee training on data security and privacy, incident response procedures for potential breaches, and regular software updates and vulnerability patching.

While we take significant precautions, no method of transmission or storage is 100% secure. If you believe your account has been compromised or you become aware of a security incident, please contact us immediately at security@getnovala.com.

6. Data Location and International Transfers

Your personal information is stored primarily in Canadian data centers, specifically in the Amazon Web Services (AWS) Canada Central region located in Montreal, Quebec. This ensures compliance with Canadian data residency requirements and provides you with the strongest privacy protections available under Canadian law.

In limited circumstances, some data may be processed outside of Canada. For example, certain third-party service providers we use for functions like email delivery, customer support, or analytics may be based in other countries. When personal data is transferred outside Canada, we ensure appropriate safeguards are in place, such as standard contractual clauses or the recipient's compliance with recognized privacy frameworks.

We provide details about specific third-party service providers and the countries in which they operate upon request. Contact privacy@getnovala.com for a current list.

7. Data Retention

We retain your personal information for as long as necessary to provide you with our Services and for legitimate business purposes, or as required by law. Different types of data have different retention periods.

Account information: While your account is active and for a reasonable period after cancellation (typically 30 days) to allow you to reactivate or export your data. Financial and tax records: Retained for at least 7 years after the end of the relevant tax year, as required by CRA regulations. Employee records: Retained in accordance with provincial employment standards laws, typically 3-7 years depending on the record type.

Marketing preferences: Retained until you unsubscribe or object to processing. Support communications: Typically retained for 2-3 years for quality assurance and to help resolve any recurring issues. You may request deletion of data that is not required by law to be retained. See "Your Rights" below for details.

8. Your Rights Under PIPEDA

You have several important rights regarding your personal information under Canadian privacy law. Right to access: You may request access to the personal information we hold about you. We will provide this information within 30 days at no charge.

Right to correction: If any of your personal information is inaccurate or incomplete, you have the right to request that we correct it. We will make corrections within a reasonable time.

Right to withdraw consent: You may withdraw your consent for the collection, use, or disclosure of your personal information at any time. Note that withdrawing consent may affect our ability to provide certain Services.

Right to deletion: You may request that we delete your personal information, subject to certain legal exceptions (such as data we are required to retain for tax purposes). Right to challenge compliance: You may raise concerns about our privacy practices with our Privacy Officer at privacy@getnovala.com. If not resolved to your satisfaction, you may file a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact privacy@getnovala.com. We may need to verify your identity before responding.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website and platform. Cookies are small data files stored on your device by your browser.

We use several types of cookies. Essential cookies are necessary for the platform to function properly (login sessions, security tokens, preferences). These cannot be disabled without breaking core functionality.

Analytics cookies help us understand how visitors use our website so we can improve it. This includes anonymous usage data such as pages visited, time spent, and features used. Preference cookies remember your settings like language selection, theme preferences, and dashboard layout.

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies, though this may affect the functionality of the Services. You can also manage cookie preferences through the cookie consent banner on our website.

10. Children's Privacy

Novala is designed for use by businesses and their employees. Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@getnovala.com. We will promptly delete such information from our records.

Businesses using Novala are responsible for ensuring compliance with any laws regarding the collection of information about minors who may be employees, contractors, or interns.

11. Marketing Communications and CASL Compliance

We take our obligations under Canada's Anti-Spam Legislation (CASL) seriously. You will only receive marketing communications from us if you have provided explicit consent to receive them, such as by checking a subscription box on our website or during account signup.

Every marketing email we send includes clear identification of us as the sender, our contact information, and an easy way to unsubscribe. You can unsubscribe at any time by clicking the unsubscribe link in any of our emails, updating your preferences in your account settings, or emailing us at unsubscribe@getnovala.com.

Even if you unsubscribe from marketing communications, you will continue to receive transactional emails necessary for the Services (such as payment receipts, account security alerts, product updates that affect your usage, and legal notices). These are required for us to fulfill our contractual obligations to you.

12. Automated Decision-Making

Novala uses automated processes to help with tasks such as fraud detection, anomaly detection in financial data, and personalized recommendations for features you might find useful. These automated processes are designed to assist you and your business, not to make decisions with significant legal or similar effects on you.

Where automated processing might have significant effects on you (for example, flagging your account for security review), we ensure human oversight is available. You have the right to request human review of any automated decision that significantly affects you.

Vela processes queries about your business data to provide insights and answers. This processing is done within your account and does not involve sharing your data with other customers.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or through a prominent notice in the platform at least 30 days before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. The "Last Updated" date at the top of this policy indicates when it was most recently revised.

Changes that are minor (such as clarifications or formatting improvements) may be made without advance notice, but we will always maintain a change log available on request.

14. Contact Our Privacy Officer

If you have questions, concerns, or requests regarding your personal information or this Privacy Policy, please contact our Privacy Officer at privacy@getnovala.com. We will respond to all inquiries within 30 days, and typically much sooner.

Our Privacy Officer is responsible for ensuring our compliance with PIPEDA and other applicable privacy laws, handling requests from individuals about their personal information, and coordinating our response to any privacy incidents or complaints.

If you are not satisfied with our response to a privacy concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada. Their contact information is available at priv.gc.ca. Alberta residents may also contact the Office of the Information and Privacy Commissioner of Alberta.