Privacy Policy

1. INTRODUCTION

Galaxa Nova Inc. ("we," "us," "our," or "Galaxa Nova") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Nova Agent service (the "Service").

This Privacy Policy applies to:

• Business customers who subscribe to Nova Agent (e.g., Croma/Infiniti Retail Limited).
• End-users who interact with Nova Agent on our customers' websites or applications.

By using the Service, you consent to the data practices described in this Privacy Policy.

2. DATA CONTROLLER AND PROCESSOR ROLES

2.1 When We Are a Data Processor

When providing the Service to Customers (like Croma), Galaxa Nova acts as a Data Processor with respect to End-User Personal Data contained in conversations. The Customer determines the purposes and means of processing End-User Personal Data.

2.2 When We Are a Data Controller

Galaxa Nova acts as a Data Controller with respect to Personal Data of Customer's authorized users who access the Nova Agent dashboard, and aggregated data used for Service improvement.

3. INFORMATION WE COLLECT

3.1 Information Collected Automatically (Service Data)

When you use the Service, we automatically collect technical information (IP address, browser type, device type) and usage information (date/time of access, performance metrics).

3.2 Information from End-Users

When End-Users interact with Nova Agent on a Customer's website, we collect conversation data (messages, queries), product context (via Sales Data Engine), and session metadata.

3.3 Information from Third-Party Sources

Real-Time Product Data: We access product information (names, specs, prices) via real-time public search and retrieval from the Customer's website. We do not store a permanent copy of the Customer's full database but retrieve data on-demand to ensure accuracy.

4. HOW WE USE INFORMATION

4.1 Providing the Service

We use End-User conversation data to generate AI-powered responses, provide product recommendations, and maintain conversation context across sessions.

4.2 Service Improvement & Quality Assurance

We use aggregated data to improve our AI models and enhance service performance. Through Nova Sentinel, we audit conversation logs to detect hallucinations and ensure response accuracy.

5. HOW WE SHARE INFORMATION

5.1 No Sale of Data

Galaxa Nova does not sell Personal Data to third parties. We do not monetize user data through advertising.

5.2 Sharing with Customers

End-User conversation data is shared with the Customer (e.g., Croma) who operates the website where the conversation took place. This is necessary to provide the Service.

5.3 Service Providers

We share information with trusted third-party providers who assist in operating the Service (e.g., cloud hosting, AI model providers). These providers are contractually obligated to protect data and comply with applicable laws.

6. DATA RETENTION

Conversation Logs: Retained for 90 days for quality assurance purposes, then archived.

Customer Data: Upon termination, we retain Customer Data for 30 days to allow retrieval, after which it is permanently deleted.

7. DATA SECURITY

We implement industry-standard security measures, including:

• Encryption: TLS 1.3 for data in transit and AES-256 for data at rest.
• Access Controls: Role-based access control (RBAC) and multi-factor authentication (MFA).
• Monitoring: 24/7 security monitoring and regular vulnerability assessments.

While we implement robust security, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

8. YOUR RIGHTS

8.1 Rights Under Indian Law (DPDP Act 2023)

Data principals have the right to access, correct, erase, and withdraw consent for their Personal Data. To exercise these rights, please contact our Data Protection Officer at [email protected].

9. CONTACT INFORMATION

For questions about this Privacy Policy or our data practices:

Email: [email protected]

---