Effective date: 6 November 2026
Service provider: ניסן רועי משה (trading as NOVETIS; an Israeli VAT-exempt sole proprietor)
Address: אנפה 210, מודיעין-מכבים-רעות 7179901, ישראל
Privacy contact: support@novetis.co
This Privacy Policy describes how Novetis ("Novetis," "we," "us") collects and handles personal information in connection with its website, accounts, subscription administration, AI agent dashboard, embedded widgets, and related services (the "Service"). This Policy applies to visitors to our own website, business customers, authorized account users, and, as relevant, End Users who interact with a Novetis-powered agent on a customer's website or supported channel.
This Policy is a notice about data practices, not a substitute for a Data Processing Agreement ("DPA") with a business customer. It does not independently create consent to processing where consent is required by law.
1. Who is responsible for which data?
Novetis generally determines the purposes and means of processing personal information used for its own website, account administration, authentication, billing administration, sales and support, platform security, and business operations. For such processing, Novetis acts as the controller or comparable responsible party under applicable law.
When a business customer configures an agent, uploads sources, collects leads, or enables conversations on its own website, that customer generally determines why and how End User information is collected. Novetis generally processes this Customer-controlled information to provide the Service on the customer's behalf, acting as a processor, holder, service provider, or analogous role under the law that applies. Actual legal roles depend on the circumstances. Customers remain responsible for their lawful purposes, privacy notices, consent where required, and instructions. Novetis retains its own statutory obligations as applicable.
Where an End User wishes to access, correct, or delete information collected by a particular business through its agent, that End User should ordinarily contact the business operating the agent. Novetis will assist as required under law and any applicable DPA. Questions about information processed directly by Novetis can be sent to support@novetis.co.
2. Information we collect and sources
Business account and identity data: names, email addresses, business names, user and account identifiers, authentication and login-event data, authorized administrators and team members, account settings, subscription information, and support communications.
Billing and transaction data: purchased plans and add-ons, billing email, merchant or payment-provider transaction identifiers, transaction and subscription status, billing notices, invoice or tax metadata, and cancellation or refund details. For subscriptions purchased through Shopify App Pricing, this may also include relevant Shopify shop identifiers, subscription identifiers, plan status, and purchase-channel information used to administer and reconcile the subscription. Payment-card data is ordinarily handled by the relevant billing or payment platform, not collected or stored as full card numbers by the Novetis application.
Agent instructions, source content, and connected systems: agent prompts, settings, uploaded documents, website URLs, crawled pages, business descriptions, product catalog data, source metadata, integration settings, and data retrieved from Customer-authorized external systems. This information may incidentally contain personal information supplied by or for the Customer.
End User conversations and leads: chat messages, AI responses, conversation or session identifiers, timestamps, user-supplied contact details (such as names, email addresses or phone numbers), support inquiries, lead status, and conversation context when enabled by the Customer.
Technical, security, and analytics information: usage and credit counts, agent activity, browser and device data, network identifiers such as IP addresses, access and error logs, security diagnostics, and approximate location inferred from technical information where relevant. On Novetis-operated websites, visit analytics may also include the page visited, referrer, and a browser identifier stored in a cookie.
Cookies and local storage: authentication and security cookies; a consent-preference cookie on Novetis-operated websites; optional preference and performance technologies; and browser storage used to preserve interface or chat-session functionality. Details and controls are explained in Section 6.
Support, sales, and other communications: requests for demos, product inquiries, feedback and communications voluntarily submitted to us. We may receive information directly, automatically through use of the Service, from a Customer, or from a Customer-enabled integration.
The Service is not intended to solicit payment-card numbers, passwords, government identifiers, medical records, children's personal information, or other particularly sensitive personal data in general-purpose agent conversations unless a specific lawful use and suitable safeguards have been separately arranged. Unexpected receipt of such information does not relieve Novetis of applicable legal duties.
Providing information to Novetis is generally voluntary unless a legal requirement applies. However, certain details, such as an email address for account authentication and billing information for paid subscriptions, are necessary to provide the requested Service or complete a purchase. If those details are not provided, the relevant account or feature may be unavailable. The purposes of collection, principal recipient categories, and relevant privacy rights are further described in Sections 3, 7, and 11. You can request access to information about you or seek correction of inaccurate information, where applicable, using the contact details in Section 16.
3. Purposes of processing
We process information, as relevant, to (a) provide user accounts, authentication, agent creation, AI responses, retrieval, customer-selected integrations, chat histories, and lead functions; (b) provide subscriptions, measure usage and credits, administer payments, and address account inquiries; (c) operate, secure, debug, and maintain the Service, prevent misuse, and investigate incidents; (d) respond to Customer and End User requests in accordance with our role; (e) send operational and legally required notices and, where permitted, marketing communications; and (f) comply with applicable law, maintain necessary records, and protect legal rights.
Customer-controlled conversation, lead, source, and integration information is processed principally to perform the Customer's instructions and operate the subscribed features, not for unrelated independent marketing. Novetis may use appropriately aggregated or effectively de-identified service metrics to evaluate product reliability and improve the Service, provided the information is not reasonably linkable to an individual or identifiable Customer and applicable contractual restrictions are respected.
We do not treat a visitor's mere use of a Customer's website as consent to all processing by that Customer or by Novetis.
4. AI processing and model training
To provide AI-powered functions, Novetis sends relevant End User messages, limited conversation context, Customer instructions, retrieved source excerpts, and other necessary information to AI model or infrastructure providers selected by Novetis for the relevant feature. Depending on enabled features, the Service may also retrieve or exchange information with Customer-authorized external services. AI models or providers may change over time as described in the Terms of Service, subject to privacy and data-processing requirements.
Novetis does not use identifiable Customer-controlled messages, leads, knowledge files, or other Customer Content to train Novetis's own general-purpose AI models without the Customer's separate affirmative authorization. AI providers have their own processing, retention, and contractual arrangements; Novetis will disclose the applicable providers and terms as required, and Customer-controlled data will be handled under the relevant DPA where applicable. This Policy does not represent that every third-party provider has identical storage, deletion, or model-training practices.
For clarity, providing an AI answer by processing a prompt or retrieving Customer-provided source content is distinct from training a general-purpose model using that data. AI responses can be incomplete or inaccurate; important decisions should include appropriate human review.
5. Legal grounds for processing
Where applicable law requires a legal basis, processing may rely on performance of a contract or steps requested before one; compliance with legal obligations; legitimate interests such as securing and administering the Service where not overridden by individual rights; and consent where necessary, such as for certain marketing or optional cookies. For information processed on behalf of Customers, the Customer determines the applicable lawful basis for its collection and instructions, while Novetis must fulfill the duties that apply to its own role. A legal ground may vary by data category and jurisdiction.
6. Cookies, analytics, and similar technologies
On Novetis-operated websites, the Service may use the following technologies:
Strictly necessary: authentication and security technologies, session state, and the cookie recording visitors' cookie choices (currently named `novetis_consent`, configured with a maximum lifetime of 365 days). These support essential functionality and the recording of privacy preferences.
Preferences and performance: Optional technologies may remember interface choices or support non-essential performance features. These categories are controlled through the cookie preferences interface where applicable.
Analytics (optional, separate consent): First-party site-visit statistics and Vercel Web Analytics are enabled only after an affirmative `analytics` choice in the current cookie interface. Where first-party visit statistics are enabled, they may record visited page paths and referrers and use the pseudonymous `pa_v` visitor cookie, configured for up to 365 days. The server-side tracking endpoint checks the current analytics consent before creating a visit record or issuing this identifier. Withdrawing consent stops subsequent first-party collection; the website also requests removal of the browser's prior visit identifier and corresponding first-party visit records. The preference is recorded in `novetis_consent`, configured for up to 365 days. Legacy cookie choices do not count as analytics opt-in.
You may accept, reject, or customize optional categories, and reopen Cookie settings to change your choice. Novetis-owned website analytics are separate from analytics, cookies or browser storage implemented by a Customer on its own website. Customer-deployed agents may use browser storage to maintain conversation continuity and functionality; Customers remain responsible for applicable notices and choices on their websites.
You can also manage cookies through your browser, although blocking necessary storage may interfere with account or widget functionality.
7. Sharing and service providers
We share information only as appropriate for the stated purposes, including with: hosting and application-delivery vendors; database and backup providers; contracted AI model or inference providers; authentication and email services; merchant-of-record or payment-processing services; security and monitoring services; customer-support infrastructure; and external systems, APIs, storefronts, and channels activated by a Customer. A Customer can access conversation and lead information relating to its own agents according to the Service's access controls.
We may disclose information where required by valid legal process or applicable law; to investigate security incidents, fraud, misuse or threats; or in a sale, financing, merger, or restructuring, with appropriate protections. Novetis does not sell personal information for monetary consideration as part of its normal Service operations. Any use of advertising or cross-context behavioral-sharing technologies must be separately disclosed where applicable.
Key service providers and integrations. Depending on the Service function used, providers involved may include Vercel (application hosting, infrastructure and optional web analytics), Neon (managed database infrastructure), OpenAI (AI inference), Resend (service email), Lemon Squeezy (billing and payment administration for direct purchases), and Shopify (customer-authorized storefront integration and, for Shopify App Pricing purchases, subscription billing and reconciliation). This list describes the main service categories and does not mean every provider receives every category of personal information. For example, AI inference may receive relevant messages and context, whereas the relevant billing platform processes subscription and purchase details. Customer-enabled integrations, such as storefront, scheduling, or business-platform connections, involve additional recipients chosen or authorized by the Customer. Provider arrangements and locations may change, subject to applicable contractual and legal requirements. For questions about the service providers relevant to your account or personal information, contact support@novetis.co.
8. International data transfers
Because infrastructure providers, AI services and Customer-enabled integrations may operate in different countries, personal data may be accessed, processed or stored outside Israel or the country where an End User is located, including in the United States, the United Kingdom, and other locations depending on the relevant provider and configuration. A Customer or End User should not assume that data is processed exclusively in Israel.
Where international transfers are subject to specific legal restrictions, Novetis will take measures required by the applicable law and relevant contractual arrangements. These may vary by the roles of the parties, the country and provider involved, and the information being processed. For more information about relevant processing locations and arrangements, contact support@novetis.co.
9. Retention, export, and deletion
We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to applicable law, the Customer's lawful instructions, and any Data Processing Agreement. Different categories of records may have different retention periods. Retaining a business account does not override an individual's applicable privacy rights or a Customer's obligations to use appropriate and proportionate retention periods.
Conversations and leads while an account is active. As a general service policy, Novetis retains Customer-controlled conversation histories, messages, lead records, and associated visitor-identification information while the Customer's Novetis account remains open and active, so the Customer can continue accessing and managing them. We do not impose a fixed age-based deletion period on these records solely because time has passed. The Customer may request earlier deletion where available or required by law or an applicable DPA, and the Customer remains responsible for deciding whether continued retention is appropriate for its End Users.
Cancellation versus account closure. Cancelling automatic renewal, allowing a paid subscription to expire, moving to the Free plan, reducing a plan, disabling an agent, or temporary account suspension does not by itself constitute permanent account closure or automatically trigger deletion of existing conversation or lead records. Access to some records or features may nevertheless change with plan entitlements or lawful security restrictions. Customers should request or complete any available export before permanent closure.
Permanent account closure. When a Customer requests permanent account closure, Novetis may verify the requester's authority, restrict account access and arrange return or export of Customer-controlled information where required by law or an applicable agreement. Deletion or anonymization of Customer-controlled conversations, leads and related records is handled through controlled technical and, where necessary, administrative processes, subject to verification, legitimate retention exceptions, legal holds, and any applicable DPA. Account closure is distinct from cancellation of paid services. Where urgent legal or security grounds require immediate access restrictions, access to an export may be limited in accordance with applicable law.
Deletion timing and backups. Different records and storage locations may have different retention and deletion processes. Account closure does not necessarily remove every record immediately or erase copies held independently by third parties. Deletion from backup or recovery systems may occur on their respective retention and rotation schedules; such copies may also be subject to legal preservation requirements. We do not specify a single fixed deletion period covering every category in this Policy. If a particular period is required by law or has been agreed in a separate, applicable contract, that requirement governs.
Other information. Agent configuration, knowledge files, catalogs and attachments, integration and action-execution logs, visitor analytics, access and security logs, and support records may be retained for different periods according to their purposes, applicable settings, technical dependencies and legal obligations. Account, billing, tax and transaction records may be kept for longer where necessary to meet mandatory accounting, taxation, dispute-resolution or legal obligations. Customer-directed data held by an external integration or a service selected and operated independently by the Customer may require action by that Customer; Novetis will fulfill its own processor and subprocessor obligations where applicable.
For an access, correction, export or deletion request, contact support@novetis.co. We may verify request authority, direct an End User to the relevant Customer when that Customer controls the information, and apply lawful exceptions. Deletion from active systems, backups and independent third-party recipients may take place through different mechanisms and at different times.
10. Information security and incidents
Novetis implements risk-appropriate administrative, technical and organizational measures to protect personal information against unauthorized access, unlawful processing, loss, alteration and disclosure, taking account of the Service, data sensitivity, feasible controls, and applicable legal requirements. Measures and responsibilities applicable to Customer-controlled information will be further described in the DPA or Security Addendum, where relevant.
We assess suspected security incidents and, where required by law or contract, cooperate with Customers and notify the relevant parties or authorities within applicable timeframes. Appropriate incident-handling, escalation, documentation and vendor-management procedures are necessary to support these commitments.
No system is entirely risk-free, and this statement does not waive mandatory statutory security duties.
11. Your privacy rights
Depending on the law applicable to the processing and the person's location, individuals may have rights to receive information, request access to or correction of personal information, seek deletion where applicable, object to or restrict certain processing, withdraw consent for processing based on consent, obtain portability where available, and complain to a competent data-protection authority. Not every right listed is available in the same form in every jurisdiction, and lawful exceptions may apply.
For personal information controlled by Novetis directly, write to support@novetis.co. We may request reasonable verification and will answer within applicable legal time limits. For messages or contact information provided through a Customer's agent, the Customer will generally be the primary contact and decision-maker on requests, while Novetis will provide legally and contractually required assistance. We will not use an End User request to disclose another Customer's confidential information without appropriate authorization.
12. End User responsibilities and transparency
A business deploying a Novetis agent is responsible for providing legally required notices to its visitors, explaining that conversations may be handled by an AI system, identifying the business operating the agent, obtaining required consent or other lawful grounds for collection, and managing marketing or lead-capture choices. Customers must also ensure they have adequate rights to submit or connect knowledge sources and information about third parties.
Messages and contact details submitted through a Customer's agent may be displayed to authorized users of that Customer in its Novetis dashboard, or used in Customer-authorized integrations. The Customer remains responsible for its own handling of that data, while Novetis remains responsible for duties applying to Novetis itself.
Novetis encourages Customers to minimize collection of high-risk personal information, make a suitable human contact route available, and provide visible links to relevant privacy notices where appropriate.
13. Children and sensitive information
The Service is intended principally for business use, not for direct use by children. Customers should not knowingly use it to collect children's personal information without the legally required notices, permissions, and protections. Where personal information of minors or other sensitive categories is involved, additional requirements may apply. Contact support@novetis.co if you believe inappropriate personal information has been submitted.
14. Marketing communications
Novetis may send operational communications such as login codes, billing notices, security alerts, and essential product notices. Commercial marketing messages will be sent only where permitted under applicable law, with an unsubscribe or objection mechanism where required. Unsubscribing from marketing will not necessarily stop essential transactional communications.
15. Changes to this Privacy Policy
We may update this Policy as practices, law, or the Service evolve. For material changes, we will provide appropriate advance notice where reasonably practicable and required, explain the effective date, and seek consent where law requires it. An updated notice does not by itself authorize a new use that requires a separate lawful basis or consent. Past versions should be maintained internally to document the information provided to users.
16. Contact and legal identity
Novetis service provider: ניסן רועי משה (trading as NOVETIS; an Israeli VAT-exempt sole proprietor)
Address: אנפה 210, מודיעין-מכבים-רעות 7179901, ישראל
Privacy contact: support@novetis.co
Policy effective date: 6 November 2026