This Privacy Policy explains how ValueNova Limited collects, uses, and protects personal information about visitors to our website at valuenova.ai and people who interact with us in connection with our products and services. We are committed to protecting your privacy and being transparent about how we handle your personal data.

1. Who we are

ValueNova Limited ("ValueNova", "we", "us", "our") is the data controller of personal information collected through this website.

Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
Company number: 16936135
Contact for privacy enquiries:

We have not appointed a Data Protection Officer because we are not legally required to. If you have any privacy questions, please write to.

Registered with the UK Information Commissioner's Office under registration number ZC141348.

2. What this policy covers

This policy covers personal information we collect when you:

visit valuenova.ai (our marketing website)
contact us via our contact form, email, or other channels
subscribe to our newsletter or other marketing communications
register your interest in the ValueNova platform
engage with us about a potential future business relationship

Where ValueNova supplies the platform to your organisation, that use is also governed by the written agreement between us and our Data Processing Agreement (published at valuenova.ai/dpa), under which your organisation is the data controller and ValueNova the data processor.

3. Personal information we collect

We collect personal information in three ways:

Information you give us directly — when you fill in our interest-registration form, subscribe to communications, or correspond with us. This may include your name, work email, job title, company name, and any information you choose to share in your message.

Information collected automatically — when you visit our website, we and our third-party providers collect technical information such as your IP address, browser type, device information, the pages you visit, and how you interact with the site. We use cookies and similar technologies to do this — see our Cookies Policy for details.

Information from third parties — we may receive limited information from analytics providers, marketing tools, and lawful business sources (for example, professional networking platforms where you have made information public).

Voice input. Where you use the voice capture feature, the platform records audio for the sole purpose of producing a written transcription. That audio is passed to our transcription sub-processor — listed at valuenova.ai/subprocessors — and is not stored by ValueNova. We retain only the resulting text. Audio is not available for playback, and we do not create voiceprints, voice templates or any other biometric identifier from your voice. If you record a conversation involving other people, you are responsible for obtaining their consent where the law requires it.

4. Why we use your personal information (lawful bases)

We process personal information for the following purposes, on the following lawful bases under UK GDPR:

To respond to your enquiries and provide information you request — lawful basis: performance of a contract or steps taken at your request before entering into a contract.
To operate, secure, and improve our website — lawful basis: legitimate interests (running and improving our business and protecting our website from misuse). We have considered whether this overrides your rights and freedoms, and we believe it does not, because the data is limited and used only for these purposes.
To send you marketing communications about ValueNova's products and services — lawful basis: consent (where you have opted in) or legitimate interests (where you are an existing business contact and we are sending you communications relevant to your role, in line with the soft opt-in under PECR). You can opt out at any time using the unsubscribe link in any marketing email or by writing to.
To comply with our legal and regulatory obligations — lawful basis: legal obligation.
To give named individuals access to our Trust Centre, and to record who was shown which security evidence — lawful basis: legitimate interests (controlling access to confidential security information, and being able to evidence who saw what). See section 4a below.

4a. The ValueNova Trust Centre

Our Trust Centre holds detailed security, data protection and assurance information. It is available only to named individuals at organisations we have approved, normally under a non-disclosure agreement. If you have been invited to it, this section explains what we hold about you and why.

What we hold. Your name, work email address, job title, the organisation you belong to, the period your access runs for, when you last opened the Trust Centre, and a record of which documents and statements you viewed or downloaded, together with the network address and browser you used.

Why we hold it. To control access to confidential material about how we protect customer data, and to be able to evidence who was shown what. Our lawful basis is legitimate interests. We have assessed whether those interests override your rights and freedoms and concluded they do not: the data is limited, it relates to you in a professional capacity, it is used only to administer and evidence your access, and you would reasonably expect a company to keep a record of who it showed confidential security material to.

How long we keep it. Records of successful sign-ins are kept for 12 months, and records of refused access attempts for 24 months. Records of what was viewed or downloaded are kept for 6 years, because they evidence that confidential material was disclosed under a valid agreement, and those agreements commonly run for three to five years.

Who sees it. Only ValueNova staff administering Trust Centre access. We do not share it with other customers, and we do not use it for marketing. Trust Centre access records are not disclosed to your employer as a matter of routine, though the fact that access was granted to your organisation is known to whoever requested it.

Your rights. The rights set out in section 8 apply to this information. You can ask us for a copy of everything the Trust Centre holds about you, or ask us to remove your access, at any time — including if your employer arranged the access rather than you.

5. Who we share your personal information with

We share personal information only where necessary, with the following categories of recipients:

Service providers and sub-processors — we use third-party service providers to support our business, including hosting, analytics, email delivery, and support. The list of sub-processors we engage in delivering the platform is published at valuenova.ai/subprocessors.
Professional advisors — including legal, accounting, and insurance advisors, who are bound by confidentiality obligations.
Authorities — where required by law, regulation, court order, or to protect our or others' rights.
Acquirers — in connection with a sale, merger, or other corporate transaction, in which case the recipient will be required to honour this Privacy Policy.

We do not sell your personal information.

6. International transfers

Where personal information is transferred outside the United Kingdom or the European Economic Area to a country not deemed adequate under UK GDPR or EU GDPR, we rely on appropriate safeguards, including:

the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in each case as issued by the Information Commissioner's Office;
the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) Module 2 (controller-to-processor); or
other lawful transfer mechanisms.

Where your data is held. All customer data is hosted in the European Union: application hosting and file storage on Google Cloud Platform in the europe-west1 region (Belgium), and the primary database with Supabase in Stockholm, Sweden. This applies to all customers regardless of location — we do not operate per-country or United States hosting. Processing outside the European Union is limited to AI inference, transcription and transactional email performed by the sub-processors listed at valuenova.ai/subprocessors, and support access by ValueNova personnel, in each case under appropriate transfer safeguards.

We will provide further information on our transfer mechanisms on request to.

7. How long we keep your information

We keep personal information only as long as we need it for the purposes for which we collected it. Specifically:

Marketing leads and prospects — we retain your information until you withdraw your consent or 24 months from the date of your last interaction with us, whichever is sooner.
Contact form submissions and email correspondence — we retain these for up to 24 months after the matter is concluded.
Platform account data — after termination you have 30 days to ask us for a copy of your data. From the end of that window we have 60 days to delete everything that remains, including copies held in backups — so all of your data is irrecoverable within 90 days of termination at the outside. We delete from live systems first, and backup copies may persist for a limited period inside that window before they expire. We keep account data for longer only where the law requires it. The written agreement and the Data Processing Agreement set out these obligations in full.
Analytics data — retained per our Cookies Policy and the relevant analytics provider's retention settings.
Trust Centre access records — sign-ins, refused attempts, and records of what was viewed or downloaded are kept for the periods set out in section 4a above.

After these periods, personal information is deleted or anonymised.

8. Your rights under UK GDPR and EU GDPR

You have the following rights in respect of personal information we hold about you:

Right of access — to ask for a copy of your personal information.
Right to rectification — to ask us to correct inaccurate or incomplete information.
Right to erasure — to ask us to delete your information in certain circumstances.
Right to restrict processing — to ask us to limit how we use your information in certain circumstances.
Right to data portability — to ask for a copy of your information in a structured, commonly used, machine-readable format and to ask us to transmit it to another controller.
Right to object — to processing carried out on the basis of legitimate interests or for direct marketing.
Right to withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, please write to. We will respond within one calendar month, in line with UK GDPR.

You also have the right to complain to the Information Commissioner's Office (the UK supervisory authority for data protection) at ico.org.uk or, if you are in the EU, to your local supervisory authority. We would, however, appreciate the chance to address your concerns directly first.

9. Cookies

We use cookies and similar technologies to operate, secure, and analyse use of our website. Full details are in our Cookies Policy, including how to control cookies.

10. Children

Our website and services are aimed at business users and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have, please contactand we will delete it.

11. Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. Information about our security practices is available on request. For customers, the security measures that apply to platform data processing are set out in Exhibit C of the Master Services Agreement.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be notified via the website. We recommend reviewing this page periodically.

13. Contact

If you have any questions about this Privacy Policy or our handling of your personal information, please write to:

ValueNova Limited

71-75 Shelton Street

Covent Garden, London WC2H 9JQ