Privacy

Privacy Policy

For Novana Outreach at outreach.novana-digital.com. Last updated 22 September 2026.

Who is responsible

Novana Digital, Casablanca, Morocco, is responsible for account, support, security, and product-operation data. For prospect and campaign data uploaded by a customer, that customer is the controller and Novana acts as its service provider. Contact hello@novana-digital.com.

Data we process

We process account identity, organization and role; prospects and custom fields; campaigns, templates, message content, approvals, send outcomes, and opt-outs; organization branding and preferences; security and diagnostic records; and connected-mailbox details described below. Prospect data can come from the customer, the prospect's direct interaction, or business sources selected by the customer.

Why and on what basis

We use data to provide the contracted service, respond before entering a contract, protect the service under our legitimate security interests, comply with law, and honour opt-outs. Connecting a mailbox is voluntary and based on the user's provider authorization, which can be withdrawn at any time.

Google and Microsoft mailboxes

Outreach requests only the identity and send permissions needed to display the authorized address and send user-approved campaign messages. We do not receive the mailbox password and do not request inbox-reading access. OAuth access and refresh tokens are encrypted at rest; disconnecting a mailbox immediately stops Outreach from sending through it and removes the stored tokens. For Google accounts we also ask Google to revoke the underlying authorization at the same time. Regardless of provider, you can independently review and remove Outreach's access at any time from your Google or Microsoft account's connected-apps settings.

Google Limited Use disclosure

Novana Outreach's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, used for advertising, or used to train a generalized AI model. Human access is limited to explicit user-authorized support, security, or legal obligations.

Open and click measurement

Engagement tracking is off by default and is enabled per campaign by the sending customer. When it is on, messages include a 1×1 image and links routed through Novana so we can record whether and when a recipient opened the message or clicked a link, together with the requesting browser or mail client. This is used only to show the sender their campaign results; it is not used for advertising or to profile people across customers. Opens are approximate because some mail clients load images automatically. The sending customer is responsible for having a lawful basis, including consent where required, for this measurement. Recipients can prevent it by blocking remote images.

Service providers and transfers

We use the following sub-processors: Supabase (database and authentication), Vercel (application hosting), Upstash (distributed abuse and rate-limit controls), and, only for a mailbox you choose to connect, Google or Microsoft (to send and display campaign messages through your own mailbox). If you invoke an AI writing feature, template text — not prospect data — may be sent to OpenAI for placeholder extraction. Resend is retained solely to preserve historical delivery records from before this mailbox-based model and is not used to send new campaign messages. It does deliver the internal notification email when you submit the “Request access” form on our homepage. International transfers must use the safeguards offered in the applicable provider agreements.

Retention

Service data is kept for the duration of the customer relationship. On a verified account-closure or deletion request, we delete or anonymize service data within a commercially reasonable time, except for legal records, security evidence, rotating backups, and suppression data needed to honour opt-outs. Mailbox tokens are retained only while the connection is active and are removed when the user disconnects it. Customer organizations control the retention of prospect and campaign records within their workspace.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent without affecting earlier processing. Contact us at the address above. In Morocco, Law No. 09-08 may apply and you may contact the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). EEA users may also complain to the data-protection authority where they live or work. A recipient can opt out through the link in each outreach message. Outreach does not make decisions producing legal or similarly significant effects solely by automated means.

Customer list responsibility

Customers must document the source and lawful basis of their lists, give recipients required notices, and use connected Google or Microsoft mailboxes only for permission-based or relationship communications allowed by the provider and applicable law. Scraped, purchased, or unsolicited bulk lists are not permitted. An unsubscribe mechanism does not cure an unlawfully obtained list.