NovaJenta Limited: Privacy Notice
1. Who we are
NovaJenta Limited ("NovaJenta", "we", "us") is a company registered in Ireland, company number 816158, registered office 8 Castleview, Athlumney, Navan, County Meath, C15 N7F4. We provide accounts payable automation for businesses.
For any privacy question, contact us at [email protected].
2. What this notice covers
This notice explains how we handle personal data:
- when you visit novajenta.com or contact us;
- when you use the NovaJenta platform (our client portal at app.novajenta.com and our API) as a user at one of our client businesses;
- when we process our clients' supplier documents on their behalf.
3. Our two roles
- Controller. For our website visitors, enquiries, and the accounts of people who sign in to our platform, we decide how and why data is used.
- Processor. For the supplier invoices, credit notes and related records our clients send us, and the data in their accounting system, we act only on our client's instructions under a written data processing agreement. The client is the controller. If you are a supplier, or another person named in those documents, please contact the business that sent them to us. We will help them answer you.
4. What we collect and why
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address, browser and device details, pages visited, cookie choices | Running and securing the site; analytics only with your consent | Legitimate interests; consent for analytics |
| People who contact us | Name, email address, your message | Replying to you and, if you ask, arranging a call | Legitimate interests; steps before a contract |
| Platform users at our clients | Name, work email address, role, sign-in and security records (sign-in times, IP addresses, failed attempts), the approvals and other actions you take, which are kept in an audit trail | Providing the service, keeping accounts secure, and keeping the audit trail our clients rely on | Contract with our client; legitimate interests (security and audit) |
| People named in client documents (as processor) | Whatever the documents contain: supplier names, contact details, bank details, VAT numbers, amounts | Reading, coding and checking documents, and posting approved bills to the client's accounting system | Our client's instructions; the client decides the legal basis |
We do not use personal data for marketing to platform users, and we do not sell personal data.
5. Data from QuickBooks and other accounting systems
When a client connects its accounting system (for example QuickBooks Online), we read the data needed to provide the service:
- suppliers and their details;
- the chart of accounts and tax codes;
- with the client's agreement, past bills, to learn how the client codes them.
We post bills to the accounting system only once the client has approved them. We never delete or change a bill already in the client's books. The client can disconnect us at any time in its accounting system (for QuickBooks, from its list of connected apps), or by asking us to. We then stop reading and writing, and handle the data already held as the client's agreement says.
6. AI processing
We use AI models to read documents, suggest how to code them and flag possible fraud. A person at the client business reviews and approves every invoice before it is posted, unless the client chooses automatic approval for invoices that pass every check. The AI makes no decision about any individual that has legal or similarly significant effects.
7. Who we share data with
We use these service providers (sub-processors) under written agreements:
| Provider | What it does | Where |
|---|---|---|
| Microsoft (Azure) | Hosts our servers, database, document storage and email sending | West Europe (Netherlands) |
| Mistral AI | Reads documents (OCR); backup reasoning | European Union (France) |
| Anthropic | Reasons about documents: classification, coding, fraud checks | EU services from Anthropic Ireland Limited; the reasoning step is processed in the United States |
| Cloudflare | Website hosting and domain services; hosts the client portal | Global network |
| Zoho (Zoho Mail) | Our company email, including [email protected], which receives your enquiries and messages | European Union |
| Intuit (QuickBooks) | The client's own accounting system, connected at the client's request | Intuit's terms with the client |
8. Transfers outside the European Economic Area
Anthropic processes data in the United States. That transfer is covered by the European Commission's standard contractual clauses in Anthropic's data processing agreement.
9. How long we keep data
- Website enquiries: up to 24 months from last contact.
- Cookie choices: 12 months.
- Platform user accounts: for as long as the client uses NovaJenta, then as the client's agreement says.
- Security and audit records: for as long as the client uses NovaJenta, then as the client's agreement says.
- Client documents and their data: as the client's agreement says. At the end of an agreement we return or delete them, within 30 days.
Our AI providers keep what we send them only briefly and do not train on it. Anthropic deletes it within 30 days.
10. Your rights
You have the right to:
- access your personal data;
- have it corrected;
- have it erased;
- restrict or object to our use of it;
- have it moved to another provider (portability);
- withdraw consent where we rely on it.
Contact us at [email protected]; we will reply within one month. For data in our clients' documents, we will pass your request to the client and help them answer it.
You can also complain to the Data Protection Commission (www.dataprotection.ie), 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
11. Security
- Data is held on our own servers in Microsoft's West Europe region.
- It is encrypted in transit.
- Access is limited to the two founders.
- The platform requires strong passwords and checks every request against the user's current session.
- Backups are kept in encrypted Microsoft Azure storage in the European Union, which accepts traffic only from our own server, and are deleted after 90 days.
12. Changes
We will update this notice when our practices change and show the date at the top. Where a change matters to our clients, we will tell them directly.