Privacy Policy
How NuvoMail processes account, email, customer, sales, file, and billing information, and how to make a privacy request.
1. Scope and Our Role
Who Operates NuvoMail
Nuvo Innovations operates NuvoMail. This policy explains what personal information we process, why we use it, who may receive it, how it is retained, and how to contact us about your privacy.
Organization and Service-Provider Roles
Your organization decides how to use workspace information, including email, contacts, employee details, and sales records. Nuvo Innovations processes that information to provide the service. We separately use account, billing, security, and support information to operate our business and meet legal obligations.
Organization Responsibilities
Organizations using NuvoMail are responsible for providing any notices, obtaining any consents, responding to recipient or employee requests, and establishing a lawful basis for the personal information they upload or transmit through the Service.
2. Information We Collect
Account Data
We process your name, email address, authentication information, membership, roles, preferences, and account activity. Supabase handles authentication, including password processing, confirmation emails, and password recovery.
Organization, Domain, and Integration Data
We collect organization and group information, group timezones, connected domains, approved sender identities, mailbox assignments, provider connection details, API credentials, webhook configuration, DNS or domain-readiness information, and related administrative and audit records.
Email Content and Metadata
When email is composed, sent, received, synchronized, or managed through NuvoMail, we may process subjects, bodies, sender and recipient addresses, Reply-To information, headers, attachments, delivery events, timestamps, thread relationships, read or workflow state, and provider identifiers.
Contacts and Business Context
We process the contact and customer details your team adds, including names, organizations, email addresses, phone numbers, notes, tags, and related products, services, or projects.
Sales Pipeline and Materials
Pipeline records can include customer and contact links, owners, delivery or service handlers, stages, estimated values, follow-up dates, notes, linked conversations, and related products or services. Sales materials include uploaded files, filenames, file types, sizes, and validation or archive status.
Automatic Replies and Retired Addresses
We process automatic-reply text, applicable addresses, dates, office hours, timezones, and enabled status. We also process retired-address routing and reply history used to select a notice and prevent repeated notices. These rules may send message content through the organization’s Resend account.
Usage, Device, and Support Data
We may collect IP address, browser and device information, timestamps, diagnostic logs, feature usage, security events, support communications, and information submitted through feedback, abuse, or help requests.
Billing Data
We process subscription identifiers, plan details, billing contacts, invoices or transaction references, payment status, and billing events. Stripe collects payment information and processes charges. NuvoMail does not store complete payment-card numbers.
3. How We Use Information
Providing the Service
We use information to sign users in, manage workspaces and permissions, send and receive email, store attachments, display customer details, operate ticketing and the sales pipeline, apply automatic-reply rules, route retired addresses, process billing, and provide support.
Security and Reliability
We use account, provider, usage, and diagnostic information to prevent fraud and abuse, authenticate webhooks, investigate complaints, enforce rate and storage limits, protect accounts and infrastructure, troubleshoot failures, maintain backups, and improve availability.
Communication and Administration
We use contact information to send account, security, billing, service, support, and legal notices. Where required, we obtain consent before sending optional marketing communications, and you may opt out of those communications.
Service Improvement and Analytics
Google Analytics runs on the public website only with your permission in Cookie settings; it excludes signed-in workspace routes. It may process browser, device, interaction, identifier, and approximate-location information. The separate Article usage preference does not currently record views on the source-managed Blog and Help guides. Necessary security and diagnostic logs are separate from optional analytics. We do not use customer email content to build advertising profiles or sell it to data brokers. See /legal/cookies for storage and consent details.
Optional Advertising Measurement
With separate permission in Cookie settings, NuvoMail can remember a ChatGPT ad-click reference for up to 30 days and share that reference, a unique conversion identifier, the workspace-creation time, and a fixed public registration URL with OpenAI to measure advertising results. We do not include names, email addresses, workspace names, email content, files, or customer records. The integration uses a server API and does not load a browser pixel that scans account forms. Staging and local development do not send these events. Withdrawing permission stops future events and removes the browser reference; information already sent is subject to OpenAI’s processing and retention practices. See /legal/cookies for the controls and storage details.
Legal and Business Purposes
We may use information to comply with law, respond to valid legal process, protect rights and safety, establish or defend legal claims, enforce agreements, and evaluate or complete a financing, reorganization, merger, acquisition, or sale of assets subject to appropriate confidentiality protections.
4. Workspace Access and Customer Instructions
Team Visibility
Workspace owners and administrators determine who may join an organization and configure access to addresses and communications. Information may be visible to authorized coworkers, administrators, mailbox members, assignees, or group members according to the organization's configuration and the Service's permission model.
Customer Instructions
We process workspace data according to the organization's instructions, these Terms, and applicable law. If you are an employee, contact, customer, or recipient seeking access, correction, or deletion of information held by an organization, you should normally contact that organization first.
Administrative Oversight
Owners and administrators can manage members, domains, provider connections, sender identities, shared addresses, and workspace permissions. They must use that access lawfully and for legitimate organizational purposes. Not every role can view every conversation, opportunity, note, or material.
6. Retention and Deletion
Retention Periods
We retain information as reasonably needed to provide the service, maintain security and continuity, follow lawful customer instructions, resolve disputes, and meet legal, accounting, or reporting obligations. A downgrade or loss of paid access does not itself delete existing opportunities, materials, attachments, or drafts. Archiving a sales material keeps its file stored and using storage. These features are not a promise of indefinite retention.
Original Files
New outgoing attachments and Pipeline sales materials preserve the submitted file format. Logos and decorative images may be optimized. Previously converted files stay in their existing format. Files already delivered to recipients or providers are also subject to those parties’ retention practices.
Deletion Requests and Account Closure
Authorized users may delete certain information through the Service or request account or workspace deletion. Deletion may be delayed where needed for backup rotation, security investigations, legal holds, fraud prevention, billing records, or other lawful obligations. We may retain de-identified information that can no longer reasonably identify an individual.
Provider Copies
Deleting information from NuvoMail does not necessarily delete copies already transmitted to recipients, email providers, recipient servers, customer-controlled systems, or other independent third parties. Their retention is governed by their own systems and policies.
7. Security
Safeguards
We use authentication, organization and mailbox access checks, private file storage, restricted provider-credential access, security logs, and secure transport where supported. Provider credentials are processed on the server and are not intended to be shown back to ordinary users after configuration.
No Absolute Security
No internet service, transmission, or storage system is completely secure. You are responsible for account security, appropriate permissions, endpoint security, credential rotation, domain configuration, and promptly reporting suspected compromise.
Security Incidents
If we become aware of a security incident affecting personal information, we will investigate and provide notices to affected organizations, individuals, regulators, or others when required by applicable law.
8. Privacy Choices and Rights
Access, Correction, Export, and Deletion
Depending on your location and relationship with NuvoMail, you may have rights to request access, correction, export, deletion, restriction, objection, or withdrawal of consent. These rights may be subject to identity verification, organizational authority, legal exceptions, and the rights of others.
How to Make a Request
Account holders may use available product controls or contact support@nuvomail.app. For workspace data controlled by an organization, we may direct your request to that organization or assist it in responding. You may also have the right to complain to an applicable privacy regulator.
Marketing Choices
You may opt out of optional NuvoMail marketing messages using the unsubscribe method provided. You may still receive transactional, security, billing, support, and legal communications necessary for the Service.
9. Policy Changes and Contact
Updates
We may update this Policy to reflect changes to NuvoMail, providers, law, or our practices. We will post the updated version with a new effective date and provide additional notice of material changes when required by law.
Contact
Questions, privacy requests, and complaints may be sent to support@nuvomail.app. Please do not include passwords, provider API keys, or unnecessary sensitive message content in your request.
This document was last updated on October 14, 2026. Questions? Contact us at support@nuvomail.app