Last updated May 5, 2026 · Nova Companion LLC · 17 vendors
What this page is
Every vendor that touches your Nova data is named here. Who they are, what they see, where they’re hosted, what they’re attested against, and a link to their DPA.
We split the list by exposure. Core infrastructure is what every Nova user touches by virtue of using the app. AI providers see chat content and attached photos. Research vendors see search queries when Nova switches into Boosters research mode. Opt-in vendors only see data when you explicitly turn the corresponding feature on.
We notify you of additions, removals, and swaps before they go live, where reasonable. To receive notifications, email privacy@novasystems.app with the word “subprocessors” in the subject line.
This page is the canonical list for GDPR Article 28(2) authorisation purposes. If you’re a data controller relying on Nova as a processor, this is the list you’ve authorised.
Core infrastructure
Touched by every Nova user. Application hosting, database, cache, error monitoring, transactional email, billing.
Before any new vendor sees a single byte of Nova user data in production:
The vendor is logged in our internal vendor inventory.
A SOC 2 / ISO 27001 / equivalent attestation is captured, or a documented risk-acceptance memo is filed by the owner.
A DPA is executed with the vendor, or vendor terms-of-service are accepted as DPA where the vendor offers them in that form.
This public list is updated, and notification subscribers are emailed.
The data-flow diagram and risk register are updated.
How to opt out
For opt-in vendors, simply don’t enable the corresponding feature. You can disconnect any connected Google service, Spotify, or Plaid account from your Profilepage. Image generation only fires when you explicitly request a generated image. Incubator’s Apollo enrichment runs only on projects you create.
For core infrastructure and AI providers, the only way to fully opt out is to delete your Nova account, which you can do from Profile → Delete account. Account deletion removes your data from Nova’s databases and memory store within 30 days.
Questions or objections
Reach privacy@novasystems.app for any subprocessor question, including objection to a specific vendor. Under GDPR Article 28(2) you may object to a planned change of subprocessors; if Nova cannot accommodate the objection, you have the right to terminate the contract.