Privacy Policy
Last updated: 4 November 2026
Who we are
This website is run by NOVATECH AI Limited Liability Company ("Novatech AI"), a limited liability company organized in New Mexico, USA. In this policy, "we" and "us" mean Novatech AI.
We are responsible (the data controller) for the personal data described in this policy. You can reach us at [email protected] or (505) 544-4385.
We process personal data in line with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. Where the EU General Data Protection Regulation (GDPR) applies to you, we also follow it.
What this policy covers
This policy covers people who visit this website, book a free systems audit, or exchange emails with us about our services.
When we build and run AI systems for a client, we process the personal data of that client's own customers on the client's behalf. In that work the client decides how the data is used, and a separate Data Processing Agreement governs it. This policy does not cover that processing.
The data we collect
When you book an audit
The time you choose, your answers to the booking questions (type of business, team size, what’s costing you, the systems you want to start with, monthly enquiries and timing), your name, business name, email address, phone or WhatsApp number, website (optional) and the language of the page, plus a record that you accepted this policy and our Terms, with the date and time. Your booking is scheduled through Cal.com, which sends your confirmation, adds the call to our Google Calendar with a Google Meet link and saves your details in our CRM (HubSpot), so we can prepare for the call and follow up.
While you fill in the booking form, your answers are kept only in your own browser (session storage), so you can go back and change them. They are deleted when you confirm the booking or close the tab.
When you email or call us
Your contact details and what you tell us.
When you browse the site
Like every website, our host receives technical data such as your IP address, browser type and the pages requested, in server logs used for security and reliability. We do not use analytics, advertising or tracking tools. The only cookie this site sets is nt_lang, and only when you pick a language, to remember your choice for a year.
To show this site in your language, we use your browser’s language setting and, where our host provides it, the country of your IP address. This happens as the page loads, and we do not store your location.
How and why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Reviewing your audit request and replying | Audit request data | Your consent, given with the checkbox (Law 09-08, Art. 4; GDPR Art. 6(1)(a)) |
| Preparing your audit and any proposal | Audit request data, notes from our conversations | Steps you ask for before a contract (GDPR Art. 6(1)(b)), and your consent |
| Keeping the site secure and working | Server logs | Our legitimate interest in security (GDPR Art. 6(1)(f)) |
| Keeping records the law requires | Contracts, invoices | Legal obligation |
We do not sell personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
AI and your data
We do not use your personal data to train, fine-tune or improve AI models, ours or anyone else's. When an AI service helps us handle your enquiry (for example, to draft a reply that a person then reviews), we use providers whose business terms state they do not train on the data we send.
Our clients' data is never used to train AI models without that client's explicit written consent. This commitment is part of every client agreement.
Who receives your data (sub-processors)
We use a small number of service providers to run this website. They process data only on our instructions and only for the purpose listed.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare (Cloudflare, Inc.) | Website hosting and server logs | IP address, browser data | United States |
| Cal.com (Cal.com, Inc.) | Scheduling audit bookings and sending confirmations | Audit request data | United States |
| HubSpot (HubSpot, Inc.) | Storing audit requests and client records | Audit request data, client records | United States |
| Google (Google LLC) | Calendar and video calls | Name, email address, meeting time | United States |
| Northwest Registered Agent | Email correspondence | Emails and contact details | United States |
The site’s fonts and scripts are served from our own website, so no font or script provider receives your data. We will update this list before adding a new provider. We may also disclose data if the law requires it.
International transfers
Some providers above store data outside Morocco. Where Law 09-08 requires it, we obtain the CNDP's authorisation before transferring data abroad, and we rely on contractual safeguards such as standard contractual clauses.
How long we keep it
- Audit requests and notes from people who do not become clients: up to 12 months, then deleted.
- Client contact and contract records: for the length of the relationship, then as long as Moroccan law requires (for example, accounting records).
- Server logs: we keep none of our own. Our host, Cloudflare, processes this data to deliver and protect the site and keeps it only as long as its own policy allows.
Your rights
Under Law 09-08 you have the right to be informed, to access your data, to have it corrected or deleted, and to object to its processing for legitimate reasons. If you are in the European Union or the United Kingdom, the GDPR also gives you the rights to restrict processing, to data portability, and to withdraw consent at any time.
To use any of these rights, email [email protected]. We reply within 30 days. You can also complain to the CNDP (www.cndp.ma) or, in the EU, to your local data protection authority.
You can also unsubscribe from our emails or ask us to delete your data by emailing [email protected].
Security
We use encrypted connections (HTTPS), give each person and system only the access it needs, and use providers with recognised security practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Children
This site and our services are meant for businesses. They are not directed at anyone under 18, and we do not knowingly collect their data.
Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change is significant, we will tell the people it affects.