Privacy Policy

For Client user accounts and Portal usage data, Collect Nova is typically the business or controller. For personal information of third parties that appears in a call recording or account record because Collect Nova is performing collections work for a Client, Collect Nova generally acts as a service provider or processor on the Client’s instructions, and the Client is the business or controller—except where law requires Collect Nova to process data for its own legal, security, or compliance purposes.

Account information: name, work email, organization, role (client or super admin), and authentication data.

Consultation inquiries: name, work email, company, service region, approximate account volume, selected plan, optional message, commercial attestation, optional NDA request, and optional marketing consent.

Call and recording information: date and time, direction, duration, status, phone numbers, account reference, customer or business name, assigned representative, visibility flags, and the audio recording itself. Recordings may contain voices and any information spoken on the call, which can include identifiers, account details, location, or other personal information.

Communications: message text, subject, optional account reference, timestamps, and read state. Internal notes are Collect Nova-only.

Security and audit data: sign-in events, recording playback events, assignment and visibility changes, IP address, user-agent, and similar logs needed to secure the Portal and demonstrate authorized access.

Technical data: cookies required for session authentication and similar technologies described in the Cookie Notice.

We do not intentionally collect payment card numbers through the Portal.

Information comes from you; from your company; from Collect Nova staff; from telephony and recording providers (including Bandwidth or a successor) via secure webhooks and media retrieval; and automatically from your use of the Portal.

We use information to:

(a) provide the Portal, authenticate users, and enforce organization-scoped access;

(b) stream recordings to authorized users and log playback;

(c) enable Client–agency messaging;

(d) secure the service, prevent abuse, detect unauthorized access, and maintain audit trails;

(e) comply with law, respond to lawful requests, and establish or defend legal claims;

(f) operate, maintain, and improve the Portal.

Where GDPR or UK GDPR applies, legal bases may include performance of a contract, legitimate interests in securing a confidential collections workspace, consent where required for recording or communications, and legal obligation. Where we act as a processor, we process on the Client’s documented instructions.

We disclose information only as follows:

To the assigned Client — metadata and recordings that Collect Nova has marked visible for that organization, and non-internal messages in that organization’s threads.

To Collect Nova personnel with a need to know.

To service providers under contract, including authentication and database hosting, application hosting, and voice or recording providers. These parties may process data only for the Portal and related collections operations, subject to confidentiality and security terms.

For legal reasons — if required by law, court order, or government request; to protect rights, safety, or security; or in connection with a merger, acquisition, or reorganization, subject to continued confidentiality.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Account data is kept while the user or Client engagement is active and for a reasonable period afterward for security and legal records. Recordings and messages are retained for the period required by the Client engagement, Collect Nova’s retention schedule, and applicable law (including collections, tax, and limitation periods). Audit logs are retained as needed for security and compliance. When no longer required, data is deleted or de-identified from the active systems we control. Deletion from backups, replicas, and vendor copies is not instantaneous and follows each system’s backup cycle.

We use access controls, encryption in transit, role- and organization-based authorization, short-lived recording playback tokens, rate limiting on playback, and audit logging. Client users cannot access another company’s recordings, hidden recordings, internal notes, or raw provider URLs. You must protect your credentials. Report suspected incidents to privacy@collectnova.test without delay.

At or before collection, we collect the categories in Section 2 for the purposes in Section 4, retain them as described in Section 6, and disclose them as described in Section 5. Sensitive personal information may be incidental in a recording (for example, account numbers or location spoken on a call). We do not use sensitive personal information to infer characteristics for advertising. We do not sell or share personal information.

If you are a resident of California or another state that grants consumer privacy rights, you may have the right to know, access, correct, delete, or obtain a copy of personal information, and to opt out of sale or sharing (we do not sell or share as those terms are defined). You may also have the right to limit use of sensitive personal information and to not be discriminated against for exercising rights.

Submit requests to privacy@collectnova.test. We will verify your identity and respond within the time required by law. You may use an authorized agent where the law allows. If we deny a request, you may appeal by replying to our decision. These rights may not apply to all data—for example, information we process solely as a service provider for a Client, or information we must retain for legal or security reasons.

We have not sold or shared personal information in the preceding 12 months. Categories collected and disclosed are those listed in Sections 2 and 5.

Where the EU or UK GDPR applies to you, you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. You may withdraw consent where processing is based on consent, without affecting prior lawful processing. You may lodge a complaint with a supervisory authority. Submit requests to privacy@collectnova.test. Where Collect Nova acts only as a processor for a Client, we will refer the request to that Client as required.

The Portal is operated in the United States. If you access it from another country, your information will be transferred to the United States. Where required, we use appropriate safeguards such as standard contractual clauses or a comparable transfer mechanism.

The Portal is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children.

The Portal does not make solely automated decisions that produce legal or similarly significant effects about individuals. It displays recordings and messages for human review. This repository does not currently apply AI processing to recordings or inquiry text. If that changes, this Policy must be updated before that processing begins.

The Portal does not respond to browser Do Not Track signals. Because we do not sell or share personal information for cross-context advertising, a Global Privacy Control signal does not change Portal functionality. Essential session cookies remain required to sign in.

We may update this Policy. The effective date will change. Material changes will be posted here or communicated through the Portal.

Privacy requests: privacy@collectnova.test. A mailing address is not published here pending owner confirmation of the contracting entity and business location.

Related: Call Recording Notice · Terms of Use