Privacy.

Effective date: October 21, 2026
Last updated: October 21, 2026

This Product Privacy Policy explains how GoNovus collects, uses, stores, and discloses personal information when providing its Shopify app, merchant dashboard, storefront text chat widget, and support for these services, and how you can exercise your rights relating to personal information. In this Policy, “personal information” means information relating to an identified or identifiable individual. “Merchants” means the businesses that use GoNovus for their stores; “customers” includes store customers and visitors whose personal information is processed through a merchant’s use of GoNovus.

1. Who We Are

GoNovus is operated by NorthByte Inc., a Delaware corporation. In this Policy, “GoNovus,” “we,” “us,” and “our” refer to NorthByte Inc.

Contact email: support@gonovus.ai
Contact address: 8 The Green, Dover, DE 19901, United States

This Policy applies to:

• Merchants and their authorized users who install, configure, or use GoNovus;
• Store customers and visitors whose personal information is processed through a merchant’s use of GoNovus; and
• Individuals who contact us for support with these services or about personal information processed through them.

For information about data processing in connection with visits to the GoNovus website and business inquiries, please see our Website Privacy Notice.

2. The Data Processing Roles of GoNovus and Merchants

Where GoNovus determines the purposes and means of processing personal information for its own merchant account administration, direct business communications, or security obligations, it acts as a controller, or in an equivalent role under applicable law. This does not change our role when handling customer information on a merchant’s behalf as described below.

For customer information that merchants process through GoNovus, such as customer conversations, contact details, and related order information, merchants generally determine the purposes of processing, and GoNovus processes that information on their behalf in accordance with their instructions and the applicable agreements.

Merchants are responsible for explaining to customers how their stores use personal information and obtaining any consent required by law. Customers can also review the privacy policy of the store they visit to understand the merchant’s own data processing practices.

To request the Data Processing Agreement (DPA) applicable to merchant services, please contact support@gonovus.ai.

3. Information We Process

The information we process depends on the features you use, the merchant’s configuration, and the access permissions the merchant grants to GoNovus.

• Merchant account and store information. The names and work email addresses of merchants or their authorized users; store names, domains, and identifiers; and account and authorization information. Sources: information provided by merchants and information accessed through an authorized Shopify integration.
• Service configuration information. Assistant names, welcome messages, suggested questions, appearance settings, store support email addresses, and related settings. Source: settings configured by merchants in the merchant dashboard.
• Product and question-and-answer materials. Product names, descriptions, prices, inventory, specifications, and question-and-answer content made available to GoNovus. These materials may also constitute personal information where they contain information relating to an identified or identifiable individual. Sources: Shopify and materials provided by merchants or accessed with their authorization.
• Customer conversations and contact information. Questions entered by customers, conversation context, assistant responses, conversation identifiers, timestamps, and names, email addresses, or other contact details that customers voluntarily provide. Source: customer interactions with the chat widget.
• Customer and order information. Where the relevant features are enabled and access is authorized, customer identifiers, order numbers, products, amounts, payment status, shipping information, and return or refund status relevant to the request. Sources: Shopify and information provided by customers.
• Contact requests, feedback, and support records. Questions and contact details submitted by customers, related order references, merchant feedback on responses, and support emails, screenshots, and issue descriptions submitted to GoNovus. Sources: customers, merchants, and their authorized users.
• Technical and usage information. IP addresses, browser or device information, access times, error logs, and related activity records processed to operate and protect the services. Page and interaction signals may also be processed in the browser to determine whether to show a proactive prompt and to limit repeated prompts, as described in Section 7. Source: information generated through use of the services.

We process information to the extent necessary to provide the relevant features. Please do not provide passwords, access tokens, full payment card details, or sensitive personal information unrelated to the matter at hand in chats or support requests.

4. How We Use Information

We use the relevant information for the following purposes:

1. Providing and maintaining the services. Connecting merchant stores, loading relevant materials, handling customer questions, generating responses, storing and displaying conversations, restoring drafts and interface state, applying merchant settings, and using page and interaction signals to decide whether to display proactive prompts and limit repeated prompts.
2. Handling customer requests. Retrieving necessary information within the scope of the relevant features and permissions, organizing contact requests submitted by customers, and providing the relevant merchant with the information needed to handle those requests.
3. Providing technical support and troubleshooting. Reviewing relevant conversations, feedback, and technical records in response to issues reported by merchants or customers, fixing errors, and evaluating service performance.
4. Protecting account and service security. Identifying unusual access, abuse, and security incidents, and maintaining service stability.
5. Complying with legal obligations: complying with applicable law and responding to legally binding requests. Separately, protecting legal rights: establishing, exercising, or defending legal claims.

For processing that GoNovus carries out for its own purposes, we rely on the legal basis applicable to each purpose. Depending on the circumstances, this may be a contract with the individual concerned, a legal obligation, valid consent, or a legitimate interest assessed against the individual’s rights and interests. A contract with a merchant does not by itself provide a contractual basis for processing its customers’ information.

We process customer information on behalf of merchants in accordance with their instructions, the applicable DPA, and legal requirements.

5. How AI Processes Data

GoNovus uses AI technology to handle questions and generate responses. To fulfill a particular request, the system may provide AI service providers with relevant questions, necessary conversation context, product or question-and-answer materials, and relevant business information that GoNovus is authorized to access.

GoNovus does not use merchant or customer data, including inputs, outputs, feedback, logs, and evaluation samples, to train or fine-tune AI models, including models used across merchants. AI service providers process data within the scope of the applicable agreements and service settings. Their data retention practices are addressed separately in Section 6.2.

AI service providers may retain necessary information for security and abuse monitoring or enabled features that store content, subject to the applicable arrangements described in Section 6.2.

Authorized personnel may review relevant conversations or feedback when providing support, troubleshooting issues, or evaluating response quality.

AI-generated content may contain errors. Customers with questions about orders, returns, refunds, other post-purchase requests, or other business matters should contact the relevant merchant for confirmation.

6. When We Disclose Information

We do not sell personal information. For the purposes described in this Policy, we disclose information to the following recipients to the extent necessary:

6.1 Relevant Merchants and Their Authorized Users

Conversations, contact requests, and related information generated by customers in a store may be made available to that store’s merchant and authorized users to answer inquiries, handle requests, and provide customer service.

6.2 Service Providers Supporting GoNovus

We may use providers of cloud computing, data storage, AI inference, email delivery, security monitoring, and technical support services. These providers process information to the extent necessary to perform their services and are subject to applicable contractual and data protection requirements.

Depending on the enabled features, cloud and storage providers host service data; AI providers process conversation inputs, necessary context, relevant product or authorized order information, and outputs to generate responses; and email providers process the information needed to deliver support requests and verification messages. Monitoring and logging support service delivery, troubleshooting, and security.

GoNovus retains AI debugging records, operational logs, and technical request metadata for the purposes and periods described in Section 9. Provider-held records are subject to the arrangements below and the applicable retention and deletion requirements in that section.

We require AI service providers not to use merchant or customer data to train or fine-tune models. Providers may retain necessary records for security and abuse monitoring, including review by authorized personnel, or for enabled features that store conversation history or uploaded content. We assess the applicable terms, settings, retention and deletion arrangements, and processing locations before introducing a provider or materially changing its use. These arrangements must support the applicable commitments in Section 9.

The service providers used for particular features may change. For an up-to-date list, including the services they provide, the information they process, and the applicable retention and processing-location arrangements, please contact support@gonovus.ai.

6.3 Recipients for Legal, Security, and Dispute Resolution Purposes

We may disclose information to regulators, law enforcement authorities, legal advisers, or other relevant parties where required by law or necessary to investigate security incidents, resolve disputes, or protect legal rights and interests.

6.4 Parties to Corporate Transactions

In the event of a merger, acquisition, reorganization, or asset transfer, relevant information may be included in transaction due diligence or transferred as part of the transaction. We will require recipients to protect the information in accordance with applicable law and provide notice where legally required.

6.5 Other Recipients You Authorize

We may provide relevant information to recipients you designate when you request or validly authorize us to do so.

7. Cookies and Similar Technologies

GoNovus uses cookies, browser storage, and similar technologies for merchant login, conversation identification and recovery, drafts, proactive-prompt frequency control, and interface preferences. Before the chat window is opened, the widget may request configuration and process page and interaction signals in the browser to decide whether to display a proactive prompt. This does not involve uploading a complete browsing or interaction history for that purpose.

You can manage or clear information stored by these technologies through your browser settings. Disabling necessary cookies or local storage may affect login, conversation continuity, or other features.

We distinguish necessary processing from optional processing. Where applicable law requires consent, we respect the privacy choices recorded through the merchant’s Shopify store, including the refusal or withdrawal of consent.

For cookies used by a merchant’s store, Shopify, or other apps, please also review the relevant provider’s information.

GoNovus sets cookies and browser storage for the following purposes:

• Merchant login. Login cookies are set after successful merchant dashboard login and remain valid for 30 days.
• Conversation identification. An identifier is stored in browser local storage when a visitor first sends a message, to maintain conversation continuity. It expires after 90 days without an actual chat interaction. Browsing, proactive prompts, and background retries do not extend this period. Retaining an identifier does not extend the retention of conversation content under Section 9.
• Conversation recovery and drafts. Browser session storage supports recovery within the current browser tab when conversation or draft state changes. Restoring a tab does not extend the retention periods for messages, drafts, or order information under Section 9.
• Proactive-prompt frequency control. Browser session storage records necessary frequency-control state when proactive prompts are initialized, which may occur before the chat window opens. The state is used only within the current browser tab for no more than 24 hours.
• Temporary interface state. Browser session storage records changes to the chat view or panel size, for use within the current browser tab for no more than 24 hours.
• Interface preferences. Browser local storage remembers preferences such as widget position and dashboard appearance for 90 days from the user's last change.
• Merchant testing and configuration. Browser session storage holds temporary test identifiers, test conversation state, and configuration authorization when a merchant starts or resets a test chat or uses a configuration tool. These records are used only within the current browser tab for no more than 24 hours and are cleared when the test is reset or the relevant tool is exited or completed. Earlier authorization expiry takes precedence.

Browser-stored records are checked for expiry and cleared while the page is running, when it resumes, or on the next visit. Expired records are no longer used. You may also clear browser-stored information through your browser settings.

For a current inventory of the cookies and browser storage used for your service, including item names, storage types, purposes, and durations, please contact support@gonovus.ai.

8. Data Storage Locations and International Transfers

GoNovus and its service providers may process information outside your country or region. Data protection laws may differ between countries and regions.

Our current primary storage location for service data is the United States. Other processing locations depend on the services and providers used and may include countries outside the United States. Authorized support, maintenance, and operations personnel may access information remotely from the United States and other countries or regions, and their locations may change. We maintain records of authorized access locations and manage processing and location changes under applicable contractual and international transfer arrangements. Material changes are subject to the notice and consent requirements described in Section 14, where applicable.

For information subject to international data transfer rules, we implement the necessary transfer arrangements and safeguards in accordance with applicable law. You can contact support@gonovus.ai for information about processing locations and arrangements relevant to the services you use.

9. How Long We Retain Information

We determine retention periods based on the purposes of the services, merchant instructions, applicable agreements, and legal requirements. We do not retain personal information for longer than necessary to fulfill the relevant purposes.

When determining retention periods, we consider:

• Whether the merchant continues to use the relevant services;
• Whether the information is still needed to handle customer requests or support issues;
• The nature and sensitivity of the information;
• Whether legal requirements, dispute resolution, or security investigations require continued retention; and
• Whether the relevant processing can be brought to an end by deleting or irreversibly anonymizing the information.

We apply the fixed retention periods set out below. They are not configurable by merchants. Copying, retrying, or saving information again does not restart the applicable retention period. A shorter applicable retention period or legal deadline takes precedence, except where the law requires us to retain necessary records.

Uninstalling the app revokes access for that installation but does not immediately erase all previously stored information. Uninstallation, a determination that information is no longer necessary, or a valid deletion request triggers deletion before the normal retention period expires. We aim to delete online copies within 7 days of the triggering event and complete deletion of all applicable copies within 30 days. A shorter retention period or legal deadline takes precedence, except for necessary records that must be retained by law.

Deletion covers relevant GoNovus systems and applicable copies held by our service providers. Copies already delivered to a merchant’s own mailbox remain under the merchant’s control. A delay in receiving an uninstall notification does not extend the deletion deadline measured from uninstallation. Reinstalling the app does not cancel deletion of the previous installation’s data, and that deletion does not remove data associated with the new installation.

Where information must be retained to comply with legal requirements, we restrict its use and delete or irreversibly anonymize it when the basis for retaining it no longer applies.

10. Your Rights and How to Submit a Request

Shopify’s requirements for data access and deletion requests apply regardless of the individual’s location. We verify each request and process it for the relevant merchant and customer, retain records of processing and completion, and complete the required action within 30 days of receiving the request. If the law requires us to retain certain information, we retain only the necessary records under the restrictions described in Section 9. The uninstall-related deletion deadlines in Section 9 apply independently of notification timing. Depending on the laws applicable where you are located, you may also have the right to:

• Know whether and how we process your personal information;
• Request access to, or a copy of, your personal information;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information;
• Request restriction of, or object to, certain processing;
• Request data portability, where applicable;
• Withdraw consent you previously provided; and
• Lodge a complaint with a competent data protection authority.

Applicable law may also give you choices regarding certain disclosures or automated processing, and the right to appeal decisions made in response to your requests.

Merchants and authorized users: Please email support@gonovus.ai and specify the store domain, the type of request, and the scope of information concerned.

Store customers and visitors: For information processed on a merchant’s behalf, please first contact the merchant whose store you visited or purchased from. We will assist the merchant in handling your request.

You may also contact us at support@gonovus.ai with

• the store URL or domain,
• the approximate conversation date and time, and
• a conversation identifier if available.

Include the email address used in the conversation only if you provided one.

We may request additional information to locate the records and verify your request. For information GoNovus processes for its own purposes, you may submit your request directly to us.

To prevent unauthorized disclosure or deletion, we may need to verify your identity and your authority to make the request. We will respond within the time limits prescribed by applicable law. If we cannot fulfill all or part of a request, we will explain the reasons and any available next steps.

Please do not send passwords, full payment details, or unnecessary identification documents with your initial request.

11. How We Protect Information

We use encryption to protect personal information in transit and at rest, including business records, files, backups, and exports. Credentials are stored under access controls and encrypted as appropriate to their type. Access to merchant accounts, customer conversations, and order information is limited according to the relevant permissions. Access controls separate information by merchant, store, account, visitor, and conversation consistently across the systems that process this information.

Personnel access is limited according to work responsibilities. We retain audit records of sensitive operations and keep production and test environments separate. Service providers involved in processing information are subject to obligations under the applicable service agreements.

No method of transmission over the internet or storage can guarantee absolute security. If a security incident involving personal information occurs, we will take appropriate response measures and fulfill applicable notification obligations in accordance with legal and contractual requirements.

Merchants should manage their merchant dashboard accounts and user permissions appropriately and promptly revoke access that is no longer needed.

12. Information About Minors

GoNovus merchant dashboard services are intended for businesses and their authorized personnel.

For personal information processed through a merchant’s store, the merchant and GoNovus each remain responsible for their respective obligations under applicable law, including those relating to minors.

If you believe that a minor has provided personal information to GoNovus in circumstances that do not meet applicable requirements, please contact the relevant merchant or support@gonovus.ai so that the matter can be reviewed and appropriate action taken.

13. Third-Party Services

GoNovus connects with Shopify and may display links to third-party websites or services.

When third parties process personal information for their own purposes, their own privacy policies apply. Please review the relevant information before providing information to a third party.

This section does not affect GoNovus’s legal responsibilities for service providers it engages to process information on its behalf.

14. Changes to This Policy

We may update this Policy to reflect changes in product features, data processing practices, or legal requirements. We will indicate the date of the update at the top of the page.

If an update materially affects the processing of personal information, we will provide notice through in-app notifications, email, or another appropriate method, as required by applicable law. Where processing requires renewed consent, we will not rely solely on your continued use of the services as evidence of consent.

15. Contact Us

For questions about this Policy or the DPA, or to request access to, export of, or deletion of information, please contact:

NorthByte Inc. / GoNovus
Email: support@gonovus.ai
Address: 8 The Green, Dover, DE 19901, United States

Updated September 15, 2026.

Who is responsible

GoNovus is operated by NorthByte Inc., a Delaware corporation. For website privacy questions or requests, email support@gonovus.ai.

Information you provide

When you send an enquiry, we receive your name, work email, company, optional website, product interests and message. We use this information to respond, discuss your requirements and manage the resulting business conversation. Please do not include passwords, payment details or sensitive customer information.

Website operation and measurement

Our hosting provider processes technical request information to deliver and secure this website. Where enabled, we use Vercel Web Analytics to understand page visits and actions such as opening a demo enquiry or submitting the form. Our analytics integration excludes enquiry text, email addresses, URL query strings and fragments. It does not use advertising cookies or cross-site advertising profiles. The website does not request microphone or camera access for its illustrative walkthroughs.

Service providers

We use Vercel for website hosting and, where enabled, website analytics, and Resend to deliver website enquiries to our team’s mailbox. Relevant providers process information to provide these services. Processing locations and safeguards depend on the services used; contact us for details relevant to your enquiry or proposed deployment. We do not sell enquiry information or share it for third-party marketing.

Purpose and retention

We process enquiries to respond to requests and take steps toward a potential business relationship. We also process necessary technical information for legitimate website operation and security. We keep correspondence for as long as needed to handle the enquiry and related business relationship, meet applicable obligations and resolve disputes, then delete it or remove identifying information. You may ask us about the retention applicable to your information.

Your choices and requests

You may ask to access, correct or delete your information, or object to or request limits on its use where applicable. We may need information to verify your request. You can also contact the data protection authority in your jurisdiction. Email support@gonovus.ai to make a request.

Product deployments

This notice covers our website and business enquiries. Client deployments, including conversation records, voice processing, connected systems and retention, are governed by the applicable service agreement and data processing terms. Client and end-customer data is not used to train or fine-tune AI models.

Updates

We will update this page when website practices change and show the revised date above.