Data Processing Agreement
Last updated: July 28, 2026
This Data Processing Agreement ("DPA") forms part of the Nova Terms of Service between you (the operator) and Novanest Pro, Inc. ("Nova"). It explains how Nova processes personal data that flows through your Thumbtack account when you use Nova to handle customer conversations.
1. Roles
- You are the data controller of the personal data your customers share with you on Thumbtack.
- Nova is your data processor: we process that data only on your behalf and only to provide the service.
- Thumbtack, Inc. is the original controller of the platform relationship with the end customer.
2. What data we process
- Inbound and outbound messages exchanged through the Thumbtack Partner API.
- Lead form data Thumbtack collected from the customer (category, project description, zip, customer name).
- Photos and attachments your customers share in those messages.
- The customer's stated phone number or address, if and only if they typed it in the chat.
3. Purpose of processing
Strictly to deliver the Nova service: drafting replies on your behalf, detecting booking outcomes, generating booking summaries, and notifying you. We do not use customer data for any other purpose, including marketing or model training.
4. Sub-processors
We engage the following sub-processors to provide Nova:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting (ECS Fargate) | USA |
| MongoDB Atlas | Database | USA |
| OpenRouter | LLM gateway | USA |
| Anthropic / Google / OpenAI | LLM inference (via OpenRouter) | USA |
| Scrapfly | Image proxy for Thumbtack attachments | USA |
| Telegram | Operator notifications + approval flow | Global |
| Retell AI | Booking-announcement phone calls (opt-in) | USA |
We'll notify operators on file at least 30 days before adding or replacing a sub-processor.
5. Security
- All data transfers use TLS 1.2+.
- OAuth tokens and other secrets are encrypted at rest in AWS Systems Manager and MongoDB.
- Per-operator data isolation via business_id.
- Access to production systems is restricted to authorized Novanest Pro engineers.
- Plaintext credentials and tokens are never logged.
6. Data subject requests
If a customer asks you (the controller) to delete or export their data, forward the request to contact@novanestpro.com and we will action it within 30 days.
7. Incident notification
If we become aware of a security incident affecting your data, we'll notify you without undue delay (and in any case within 72 hours) with what happened, what data is affected, and what we're doing about it.
8. Deletion on termination
When you disconnect your Thumbtack account or close your Nova account, OAuth tokens are revoked immediately. All operator and customer data tied to your account is deleted within 30 days unless we are legally required to retain it (e.g. tax/audit records of billing, never message content).
9. International transfers
All processing occurs in the United States. If you require an EU or UK data residency arrangement (e.g. with Standard Contractual Clauses), contact us. We'll handle it on a per-operator basis.
10. Audits
Once per calendar year, on 30 days' notice, you may request a summary of our security controls and sub-processor list. We'll respond in writing within 30 days.
11. Contact
Novanest Pro, Inc.
Los Angeles, California, USA
contact@novanestpro.com