Privacy Policy

1. Who we are and what this covers

Nova Publishers Inc., a Virginia corporation trading as "Nova Publishers" ("Nova," "we," "us"), provides author and self-publishing services. This policy explains what personal information we collect, why, what we do with it, and what rights you have.

This policy covers thenovap.com, our author portal, our online bookstore, and our services. It does not cover third-party websites we link to, or retailers such as Amazon, Apple Books, Barnes & Noble, Kobo, or IngramSpark, which have their own policies.

Data controller. For the purposes of the UK and EU General Data Protection Regulation, Nova Publishers Inc. is the controller of personal information described in this policy. Contact details are in section 16.

2. The short version

• We collect what we need to publish your book and run our business. Not more.
• We do not sell your personal information for money.
• We do not use your manuscript to train AI models, and we do not sell or license it to anyone who would.
• We keep your unpublished manuscript confidential.
• You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email connect@thenovap.com and we will respond within 30 days (extendable for complex requests, see section 12.7).

3. What we collect

3.1 Information you give us

3.2 Information we collect automatically

IP address, browser type and version, operating system, device type, referring URL, pages viewed, time on page, and approximate location derived from IP (city or region level, not precise). Collected through server logs and, where applicable, cookies (see section 8).

3.3 Information from others

Payment confirmations from our processor. Sales and royalty reports from distributors and retailers. Delivery updates from carriers. Aggregate engagement data from advertising and social platforms where you have interacted with our campaigns.

3.4 Sensitive information

We do not collect biometric data, precise geolocation, or health information as profile data about you, and we ask that you not send such information in a support message.

Two categories of sensitive information we do hold, and how we treat them:

(a) Taxpayer identification numbers and account credentials. A TIN or SSN, and your account log-in credentials, are "sensitive personal information" under California law. We collect a TIN only where required to pay you royalties and report to the IRS, and credentials only to operate your account. We do not use either to infer characteristics about you, and we use them only for the purposes just stated.

(b) Special-category material inside your manuscript. A memoir will often contain information about health, religion, sexual orientation, political opinion, or racial or ethnic origin (about you, and sometimes about others). Under GDPR that is Article 9 special-category data, and storing it inside a manuscript file does not change what it is. Where GDPR applies, we process it on the basis of your explicit consent under Article 9(2)(a), which we obtain at manuscript submission; once the book is published, Article 9(2)(e) also applies because you have manifestly made it public. You may withdraw consent, though once a book is published we cannot recall it from the world (see section 10.3).

4. Why we use it, and our legal basis

If you are in the UK, the EEA, or another jurisdiction with equivalent law, this table is our lawful basis under Article 6 GDPR.

4.1 Our legitimate interests, stated plainly. Where we rely on legitimate interests, our interest is in running a secure, solvent, and improving business, and we have balanced it against your rights. You may object at any time (section 12) and we will stop unless we have compelling grounds that override your interests.

4.2 We will not use your information for a materially different purpose without telling you and, where required, getting your consent.

5. Your manuscript: special commitments

Your manuscript is the most sensitive thing you give us. These commitments are contractual, not aspirational, and they also appear in our Terms.

5.1 We do not train AI on it. Nova does not use your manuscript, artwork, audio, or any material you supply to train, fine-tune, evaluate, or benchmark artificial-intelligence or machine-learning models. We do not sell, license, or otherwise make it available to any third party for that purpose. We require our contractors, in their contracts with us, not to submit your material to any AI tool whose terms permit training on submitted content.

5.2 Confidentiality. Unpublished manuscripts are confidential. Access is limited to the employees and contractors working on your project, each bound by a written confidentiality obligation.

5.3 Storage. Manuscripts are stored in access-controlled systems, encrypted in transit and at rest.

5.4 AI and your book. Our in-house editors and designers do the editing and design work on your book; we do not use AI to write or edit it. Where a service you choose uses an AI tool, such as AI-voice audiobook narration, we use only tools whose terms exclude submitted content from model training, a human reviews the output before it reaches you, and we tell you before you approve it.

If you would prefer that no AI tool touches your manuscript at all, tell us in writing before work begins. We will honour that at no extra charge and confirm it back to you. See Terms, section 12.

5.5 Retention and deletion. See section 10. In short: we keep working files for the length of your engagement plus a wind-down period, and you can ask us to delete them sooner.

6. Who we share it with

We share personal information only as described here.

6.1 Service providers ("processors"). Each is bound by contract to use your information only on our instructions.

6.2 Distributors and retailers. With your authorisation, we send your book files, metadata, and author information to Amazon KDP, IngramSpark, Apple Books, Barnes & Noble, Kobo, and similar. Once they hold it, their own privacy policies apply and we do not control what they do. Author name and biography are published deliberately. That is the point of a book.

6.3 Bookstore purchases. When someone buys a book through our bookstore, we share the buyer's name and email with the author or merchant of that book so they can fulfil and support the order. Authors may only use buyer details for order fulfilment and support, and may only market to a buyer who has separately opted in.

6.4 Legal. We may disclose where required by law, subpoena, or court order; to establish, exercise, or defend legal claims; to protect the rights, safety, or property of Nova, our authors, or the public; or to investigate suspected fraud or abuse. Where we are legally permitted to tell you, we will.

6.5 Business transfer. If Nova is acquired, merged, or sells substantially all of its assets, personal information may transfer as part of that transaction. We will give you notice and the successor will be bound by this policy or one at least as protective. Your manuscript rights under our Terms are not affected.

6.6 We do not sell your personal information for money and never have. We do use advertising measurement tags from Meta and Google, which under California law can count as "sharing." We treat it as sharing and give you a full, working opt-out (see section 9).

7. International transfers

7.1 We are based in the United States and our systems and service providers are primarily in the United States. If you are outside the US, your personal information will be transferred to and processed in the United States, which may not provide the same level of protection as your home jurisdiction.

7.2 Safeguards. For transfers of personal information from the UK or EEA, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), incorporated into our contracts with service providers. A copy of the relevant safeguards is available on request from connect@thenovap.com.

7.3 Distribution transfers. Where you authorise distribution, your author information travels to retailers worldwide. That is inherent in publishing internationally and is done on the basis of your instruction and our contract with you.

7.4 EU/UK representative. If you are in the UK or EEA and wish to contact us about this policy, email connect@thenovap.com and we will respond within 30 days.

8. Cookies and tracking

8.1 What cookies are. Small files placed on your device that let a website remember you between pages and visits. Some of ours are essential. Most are not, and the non-essential ones do not run until you say yes.

8.2 Categories, and what we do with each.

8.3 The third-party services in the non-essential categories.

• Analytics: Google Analytics 4, Google Tag Manager, Microsoft Clarity, Hotjar, Vercel Analytics
• Advertising measurement: Meta (Facebook) Pixel, LinkedIn Insight Tag, X (Twitter) Pixel

We run advertising campaigns on Meta and Google. These tags measure whether our ads worked. We do not currently run retargeting or build custom audiences from our website visitors.

8.4 Managing your choices. A cookie banner appears on your first visit. Nothing in the Functional, Analytics, or Advertising categories loads until you accept it, and declining is exactly as easy as accepting: one click, same prominence. You can change your mind at any time using the Cookie Settings link in our footer. You can also block or delete cookies in your browser, though blocking strictly-necessary cookies will break parts of the site.

8.5 Do Not Track and Global Privacy Control. Browsers send DNT signals inconsistently and there is no agreed standard for honouring them, so we do not respond to DNT. We do honour the Global Privacy Control (GPC) signal: where your browser sends GPC, we automatically treat it as a refusal of Advertising and Analytics cookies and as an opt-out of sale or sharing under California law, without you having to interact with the banner.

8.6 Email tracking. Our marketing emails may record whether you opened the message and which links you clicked, so we can tell what is useful and stop sending what is not. Transactional emails (order confirmations, milestone notices, invoices, royalty statements) are not used for marketing analysis. You can stop all marketing email at any time using the unsubscribe link, which also stops the tracking.

9. Advertising and "sharing" under California law

9.1 We run paid advertising on Meta and Google and use their measurement tags, as listed in section 8.3.

9.2 Under the California Consumer Privacy Act, allowing an advertising platform to set a tag on our site can count as "sharing" personal information for cross-context behavioural advertising, even where, as with us, no retargeting audience is built. We therefore treat it as sharing and give you the full opt-out.

9.3 How to opt out. Any one of these works, and each is honoured automatically:

• Decline Advertising cookies in the banner, or change it later in Cookie Settings
• Send a Global Privacy Control signal from your browser
• Use the "Do Not Sell or Share My Personal Information" link in our footer
• Email connect@thenovap.com with the subject "Do Not Sell or Share"

9.4 We do not sell personal information for money, and we have never done so.

10. How long we keep things

10.1 Earlier deletion. You can ask us to delete your manuscripts and working files at any time (section 12). We will do so within 30 days, except where we must keep something: for a legal obligation; to defend a live legal claim; to fulfil a distribution instruction you have not withdrawn; or to perform services under an engagement that is still running. In that last case we will tell you, and you may cancel the engagement (see the Refund and Cancellation Policy) and then repeat the deletion request. We will always tell you exactly what we are keeping and why.

10.1.1 Notice before deletion. Where we are about to delete working files for a project on hold, we give at least 30 days' written notice to your account email first, as promised in Terms section 4.5.

10.2 Backups. Deleted data may persist in encrypted backups for up to 90 days before those backups cycle out. It is not restored to live systems and is not used.

10.3 Published material. Once a book is published and distributed, we cannot recall it from retailers, libraries, or the internet. Author name and biography are public by design. See our Terms, section 11.4.

11. Security

11.1 What we actually do, stated precisely rather than reassuringly:

• Encryption in transit. All traffic to and from our site uses TLS.
• Passwords are hashed with bcrypt and never stored in readable form. We cannot see your password, and neither can anyone who obtains our database.
• Encryption at rest is provided by our infrastructure providers (Neon for the database and Vercel for file storage) under their standard platform encryption. We do not add a separate layer of application-level encryption on top of that, and we would rather tell you that than imply more than we do.
• Manuscript files are stored with unguessable, randomised URLs and are served through short-lived signed links. They are not listed, indexed, or browsable. This is obscurity plus signed access rather than a per-user permission wall. A specific person who obtained a specific file URL could use it until it expires.
• Access is limited to the employees and contractors working on your project, each under a written confidentiality obligation.
• We keep an activity log of account and submission events. It does not record every time a file is opened, and it retains only the most recent entries, so we cannot promise you a complete history of who viewed your manuscript.

11.2 We restrict access to personal information to people who need it to do their job.

11.3 No absolute guarantee. No system is perfectly secure. We cannot guarantee that our security will never be breached.

11.4 Breach notification. If a breach is likely to result in a risk to your rights and freedoms, we will notify you without undue delay, and we will notify the relevant supervisory authority within 72 hours of becoming aware where GDPR applies. We will also comply with applicable US state breach-notification laws, including Virginia's.

11.5 Your part. Use a strong, unique password and tell us immediately at connect@thenovap.com if you think your account has been compromised.

12. Your rights

12.1 Rights available to everyone, regardless of where you live:

• Access: get a copy of the personal information we hold about you
• Correction: have inaccurate information fixed
• Deletion: have your information deleted, subject to section 10.1
• Withdraw consent: unsubscribe from marketing at any time
• Complain: tell us, and escalate to a regulator

We aim to respond within 30 days; complex requests may take longer, and section 12.7 explains when and how we tell you.

12.2 Additional rights under GDPR (UK and EEA):

• Restriction of processing in defined circumstances
• Portability: receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
• Object to processing based on legitimate interests, including profiling
• Object to direct marketing: absolute, no balancing test
• Not be subject to solely automated decision-making producing legal or similarly significant effects. We do not make such decisions.
• Complain to your supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk); in the EEA, your national authority

12.3 Additional rights under California law (CCPA/CPRA):

• Know the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties
• Delete personal information, subject to exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing: we do not sell or share, but you may still direct us not to, and we honour the Global Privacy Control signal
• Limit use of sensitive personal information: we do not use sensitive personal information for inferring characteristics
• Non-discrimination: we will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right
• Use an authorised agent, with proof of authorisation

12.4 Additional rights under Virginia law (VCDPA): access, correction, deletion, portability, opt-out of targeted advertising, sale, and certain profiling; and a right to appeal a refused request. Appeals: email connect@thenovap.com with the subject "Privacy Appeal." We will respond within 60 days. If we deny your appeal, you may contact the Virginia Attorney General at oag.state.va.us.

12.5 Residents of other US states with comprehensive privacy laws, including Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, have substantially similar rights, and we extend the rights in this section to you.

12.6 How to exercise any of these. Email connect@thenovap.com with the subject "Privacy Request." Tell us which right you want to exercise and enough information for us to find your records.

12.7 What happens next. We acknowledge within 10 business days and respond within 30 days (extendable by a further 60 days for complex requests, with notice to you). Free of charge, unless a request is manifestly unfounded or excessive, in which case we will tell you before charging anything.

12.8 Verification. We will verify your identity before acting on a request. For an access or deletion request we may ask you to confirm details we already hold. We will not ask for more information than we need.

13. Children

13.1 Our services are for adults. Our website and author portal are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under 18, you may not create an account or purchase services.

13.2 Children's books. We publish books for children. Those books are commissioned and delivered by adult authors and adult rights holders, and we collect information from the adult, not from any child.

13.3 If a child is depicted or named in a book (a family memoir, a dedication, a photograph), that material is manuscript content supplied by you, and you are responsible for having the consent of the child's parent or guardian. This is an express warranty you give us in Terms section 14.9.

13.4 If we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. Contact connect@thenovap.com if you believe this has happened.

13.5 For children in the UK and EEA, the digital-consent age varies between 13 and 16 by member state; we apply the higher standard where applicable.

14. Marketing

14.1 We send marketing email only to people who have opted in, or to existing customers about services similar to those they purchased, where permitted.

14.2 Unsubscribing. Every marketing email has an unsubscribe link and it works immediately. You can also email connect@thenovap.com. We will keep your email address on a suppression list so that we can continue not to email you. That is the only reason we keep it.

14.3 Transactional email is separate. Order confirmations, milestone notifications, invoices, royalty statements, and policy-change notices are not marketing and continue while you have an active account or project.

14.4 Bookstore buyers. If you bought a book from our bookstore, the author may only market to you if you separately opted in at checkout.

15. Changes to this policy

We may update this policy. We will post the new version here. For material changes we will email registered account holders at least 30 days before the change takes effect, and where the change requires your consent we will ask for it rather than assume it. We keep dated prior versions and will send you the one that applied to you on request.

16. Contact us

Nova Publishers Inc.
Virginia, USA
Email: connect@thenovap.com
Phone: (703) 249-9257

Privacy requests: connect@thenovap.com, subject "Privacy Request"
Privacy appeals (Virginia and other states): subject "Privacy Appeal"
Do Not Sell or Share (California): subject "Do Not Sell or Share"

We acknowledge privacy requests within 10 business days and respond within 30 days.

Regulators. UK: Information Commissioner's Office, ico.org.uk. EEA: your national supervisory authority. California: the California Privacy Protection Agency, cppa.ca.gov. Virginia: Office of the Attorney General, oag.state.va.us. We would rather you came to us first, but we are not going to pretend these routes don't exist.