Publication details
- Version
- 1.1
- Applicability
- Global
- Effective date
- 24 September 2026
- Last updated
- 24 September 2026
1. Document status, version and effective date
This is the NOVA Global Privacy Policy, version 1.1, effective 24 September 2026, and last updated 24 September 2026. It is effective and available for acknowledgement. It explains how Eredox Pty Ltd handles personal information in connection with the NOVA platform and related websites.
2. About this Policy
This Policy explains what personal information Eredox collects or processes, why, on what legal basis where relevant, who it may be disclosed to, how long it is generally kept, and what rights an individual has. It works alongside the NOVA Global Master SaaS Terms and Conditions and, once published, the Data Processing Addendum, Cookie Policy, and AI Features Addendum.
3. Who Eredox is
Eredox Pty Ltd (ABN 32 634 165 941) is a company registered in Queensland, Australia, and operates the NOVA platform. References to "Eredox," "we," or "us" in this Policy mean Eredox Pty Ltd.
4. Scope
This Policy applies to personal information Eredox processes in its own capacity — for example, in operating its website, administering accounts, billing, and providing support. It does not itself govern how a Customer processes personal information within Customer Data it controls; that is addressed in Sections 7-9 and, in more detail, the Data Processing Addendum once published.
5. Services covered
This Policy covers the NOVA platform (the Services described in the Terms), Eredox's public website, and Eredox's direct communications with visitors, trial applicants, and customers.
6. Persons covered
This Policy is relevant to website visitors, trial applicants, customer administrators, Authorised Users, invited auditors and external reviewers, support contacts, prospective customers, paid subscribers, integration users, and any individual whose personal information a Customer submits to NOVA as Customer Data.
7. Customer-controlled data
Where a Customer uploads or generates content in NOVA that includes personal information about its own employees, contractors, customers, suppliers, or auditors, that Customer generally determines the purpose of that processing and Eredox processes it on the Customer's behalf. See Section 9 and the NOVA Privacy Role Allocation Matrix for detail.
8. Eredox-controlled data
Where Eredox determines the purpose of processing in its own right — account administration, billing, security, service operations, support, legal compliance, website-visitor handling, Eredox's own marketing, acceptance records, and privacy-request handling — Eredox acts independently, not as a processor for a Customer.
9. Controller and processor roles
Depending on the processing in question, Eredox may act as an independent controller or equivalent responsible organisation (Section 8), or as a processor, service provider, or operator for a Customer acting as controller, business, or responsible party (Section 7). The applicable role depends on the actual processing and applicable law, not on a single blanket label — Eredox is not always solely a processor, and a Customer is not always solely responsible where Eredox independently determines a purpose. Full detail is in the NOVA Privacy Role Allocation Matrix. Where Eredox acts as a processor, the Data Processing Addendum (once published) will govern that processing and prevails over this Policy for processor obligations.
10. Definitions
"Personal information" (or "personal data") means information about an identified or reasonably identifiable individual. "Processing" means any operation performed on personal information. "Customer Data" has the meaning given in the Terms. Other capitalised terms have the meaning given in the Terms unless defined differently here.
11. Information provided directly
Eredox collects information an individual or a Customer provides directly — for example, when registering an account, completing a trial signup, contacting support, or configuring the Services.
12. Account information
Name, email address, and role, collected when an account is created (verified: `User.email`, `User.full_name`, `User.role`). Eredox does not currently implement multi-factor authentication, so no MFA data is collected.
13. Organisation and tenant information
The organisation (tenant) name and related administrative details a Customer provides when its NOVA workspace is provisioned.
14. Trial and subscription information
Trial start/end dates, plan selection, and subscription status (verified: `Subscription.is_trial`, `Subscription.trial_ends_at`, `Subscription.plan`).
15. Billing and transaction information
Billing contact details and a payment-provider identifier are recorded by Eredox (verified: `Subscription.external_id`, confirmed to be the Stripe customer/subscription identifier). Card and other payment details are collected and processed directly by Stripe, Eredox's payment processor — Eredox does not itself store full card numbers.
16. Authentication and security information
Hashed passwords (never plain-text), session tokens, API key metadata (name, prefix, hash, last-used date), and password-reset request records including the requesting IP address (verified: `User.hashed_password`, `ApiKey`, `PasswordResetToken.requested_ip`).
17. Compliance and evidence information
Controls, policies, evidence, risks, assets, and reports a Customer creates or uploads within NOVA. This is Customer Data — see Section 7.
18. Files and uploaded content
Documents and other files a Customer or its Authorised Users upload as evidence or supporting material, which may include personal information about the Customer's own personnel or third parties if the Customer chooses to include it.
19. Support and communications
Content of support requests sent to support@eredox.com. NOVA does not currently use a dedicated in-app ticketing or help-desk platform — support is handled by direct email today.
20. Feedback and surveys
If an individual chooses to give feedback or complete a survey, Eredox collects what is submitted. Participation is voluntary.
21. Information from integrations
Where a Customer configures an evidence connector or other integration, data flows in according to how the Customer has configured that connection. This is Customer-controlled — see Section 7.
22. Information from administrators and other users
A Customer's administrator may provide information about other individuals when creating their Authorised User accounts (e.g. name and email) or when configuring roles and permissions.
23. Information collected automatically
Some information is generated automatically through use of the Services, described in Sections 24-30.
24. Device and browser data
Where captured, browser/user-agent information is recorded for specific security purposes — see Section 26. NOVA does not operate a general device-fingerprinting or analytics-tracking system.
25. IP addresses
IP addresses are recorded in the server-side audit log for security purposes (verified: `AuditLog.ip_address`) and in password-reset request records (verified: `PasswordResetToken.requested_ip`). Eredox does not derive geolocation from IP addresses — no such capability exists in the product.
26. Logs and audit records
NOVA maintains a server-side audit log recording actions, the acting user, timestamps, and related detail (verified: `AuditLog` model). This is the authoritative record of platform activity — not any client-side storage (see Section 27).
27. Cookies and local storage
NOVA uses strictly necessary first-party session cookies for authenticated browser access. The HttpOnly `nova_session` cookie contains only an opaque server-side session reference; a separate `nova_csrf` cookie supports request-forgery protection. NOVA does not persist access or refresh tokens in browser storage. Full detail is in the NOVA Cookie and Storage Technology Inventory. These cookies are not NOVA's audit trail — the authoritative record is the server-side audit log (Section 26).
28. Analytics and performance data
NOVA does not currently integrate a third-party analytics or performance-monitoring service. No such data is collected today.
29. Security monitoring
Eredox monitors the Services for security purposes using the audit log and related internal tooling described in Section 26 and the Terms' security provisions.
30. Marketing and preference data
NOVA does not currently operate a newsletter subscription, marketing-preference centre, or email/SMS marketing-consent capture mechanism — this is a greenfield area, not yet built. If and when Eredox introduces optional marketing communications, this Section and Sections 122-128 will describe the specific mechanism, and marketing consent will always be captured separately from Terms acceptance and Privacy Policy acknowledgement.
31. Legal acceptance and acknowledgement records
NOVA has a backend foundation for recording Terms acceptance evidence and Privacy Policy acknowledgement evidence, including document version, server-authoritative document hash, user and tenant attribution, timestamp, and audit evidence. Terms acceptance and Privacy Policy acknowledgement are distinct from consent to a separate processing activity, and any applicable acceptance or acknowledgement record is governed by the version and publication status of the document presented at the time.
32. Consent and withdrawal records
Where Eredox relies on consent for a specific processing activity (for example, future optional marketing, or a tenant's own enablement of an external AI connector), Eredox intends to keep a record of that consent and any withdrawal. Acknowledging this Policy is not, by itself, consent to any processing activity that legally requires separate consent — see Section 54.
33. AI prompts, inputs and outputs
Where a Customer or Authorised User uses an AI-assisted feature, the prompt/context submitted and NOVA's generated output are processed as described in Section 61 and the NOVA AI Privacy Processing Register. Submitted content may include personal information if the user includes it — Eredox does not filter this before processing.
34. Sensitive or special-category information
NOVA does not ask for sensitive or special-category information (such as health data, biometric data, or precise geolocation) as part of its own account or billing processes. If a Customer chooses to include such information within Customer Data it uploads, that is the Customer's own processing decision (Section 7), and the Customer is responsible for ensuring it has an appropriate lawful basis to do so, consistent with the Terms.
35. Children and age restrictions
NOVA is a business-use platform not directed at children. Eredox does not intentionally solicit children's information for its own account administration, and Eredox has not implemented a specific age-verification mechanism in the product. Customer Data may include information selected by a Customer, and Customer is responsible for ensuring it has authority and a lawful basis for any information it uploads or asks NOVA to process.
36. Purposes of processing
Eredox processes personal information for the purposes described in Sections 37-49, each of which is recorded in more detail, with its legal basis, in the NOVA Privacy Purpose and Legal Basis Matrix.
37. Service delivery
To provide, operate, and maintain the Services a Customer has subscribed to.
38. Contract administration
To create and administer accounts, tenants, roles, and subscriptions.
39. Billing
To charge for paid plans and administer billing, via Stripe.
40. Security and fraud prevention
To detect, investigate, and prevent unauthorised access, fraud, and abuse.
41. Support
To respond to support requests sent to Eredox.
42. Compliance and legal obligations
To meet Eredox's own legal, tax, and accounting obligations.
43. Service communications
To notify users of matters affecting their use of the Services, including security and billing notices.
44. Product improvement
To improve the Services generally, using aggregated or de-identified information where genuinely de-identified, or otherwise only on an appropriate legal basis.
45. Analytics
Not currently applicable — no analytics processing occurs, per Section 28.
46. AI-assisted functionality
To provide AI-assisted features using the AI processing paths described in Section 61. Eredox does not use this Policy to claim unverified AI metadata categories, model-training datasets, behavioural profiles, inferred personal attributes, or AI decision scores.
47. Marketing
Only where Eredox introduces an optional marketing capability and only on the basis of separately captured consent or another lawful basis recognised under applicable law — not currently operative, per Section 30.
48. Surveys and research
To understand user feedback, where an individual chooses to participate.
49. Legal claims
To establish, exercise, or defend legal claims, and to cooperate with lawful requests from courts, regulators, or law enforcement.
50. Lawful bases
Where a jurisdiction's law requires a specific lawful basis for processing (for example, the EU/EEA and UK GDPR frameworks), Eredox relies on the bases described in Sections 51-54, applied to the specific purpose as set out in the NOVA Privacy Purpose and Legal Basis Matrix — never a single basis asserted as covering everything.
51. Contract necessity
Where processing is objectively necessary to provide the Services a Customer or individual has requested (for example, account creation, authentication, billing), Eredox relies on contractual necessity.
52. Legal obligation
Where Eredox must process personal information to comply with a legal obligation (for example, financial record-keeping, responding to a lawful regulator request), it relies on that obligation.
53. Legitimate interests
Where Eredox relies on legitimate interests (for example, security monitoring, fraud prevention, or service improvement using non-de-identified data), the specific interest is identified in the NOVA Privacy Purpose and Legal Basis Matrix, and Eredox's assessment weighs that interest against an individual's rights and reasonable expectations. Legitimate interests is not used as a universal, unexamined basis for every purpose.
54. Consent
Where Eredox relies on consent (for example, a future optional-marketing capability, or a tenant's enablement of an external AI connector), that consent can be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out before withdrawal. Acknowledging this Policy is not itself consent to a processing activity that requires separate consent under applicable law.
55. Customer instructions
Where Eredox processes Customer Data as a processor, it does so on the Customer's documented instructions, as will be further specified in the Data Processing Addendum once published — not on an independent basis of its own for that content.
56. How information is disclosed
Eredox discloses personal information only as described in Sections 57-65, and does not sell personal information — no sale or third-party-sharing-for-cross-context-behavioural-advertising practice was found or is described in this Policy.
57. Customer administrators
A Customer's own administrators can see information about that Customer's own Authorised Users, within the tenant they administer.
58. Authorised users
Other Authorised Users within the same tenant may see information as configured by the Customer's own role and permission settings.
59. Service providers and subprocessors
Eredox uses a limited number of service providers to operate the Services, listed in the NOVA Subprocessor Register. Current service providers and processing locations, where confirmed, are identified in that register; unconfirmed items are not asserted here as fact.
60. Payment providers
Stripe, Eredox's payment processor, receives payment-provider identifiers and processes payment details directly — see Section 15.
61. AI providers
NOVA's default AI features run on Eredox's own self-hosted local AI infrastructure; no content is sent to an external AI provider by that path. Where a Customer configures and explicitly enables its own connector to an external AI provider (for example, OpenAI, Anthropic, or DeepSeek), content submitted to that feature is processed by that provider under the terms the Customer itself has agreed to when configuring the connector — Eredox does not hold a platform-level credential for any external AI provider and is not a party to that processing relationship. Full detail is in the NOVA AI Privacy Processing Register. Eredox does not represent that any external provider trains models on submitted content, or that it does not — this has not been verified provider-by-provider and is not asserted either way.
62. Infrastructure providers
Eredox's own infrastructure (database, cache, object storage, search) is described in the NOVA Subprocessor Register; the specific hosting provider and location for a production deployment are not confirmed in this Policy — see the NOVA International Data Transfer Register.
63. Professional advisers
Eredox may disclose personal information to its own professional advisers (for example, lawyers, accountants, auditors) where reasonably necessary.
64. Authorities and legal process
Eredox may disclose personal information where required by law, court order, or lawful request from a regulator or law enforcement body.
65. Corporate transactions
If Eredox is involved in a merger, acquisition, or sale of assets, personal information may be disclosed as part of that transaction, subject to appropriate safeguards.
66. International transfers
Personal information may be processed in a country other than the one an individual is located in. Eredox has not independently confirmed the specific hosting location(s) used for a production deployment in this Policy — see the NOVA International Data Transfer Register. Where a transfer occurs to a country without an applicable adequacy decision, Eredox intends to rely on a recognised transfer mechanism such as the European Commission's Standard Contractual Clauses or the UK's equivalent transfer mechanism, consistent with the safeguards described in Section 67.
67. Transfer safeguards
Where a cross-border transfer requires a safeguard under applicable law (for example, the GDPR's Chapter V mechanisms), Eredox intends to use an adequacy decision where the destination is covered by one, or the current modernised Standard Contractual Clauses (including a transfer-impact assessment) or an equivalent UK mechanism otherwise. This is a statement of intended approach, not a representation that a specific mechanism is already executed for a specific transfer, since the underlying hosting-location facts are not yet confirmed.
68. Data localisation
Eredox has not confirmed offering a customer-selectable data-residency or localisation option in the product today, notwithstanding that its underlying infrastructure stack is technically self-hostable in a specific region. A Customer requiring a specific data-residency commitment should raise this directly with Eredox using the contact details in Section 133 rather than assume one exists.
69. Security safeguards
Eredox maintains administrative, physical, and technical safeguards designed to protect personal information appropriate to its nature, consistent with Section 49 of the Terms. These safeguards are risk-appropriate and do not state a specific certification, attestation, encryption configuration, or audit result unless separately published. Further detail will be in the Security and Shared Responsibility Schedule once published.
70. No absolute-security guarantee
No method of transmission or storage is completely secure. Eredox does not guarantee absolute security and cannot promise that a security incident will never occur.
71. Retention principles
Eredox retains personal information for as long as needed for the purpose it was collected for, plus any period required by law, subject to the specific periods and gaps identified in the NOVA Personal Information Retention and Deletion Schedule. Eredox does not assert a single universal retention period across every category of information.
72. Retention schedule
The approved retention position is a 30-day post-expiry or post-termination action period before administrative disposition review, and a 30-day retention period for generated auditor evidence-package export artefacts. Other categories do not yet have a confirmed period and are not asserted as having one.
73. Account closure
When an account, trial, or subscription ends, personal information is handled per Sections 74-77 and the Terms' termination provisions (Sections 64-69). Expiry does not automatically delete Customer Data.
74. Data export
Following trial expiry, subscription expiry, or termination, Eredox intends to provide the 30-day action period described in Section 65 of the Terms, using then-available product export capability. Notices are intended at expiry or termination, 14 days remaining, 7 days remaining, 1 day remaining, and final expiry of the action period. Supported export formats depend on then-current product capability.
75. Active-system deletion
Expiry of the 30-day action period does not automatically delete Customer Data. The account enters administrative disposition review, which is expressly non-content review: Eredox does not open, read, inspect, analyse, assess, classify, validate, or selectively review Customer Data. Customer Data is treated as a sealed tenant package. Deletion requires an explicit decision by an authorised Eredox person. Where deletion is approved, the tenant package is removed from active systems as a package, without selective content inspection, and notices, decisions, approvals, and execution evidence are retained.
76. Backup expiry
Personal information may persist temporarily in backup copies after package deletion from active systems, until those backups reach their ordinary approved backup lifecycle expiry. Eredox does not promise immediate erasure from every backup copy.
77. Legal holds
Eredox may pause export, deletion, or disposition, or retain personal information beyond its ordinary retention period, where required to comply with a legal or regulatory hold, preserve fraud or security records, meet a financial record-keeping obligation, address a dispute, or comply with security restrictions, for as long as that requirement applies.
78. De-identification and aggregation
Where Eredox uses aggregated or de-identified information (for example, for service improvement), it does so only where the applicable de-identification standard is genuinely met for the relevant purpose. Eredox does not describe merely pseudonymised information (information that could be re-identified using additional information Eredox or another party holds) as anonymous.
79. Individual rights
Depending on applicable law, an individual may have some or all of the rights described in Sections 80-91. These rights, and how to exercise them, vary by jurisdiction — see Sections 98-111 for jurisdiction-specific detail and Sections 92-97 for how to exercise a right generally.
80. Access
The right to request confirmation of, and access to, personal information Eredox holds, where applicable law provides this right.
81. Correction
The right to request correction of inaccurate or incomplete personal information, where applicable law provides this right.
82. Deletion
The right to request deletion of personal information, subject to exceptions such as a legal obligation to retain it, where applicable law provides this right.
83. Restriction
The right to request that Eredox restrict processing in certain circumstances, where applicable law provides this right (for example, under the GDPR/UK GDPR framework).
84. Objection
The right to object to certain processing, including processing based on legitimate interests, where applicable law provides this right.
85. Portability
The right to receive certain personal information in a portable format, where applicable law provides this right.
86. Consent withdrawal
Where processing is based on consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal — see Section 54.
87. Sale/sharing opt-out where applicable
Eredox does not sell or share personal information for cross-context behavioural advertising as those terms are used in California's CCPA/CPRA framework, based on the processing described in this Policy. Where applicable law nonetheless provides an opt-out right, an individual may exercise it using the contact details in Section 133.
88. Targeted-advertising opt-out where applicable
NOVA does not currently engage in targeted advertising — see Section 30. Where applicable law provides an opt-out right regardless, an individual may exercise it using the contact details in Section 133.
89. Sensitive-information rights
Where applicable law grants additional rights over sensitive personal information, and to the extent NOVA processes any (see Section 34), those additional rights apply.
90. Automated-decision rights
NOVA's compliance-readiness indicators and AI-assisted features are decision-support tools for human users, not automated decisions producing legal or similarly significant effects on individuals, based on the processing described in this Policy. Where applicable law provides rights concerning automated decision-making (for example, Australia's amended transparency provisions, not yet in force as of the effective date — see the source register), those rights apply to the extent NOVA's processing falls within their scope.
91. Non-discrimination
Eredox will not discriminate against an individual for exercising a privacy right, where applicable law prohibits this (for example, under CCPA/CPRA).
92. Authorised agents
Where applicable law permits, an individual may use an authorised agent to exercise a right on their behalf, subject to Eredox verifying the agent's authority.
93. Exercising rights
A request to exercise a privacy right can be made using the contact details in Section 133. See the NOVA Privacy Rights Request and Complaint Workflow for how Eredox intends to handle such a request.
94. Identity verification
Eredox may need to verify a requester's identity before acting on a request, proportionate to the sensitivity of the request.
95. Response timing
Response periods and applicable rights depend on the law that applies to the individual making the request — this Policy does not state a single universal response deadline. Where a specific deadline is legally required (for example, under a jurisdiction's data-protection law), Eredox intends to meet it.
96. Appeal rights
Where applicable law provides a right to appeal Eredox's response to a request, an individual may do so using the contact details in Section 133.
97. Complaints
An individual may also complain to Eredox directly (Section 134) or to their applicable data-protection regulator (Section 135).
98. Australian rights
Individuals in Australia have rights under the Privacy Act 1988 (Cth) and its Australian Privacy Principles, including access and correction (APP 12, APP 13), and may complain to Eredox or to the Office of the Australian Information Commissioner (OAIC).
99. EU/EEA rights
Individuals in the EU/EEA have rights under the GDPR, including access, rectification, erasure, restriction, objection, and portability (Articles 15-22), and may complain to their competent supervisory authority.
100. United Kingdom rights
Individuals in the UK have equivalent rights under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (in force in full as of the effective date), and may complain to the Information Commissioner's Office (ICO).
101. United States state rights
Individuals in certain US states (for example, California, under the CCPA as amended by the CPRA and current CPPA regulations) have rights including access, deletion, correction, and opt-out of sale/sharing where applicable. Rights and their exact scope vary by state; not every US state provides the same rights, and this Policy does not claim a single nationwide US privacy law applies uniformly.
102. Canadian rights
Individuals in Canada have rights under PIPEDA (access, correction, and complaint to the Office of the Privacy Commissioner of Canada) and, where applicable, stricter provincial law such as Quebec's Law 25.
103. New Zealand rights
Individuals in New Zealand have rights under the Privacy Act 2020, including access and correction, and — since 1 May 2026 — the benefit of IPP 3A's notification requirement for indirectly-collected personal information, and may complain to the Privacy Commissioner.
104. Singapore rights
Individuals in Singapore have rights under the Personal Data Protection Act 2012, including access and correction, and may complain to the Personal Data Protection Commission (PDPC).
105. Japanese rights
Individuals in Japan have rights under the Act on the Protection of Personal Information, and may raise concerns with the Personal Information Protection Commission (PPC).
106. South Korean rights
Individuals in South Korea have rights under the Personal Information Protection Act, and may raise concerns with the Personal Information Protection Commission (PIPC).
107. Indian rights
India's Digital Personal Data Protection Act 2023 and its 2025 Rules are in a phased commencement — as of the effective date, the Act's core data-fiduciary obligations and data-principal rights machinery are not yet fully in force (they phase in through 14 May 2027, per the NOVA Authoritative Legal Source Register). Individuals in India will have rights under that Act as its provisions come into force.
108. Brazilian rights
Individuals in Brazil have rights under the Lei Geral de Proteção de Dados (LGPD), including confirmation, access, correction, and objection, and may raise concerns with the Autoridade Nacional de Proteção de Dados (ANPD).
109. South African rights
Individuals in South Africa have rights under the Protection of Personal Information Act (POPIA), and may raise concerns with the Information Regulator.
110. UAE and regional financial-centre rights
Individuals in the UAE have rights under Federal Decree-Law No. 45 of 2021, or, where applicable, the separate DIFC or ADGM data protection regimes, which operate independently of the federal law.
111. Rest-of-World rights
Where an individual is located in a jurisdiction not specifically addressed above, Eredox will honour any mandatory local privacy law that applies, consistent with the mandatory-local-law approach in the Terms. Eredox has not researched every jurisdiction's specific privacy law in detail — this Section is a savings clause, not a representation of jurisdiction-by-jurisdiction compliance.
112. Privacy incidents and data breaches
Eredox intends to assess a suspected security incident to determine whether personal information was involved and whether it meets a legal notification threshold. Not every incident is a notifiable data breach — see the NOVA Privacy Incident Notification Matrix. No universal notification-timing rule (such as a single global "72 hours") is used in this Policy.
113. Regulatory notifications
Where an incident meets a jurisdiction's legal notification threshold, Eredox intends to notify the applicable regulator consistent with that jurisdiction's requirement (for example, Australia's Notifiable Data Breaches scheme, which requires a reasonable and expeditious assessment within a maximum of 30 days).
114. Customer breach cooperation
Where an incident affects Customer Data for which Eredox acts as a processor, Eredox intends to notify the affected Customer so the Customer can meet its own obligations. Eredox has not approved a specific fixed contractual notification-timing commitment as of the effective date — see the NOVA Privacy Incident Notification Matrix.
115. Cookies and similar technologies
NOVA uses strictly necessary first-party session cookies for authenticated browser access. Section 27 and the NOVA Cookie and Storage Technology Inventory describe their purpose and expiry. NOVA does not use analytics or marketing cookies.
116. Strictly necessary technologies
The HttpOnly `nova_session` cookie and the readable `nova_csrf` double-submit cookie are strictly necessary to keep a user signed in securely and protect state-changing requests. They do not contain access or refresh tokens.
117. Functional technologies
None currently implemented.
118. Analytics technologies
None currently implemented — see Section 28.
119. Marketing technologies
None currently implemented — see Section 30.
120. Cookie preferences
These cookies are strictly necessary for the requested authenticated service. No analytics or marketing cookie preference is required because those technologies are not currently used.
121. Global Privacy Control
NOVA does not currently detect or respond to the Global Privacy Control signal, consistent with there being no sale/sharing of personal information or targeted advertising to opt out of today (Sections 87-88). This will be revisited if that changes.
122. Electronic marketing
Eredox does not currently send marketing communications — no newsletter, marketing-consent capture, or outbound marketing-send capability exists in the product today (Section 30). This Section describes the principles that will apply if and when that changes. Accepting the Terms or acknowledging this Policy does not, by itself, constitute consent to receive marketing communications.
123. Essential service communications
Eredox may send essential, non-marketing communications (account, security, billing, and legal notices) where legally permitted, and these are not treated as marketing regardless of a recipient's marketing preferences.
124. Email marketing
If introduced, email marketing will be sent only where a lawful basis (such as consent) exists, with accurate sender identification and a functional unsubscribe facility, consistent with the Spam Act 2003 (Cth) principles described in the NOVA Authoritative Legal Source Register and the NOVA ACMA Electronic Communications Operational Implementation Register.
125. SMS marketing
NOVA does not currently use SMS for any purpose, including marketing. If an alphanumeric SMS sender ID is adopted in future, it will be registered on the ACMA SMS Sender ID Register (in force since 1 July 2026, before this Policy's date) through a participating telecommunications provider before use, per the ACMA operational register.
126. Telemarketing
Eredox does not currently telemarket. If it does in future, it will screen against the Do Not Call Register and observe the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017's permitted-hours and identification requirements.
127. Unsubscribe and suppression
Any future marketing communication will include a functional unsubscribe mechanism. Withdrawing marketing consent does not stop essential service communications (Section 123). Eredox may keep a limited suppression record of a withdrawal to ensure a recipient who unsubscribed is not contacted again for marketing purposes.
128. ACMA and Australian communications treatment
Where Eredox sends commercial electronic messages from or into Australia, it intends to meet the Spam Act 2003 and Spam Regulations 2021 requirements for consent, accurate sender identification, and a working unsubscribe facility, as detailed in the NOVA Authoritative Legal Source Register §A and the NOVA ACMA Electronic Communications Operational Implementation Register. Not every message NOVA sends is treated as exempt merely because it also contains service content — a message combining promotional and essential content is assessed on its overall character.
129. Third-party links and services
NOVA or Eredox's website may link to third-party sites or services Eredox does not control. This Policy does not apply to those third parties' own privacy practices.
130. Changes to this Policy
Eredox may update this Policy from time to time. Material changes will be notified in advance where reasonably practicable, except where an immediate change is required for legal or urgent security reasons.
131. Version history
Each version of this Policy is separately identified by version number and effective date, consistent with the LEGAL-001A publication architecture's versioning model.
132. Material changes and notice
Where a new version materially changes how personal information is handled, Eredox may seek fresh acknowledgement, consistent with the reacceptance model described in the NOVA Global Legal Publication Architecture.
133. Contacting Eredox
Questions about this Policy, and requests to exercise a privacy right, must be sent using the legal contact details published in the NOVA Legal Centre. General product support is available at support@eredox.com.
134. Privacy complaints
An individual may raise a privacy complaint directly with Eredox using the contact details in Section 133. See the NOVA Privacy Rights Request and Complaint Workflow for how Eredox intends to handle a complaint.
135. Regulator contacts
An individual may also complain to their applicable data-protection regulator — for example, the OAIC in Australia, the ICO in the UK, a competent supervisory authority in the EU/EEA, or the equivalent regulator identified for their jurisdiction in Sections 98-111.
136. Regional notices and addenda
Eredox may publish a country or regional privacy addendum to reflect mandatory local law. As of the effective date, no such addendum has been published — see Section 111.
137. Language and interpretation
This Policy is published in English. Where a translation is provided, the English version prevails in the event of a conflict, unless applicable law requires otherwise.
138. Effective-date and update notation
This Policy's current version, effective date, and "Updated — <date>" notation are shown on this page and sourced from the document's own metadata, not a hardcoded page-level date.