Privacy Policy

Effective Date: 2026-05-14 Last Updated: 2026-05-24 Entity: Nova Codes LLC ("Nova Codes," "we," "us," or "our") Contact: liam@nova.codes

1. Who we are

Nova Codes LLC is a Texas limited liability company based in Austin, Texas that provides AI-powered receptionist services, Google Reviews automation, and high-end websites to local service businesses (HVAC/plumbing/electrical, veterinary clinics, auto repair shops, salons/barbershops, and similar non-HIPAA-covered trades). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have about your information when you interact with our services or our agency directly.

This Policy applies to: - Our website at nova-codes.com (and any subdomains such as agency.nova-codes.com) - Our AI receptionist services deployed to client sub-accounts on the GoHighLevel platform - Our outbound cold-calling, email, and SMS outreach - Any other Nova Codes branded service or interaction

If you are a client of Nova Codes who has purchased our services, this Policy describes how Nova Codes handles your information. The end users of your business who interact with the AI receptionist we deploy on your behalf are subject to your privacy policy as the operator of your business — Nova Codes acts as your data processor under your direction. We do not independently market to or contact your customers.

2. Information we collect

2.1 Information you provide to us directly

Contact information when you book a demo, request information, or sign up as a client: name, business name, email address, phone number, business address, business website, role.
Account and billing information when you become a paying client: billing contact name, billing email, payment-method details (collected and stored by our payment processor, not by Nova Codes; we receive only the last four digits of the card and the billing summary).
Business operational information you share with us during onboarding: hours, services, pricing, geographic service area, sample calls, and any custom intake fields you want your AI receptionist to capture.

2.2 Information collected automatically when you interact with our AI receptionist (during the demo experience or, for clients, on your deployed receptionist)

Call audio (the voice of the person speaking with the AI), recorded for the duration of the call.
Speech-to-text transcripts of the call, generated by our speech-recognition vendor.
Call metadata: phone number of the caller (caller ID), call start time, call duration, the call's outcome (booked appointment, transferred, voicemail, hung up).
AI-generated call summary produced by our language-model vendor based on the transcript.

2.3 Information collected automatically when you visit our website

Standard web analytics: IP address, browser type and version, operating system, referring URL, pages visited, time spent on each page, click events. Collected via cookies and similar technologies; see Section 8.

2.4 Information collected from outbound outreach

Lead-list information sourced from licensed third-party data providers, public business directories, and our own enrichment pipeline. Typically includes: business name, business phone number, business address, owner name (where publicly available), business website, and industry classification. This is business contact information, not personal information about consumers.
Cold-call dispositions and notes we record during or after a call we place to a business: whether the contact was reached, what they said, follow-up notes, and whether they consented to a demo.

3. How we use information

We use the information we collect for the following purposes:

To deliver the AI receptionist service — answer calls on behalf of you (the client), book appointments on your calendar, capture lead information, and transfer to a human when appropriate.
To enrich and reconcile your CRM — write call transcripts, summaries, and recording links into your GoHighLevel sub-account so you have a complete record of every interaction.
To send appointment confirmations and reminders to your customers via SMS and email, using contact information your customers provide during a call or web booking.
To request Google Reviews from your completed appointments via SMS and email, using contact information your customers provide.
To respond to your inquiries when you reach out to us (sales questions, support requests, billing).
To improve our services — analyze aggregated, de-identified call quality, transcription accuracy, and booking conversion rates. We do not use the content of any specific call to train AI models without explicit prior consent.
To comply with applicable laws — including the Federal Telephone Consumer Protection Act (TCPA), state telemarketing rules, the federal and state Do Not Call (DNC) registries, and call-recording disclosure laws in two-party-consent states.

4. Cold-call outreach and consumer choice

Nova Codes places business-to-business cold calls to local service-business owners to introduce our AI receptionist service. Before placing any outbound call:

DNC scrubbing. Every phone number on our outbound list is scrubbed against the U.S. Federal Do Not Call Registry and the eleven state DNC registries that maintain their own list, within 31 days of the call. Numbers that appear on any DNC list are removed before dialing.
Internal opt-out. If you tell us during a call, by email, or in any other written form that you do not wish to be contacted again, we add your number to our internal DNC list, which is honored across our entire outbound operation (this list is shared between our voice and email outreach systems and is not used for any other purpose).
State-specific compliance. In states that require all-party consent to record a call (California, Florida, Washington, Nevada, Massachusetts, Illinois, Montana, Maryland, New Hampshire, Connecticut, Pennsylvania), our caller will disclose at the beginning of the call that the call may be recorded for quality and training purposes. In states that require identity disclosure on cold calls (e.g., New York), our caller will identify themselves and Nova Codes by name at the start of the call.
Texas exclusion. Nova Codes does not currently place outbound cold calls to phone numbers with Texas area codes due to Texas Senate Bill 140's bond and registration requirements (effective September 2025). This exclusion will be revisited when our compliance posture supports it.

To opt out of future outreach, email liam@nova.codes or reply STOP to any SMS message you receive from us.

4a. SMS messaging program (Nova Codes operator and client appointment notifications)

Nova Codes operates an SMS messaging program that sends transactional and informational text messages to two groups of recipients: (a) Nova Codes' agency operator (Joel) for new-booking and emergency alerts triggered by the AI receptionist, and (b) end-customers of our agency clients for appointment confirmations and review-request automation, where the end-customer has opted in.

What you opt in to receive. By providing your phone number on our SMS opt-in form at https://nova-codes.com/sms-opt-in and checking the consent box, you agree to receive recurring transactional text messages from Nova Codes LLC at the phone number you provide. Messages are limited to: appointment confirmations, demo follow-ups, account updates, and service notifications related to our AI receptionist service. Nova Codes does not send promotional or marketing SMS to opted-in numbers. Message frequency varies and is typically up to 5 messages per month, but may vary based on your interactions.

What information is collected during opt-in. When you submit the SMS opt-in form, we collect: your mobile phone number, your name (optional), the timestamp of your consent, the IP address from which you submitted the form, and the URL of the opt-in page. We retain this information as proof of consent for the duration of your subscription plus a reasonable period thereafter for audit purposes.

Carrier and standard rates. Standard message and data rates from your wireless carrier may apply. Nova Codes is not responsible for any charges incurred from your wireless carrier for receiving SMS messages from us. Carriers including AT&T, Verizon, T-Mobile, Sprint, Boost, MetroPCS, Virgin Mobile, U.S. Cellular, and others are not liable for delayed or undelivered messages.

How to opt out. Reply STOP to any text message from Nova Codes LLC at any time to stop receiving messages. You will receive a single confirmation message and no further marketing messages will be sent. To get help at any time, reply HELP or email liam@nova.codes.

Age restriction. You must be at least 18 years of age (or the age of majority in your jurisdiction) to opt in to receive SMS messages from Nova Codes LLC.

No sharing of SMS opt-in data — CRITICAL. Nova Codes LLC does not share, sell, rent, lease, or otherwise transfer mobile phone numbers, SMS opt-in consent records, or any associated personally identifiable information collected through our SMS opt-in form with any third parties, affiliates, marketing partners, or data brokers for any purpose. SMS opt-in data is used exclusively by Nova Codes LLC to deliver the messaging program you opted in to receive, and is shared only with the carrier-side telecommunications providers (such as Twilio) that are strictly necessary to transmit the SMS message you requested. This non-sharing commitment applies to all opt-in data regardless of source (web form, paper form, verbal, or otherwise).

5. Service providers and third parties (sub-processor chain)

We use the following service providers to deliver our AI receptionist service. Each handles a defined slice of the data described in Section 2.

Provider	Role	Data accessed
GoHighLevel	CRM platform, calendar booking, SMS/email sending, website hosting for clients	Contact records, call transcripts, appointments, conversation history
Vapi	Voice AI runtime that powers the receptionist	Live call audio, call metadata
Twilio	Telephony carrier that delivers the phone calls	Phone numbers, call metadata
Deepgram	Speech-to-text transcription	Call audio (transient, for transcription)
Cartesia	Text-to-speech voice generation for the AI receptionist	Generated audio output (the AI speaking back)
OpenAI	Language model that powers the AI receptionist's reasoning and the call summary	Live call transcript (transient, for response generation)
Trellus.ai	Outbound parallel dialer used by Nova Codes' agency operators	Outbound phone numbers, dispositions, recordings
Fly.io	Hosting platform for our internal webhook relay service	Webhook payloads (transcripts, recording URLs)
Stripe	Payment processing for Nova Codes services	Billing information, payment method last four digits
Google (Gmail, Google Maps)	Email infrastructure and business-listing data	Email contents, public business profile data
Google Calendar API (when a client owner connects their calendar — Section 5A)	Free/busy and event read/write on the connected calendar so the AI receptionist can book real availability	The connected calendar's free/busy windows and event metadata (title, start, end, attendees, description) on events Nova Codes creates or reads on the owner's behalf
Hunter / Apollo	Owner-name enrichment for outbound business lists	Public business contact information

These vendors are contractually obligated to handle data only as needed to provide their service to Nova Codes, and not for their own independent purposes.

HIPAA notice. Nova Codes does not currently serve HIPAA-covered entities (medical practices, dental practices, mental-health providers, chiropractors, optometrists, or any other healthcare provider subject to HIPAA). Our service infrastructure is not configured for Protected Health Information (PHI) handling, and we do not enter into Business Associate Agreements at this time. If our services are deployed at a client whose business begins handling PHI, the client is responsible for ensuring that no PHI is captured by the AI receptionist, and Nova Codes reserves the right to terminate or migrate the engagement to maintain compliance.

5A. Calendar integrations and Google user data

When a Nova Codes client (a business owner) chooses to connect their personal or business Google Calendar to their AI receptionist, Nova Codes uses Google Workspace APIs (specifically the Google Calendar API) so the receptionist can read free/busy and create real bookings on the connected calendar. This section describes what we do — and do not do — with that Google user data.

5A.1 Scope of Google data accessed

Nova Codes requests exactly one OAuth scope when an owner connects their calendar:

https://www.googleapis.com/auth/calendar.events — read and write calendar events on the connected calendar. We do not request access to email (https://mail.google.com/), Gmail metadata, Drive, Contacts, Tasks, or any other Google scope.

From the connected calendar we read:

The list of free/busy windows on the calendar's primary calendar for a rolling 60-day forward window — used to intersect with GHL availability so the receptionist offers only times the owner is actually free.
The events Nova Codes itself created on the owner's behalf — needed so the receptionist can cancel or reschedule a booking it made when a customer calls back.

We do not read, copy, or store events on the connected calendar that Nova Codes did not itself create. The free/busy lookup only exposes "busy" windows, not event titles, attendees, or descriptions of unrelated events.

5A.2 Google API Services User Data Policy compliance

Nova Codes' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Allowed use only. Calendar data accessed via calendar.events is used solely to provide and improve the user-facing AI receptionist feature (free/busy intersection + dual-write booking). We do not use it for serving advertisements, for training generalized AI/ML models, or for any purpose other than the receptionist feature the owner connected the calendar for.
No human reading. No Nova Codes employee, contractor, or affiliate reads or accesses the contents of Google Calendar data except (a) with the owner's explicit consent for support, (b) for security investigation, (c) to comply with applicable law, or (d) where the data is aggregated and anonymized and used for internal operational analytics (e.g., counting how many bookings were created in a billing period).
No transfer. We do not transfer Google user data to third parties beyond the sub-processors listed in Section 5 acting on Nova Codes' behalf, and only as needed to operate the calendar integration. We do not sell Google user data.

5A.3 Storage and retention of Google data

We persist a per-owner OAuth refresh token in our encrypted token vault (Fernet AES-128 with HMAC, stored in a Fly.io volume encrypted at rest). Access tokens are obtained lazily for each request and discarded; they are never written to durable storage.
Free/busy responses are not cached beyond the lifetime of the single receptionist turn that requested them.
Events Nova Codes creates on the connected calendar carry a private extended property linking them back to the owner's GoHighLevel appointment record. We retain the Google event ID and timestamp inside our own records for booking reconciliation; we do not retain the event title, attendees, or description outside the connected calendar itself.

5A.4 Owner control — revoke and delete

You may sever Nova Codes' access to your Google Calendar at any time:

Revoke via Google — visit https://myaccount.google.com/permissions, locate "Nova Codes Calendar Connect," and click Remove access. Revocation takes effect immediately on Google's side.
Notify Nova Codes — email liam@nova.codes and ask to delete your stored refresh token. We will remove the encrypted token from our vault within five (5) business days. You will also receive a confirmation email when the deletion is complete.

After revocation, your AI receptionist will fall back to using the GoHighLevel-native calendar only; bookings will continue to land in GHL but not in your Google Calendar. You may reconnect at any time by clicking the "Connect calendar" link in your welcome email or by emailing us for a fresh link.

Events that Nova Codes created on your Google Calendar while access was active remain on your calendar after revocation — they belong to you, and Nova Codes does not delete them as part of revocation. You can delete them yourself via Google Calendar; reach out if you'd like Nova Codes to delete them on your behalf before revoking.

5A.5 Testing-mode disclosure (interim until verification clears)

While Nova Codes' Google OAuth application is undergoing verification by Google, our OAuth flow operates in Google's Testing mode. In this mode, Google issues refresh tokens that expire every seven (7) days, and Nova Codes will email you a fresh connect link before expiry so calendar access never silently lapses. Once Google completes verification, the seven-day expiry disappears and the connection becomes long-lived.

6. Data retention

Call recordings: retained for thirty (30) days after the call, then automatically deleted from our voice runtime. Call recordings written to your client sub-account follow the retention policy you configure on your GoHighLevel account.
Call transcripts and summaries: retained for as long as the client relationship is active, plus a reasonable period thereafter for billing and audit purposes (typically one year). You may request earlier deletion as described in Section 7.
Contact and lead records: retained while the client relationship is active. Cold-outreach contacts who declined our service or asked not to be contacted again are retained in our internal DNC list indefinitely to honor the opt-out.
Billing records: retained per our reasonable tax and accounting needs (typically seven years).
Google Calendar refresh tokens (Section 5A): retained while the connection is active; deleted within five (5) business days of an owner-initiated revoke request (see Section 5A.4) or automatically when our token-refresh job detects the user has revoked access via Google.

7. Your rights and choices

Depending on where you live, you may have one or more of the following rights with respect to the personal information Nova Codes holds about you:

Right of access. Request a copy of the personal information we hold about you.
Right to correct. Ask us to correct inaccurate or incomplete information.
Right to delete. Ask us to delete personal information we hold about you, subject to legal retention obligations.
Right to opt out. Opt out of future marketing or outbound outreach from Nova Codes at any time.
Right to data portability. Request a machine-readable export of personal information you provided to us.

To exercise any of these rights, email liam@nova.codes. We will respond within the timeframes required by applicable law (typically 30 days). We may need to verify your identity before fulfilling certain requests.

If you have connected your Google Calendar to Nova Codes, you can also revoke our access independently at any time via your Google account — see Section 5A.4 for the step-by-step procedure.

California residents. If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information we have collected about you, the right to know whether we have sold or shared your personal information (we have not, and we do not sell personal information), and the right to non-discrimination for exercising any of your rights. Nova Codes does not sell or share personal information for cross-context behavioral advertising.

8. Cookies and similar technologies

Our website uses cookies and similar technologies to operate the site, remember your preferences, and analyze aggregate site usage. You can disable cookies in your browser settings, though some features of the site may not work properly. We do not use cross-site tracking cookies or sell behavioral advertising data.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect the personal information we collect. These include access controls, encryption of data in transit (TLS) and at rest where supported by our vendors, multi-factor authentication on our internal systems, and routine review of our security practices. No system is perfectly secure, and we cannot guarantee that information transmitted over the internet or stored on our systems will not be accessed, disclosed, altered, or destroyed by unauthorized parties. If we become aware of a breach affecting your personal information, we will notify you in accordance with applicable law.

10. Children's privacy

Our services are intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe we have collected personal information from a child under 13, please contact liam@nova.codes and we will delete it.

11. International users

Nova Codes operates from the United States, and the information we collect is processed and stored in the United States. If you are accessing our services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may be different from those in your country.

Nova Codes does not currently market its services outside the United States.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top and, where appropriate, notify you by email or through a prominent notice on our website. Your continued use of our services after changes take effect constitutes your acceptance of the updated Policy.

13. Contact us

For privacy questions, requests, or complaints:

Nova Codes LLC 2803 E 5th St Austin, TX 78702 Email: liam@nova.codes

If you are not satisfied with our response, you may also lodge a complaint with the applicable data-protection authority in your jurisdiction.

This Privacy Policy is provided as a reasonable starting point and reflects Nova Codes' current data practices for non-HIPAA-covered local service-business clients. It is not legal advice; before publishing, an attorney should review the language for your specific jurisdiction and business model.