Written from what the code actually does, not from a template. If you find a difference between this page and the product, the product is the bug.
Last updated 10 August 2026.
This is what a person browsing a website that has Novvatar on it should be told. GDPR Article 13 lists what has to be here; each block below answers one of its points.
Novvatar is a tool that the owner of the website you are visiting chose to install. They decide what it is for; we only run it. In GDPR words, the site owner is the controller and Novvatar is the processor (Article 4(7) and 4(8)). If you want your data deleted, ask them; they can do it from their dashboard, and we do it for them.
| What | Why | How long |
|---|---|---|
A random id kept in your browser (novva_v) |
So that reloading a page is not counted as a new visitor | Until you clear your browser storage |
| Country and city, roughly | So the site owner knows where their visitors are | With the visit record, 400 days. Your IP address is never written to disk,
but it is sent to ip-api.com to be turned into a city name, and that
request goes over plain HTTP, not HTTPS. |
| Pages you saw, how long, which buttons you touched | To show the owner what people were looking for | With the visit record, 400 days. The address is kept whole, including anything
after the ?. |
| The topic of what you asked | Same | Same |
| A recording of your visit: where the mouse went, where you clicked and on what, how far you scrolled, and what you did with the guide (which of its buttons, which tour step, that you opened the chat and asked something) | Only if the site owner turned that on. Off by default. So the owner can see how people use their site and the guide. | 30 days, then deleted. Nothing you type is in it: not your questions, not any form. It is stored with the visit id and the page address, on our server, and only the site owner and we can play it back. |
| The words you typed | Only if the site owner turned that on. Off by default. | A period they choose, 30 days unless they change it. Emails, links, card numbers, bank accounts, ID numbers, postal addresses, phone numbers and long strings that look like a token are matched by pattern and removed before anything is written, and your visitor id is not stored next to it. Names are not removed: no pattern can tell a name from any other word, so if you type yours in a sentence it stays in the sentence. |
| A name, only if you type one when asked | So Novvatar can greet you by it | Kept in your browser until you clear it. It does not stay there: it travels with every question you ask, it goes into the prompt we send to the AI provider, and if the voice is on, the sentence that greets you by name is made by the voice provider and cached as an audio file on our server. |
No cookies and no advertising. Novvatar does not set cookies, does not track you across other sites, and does not sell anything to anyone.
We do score behaviour, and you should know it. What you do on the site, the kind of pages you open, how many questions you ask, whether you finish the tour, whether you come back another day, is added up into a number kept under your random id. If it crosses a threshold, the site owner's dashboard records it and a short alert with your country, city and the reason reaches us. Nothing is decided about you and nothing is sold, but calling that "we do not build a profile of you" would not be true: under Article 4(4) it is profiling.
To answer a question about a page, Novvatar has to read that page. Two things happen to that text before it goes anywhere:
What is kept expires after 90 days. The site owner can see it, turn it off, or erase it from their dashboard.
Three things reach the AI provider without that cleaning, and it is fairer to name them than to let the paragraph above cover everything: the address of the page you are on, whole, query string included; the text inside a region you point at, if you use "explain this"; and, in that case, an image of that region taken from your screen. An image cannot be cleaned by pattern, so it goes as it is. If you are behind a login, what is on your screen is what gets sent.
The site owner decides the lawful basis under Article 6(1). In practice it is usually (b) performance of a contract for what makes the tool work, or (f) legitimate interests for understanding what visitors need. Where they rely on (f), they must have weighed their interest against yours. If they rely on (a) consent, they must ask you first, and you can withdraw it at any time.
See the list below. We do not sell data and we do not share it beyond what is needed to make the product work.
Under Chapter III of the GDPR you can ask for access, correction, erasure, restriction, portability, and you can object. Ask the owner of the site you were visiting, because they are the controller. Be clear about what they can do today: their dashboard downloads and erases in bulk: all saved questions at once, all remembered page text at once. There is no way to look up, export or erase the records of one single person, and for saved questions there cannot be, because no visitor id is stored beside them. A request about you alone has to be handled by hand, by writing to us. You can also complain to your national supervisory authority.
If you put Novvatar on your website, you are the controller and we are your processor. GDPR Article 28(3) says our contract has to say certain things. Here they are, in the same order as the article, so you can check them off.
| Art. 28(3) | What we commit to |
|---|---|
| (a) only on your instructions | We process visitor data to run Novvatar on your site and show you your own dashboard. One exception, stated rather than hidden: when operational alerts are switched on, a short message with a visitor's country, city and page, or the reason they were scored as interested, also reaches us, so we can see the product is alive. That is our own purpose, not your instruction, and it is one of the things a lawyer has to settle before this page can be a contract. |
| (b) confidentiality | Whoever can reach the systems is bound to confidentiality. |
| (c) security (Art. 32) | Traffic over HTTPS. Your account key only works from the domains you registered. Dashboard access needs a password and a signed session that expires. Data at rest on a persistent volume with the hosting provider's encryption. Personal data is stripped out of page text before storage. |
| (d) sub-processors | The list is below and is part of these terms. We will tell you before adding one, and you can object. |
| (e) helping with visitor requests | Your dashboard erases and downloads in bulk. It cannot answer a request from one named person: there is no per-visitor lookup, export or erasure, so for that you do have to write to us and we do it by hand. |
| (f) helping with Art. 32–36 | We tell you about a breach without undue delay and give you what you need to report it. |
| (g) deletion at the end | When you close your account, your files and your visitors' records are deleted. Two honest caveats: there is no self-service button today, you ask us and we run it; and it is not instantaneous everywhere, because rotating backups keep copies for a few days and the cached audio is only cleared when the cache fills up. |
| (h) showing our work | We answer your questions about how this runs and let you audit it. |
These are the third parties involved, and what reaches them. The list is checked against
the code: probar-legal2.mjs reads every outbound call the product makes and goes
red if a provider appears there and not here.
| Who | What for | What reaches them |
|---|---|---|
| OpenAI | Writing answers and tours, and the voice | The text of the page after personal data has been stripped, and with it: the address of the page whole, the text of a region you point at as it is, an image of that region when there is one, the name you gave if you gave one, and the sentence to be spoken. Never your visitor id. |
| Anthropic (used when no OpenAI key is set) | Writing answers | The same as OpenAI above, for the same requests. |
| ElevenLabs (only if configured) | The voice | Only the sentence to be spoken, which is the sentence that greets you by the name you gave, if you gave one. |
| Railway | Hosting | Everything, because it runs there. |
| Cloudflare | Domain, traffic, and the CDN the widget loads a library from | Traffic in transit, the country code of the visitor, and, because the widget pulls
the screenshot library from cdnjs.cloudflare.com, the visitor's IP address
and the page they were on. |
| Resend | Your reports and account emails, and our own visit alerts | Your email address and the contents of the report. And, when visit alerts are on, the country, city and page of a visitor, in an email to us. |
| ntfy.sh (only if configured) | Push alert to our phone when someone is on your site | Your account name and a visitor's country, city and page, or the reason they were scored as interested. Worth knowing what this service is: a ntfy topic is a public mailbox with no account and no contract behind it, so anyone who guesses the topic name can read those alerts. |
| Lemon Squeezy | Payments | Your billing details. They are the merchant of record; we never see a card. |
| ip-api.com | City of the visitor, roughly | The IP address, to turn it into a city, sent over plain HTTP rather than HTTPS. We do not store the IP. |
ip-api.com
sends a visitor IP to a third party for a city name: worth deciding whether that trade is
worth it, because dropping it costs you one column in the dashboard.
Write to [email protected]. If you were browsing a site that has Novvatar on it, write to the owner of that site first: it is their data and their decision.