Legal

Privacy Policy

Last updated: 12 June 2026

Plain-language summary: Novisly connects to your HubSpot account to place AI phone calls when deals move, and writes the results back to your deals. We process the data needed to do that, store your VAPI key securely, and delete your data on request. We don’t sell your data.

This Privacy Policy explains how Novisly (“we”, “us”) collects, uses, and protects information when you use the Novisly application and website (the “Service”). If you have questions, contact [email protected].

1. Information we collect

Account & HubSpot connection data — your name, email, HubSpot portal ID, and OAuth tokens issued when you install the app.
HubSpot CRM data — the deal, contact and pipeline data needed to trigger and place a call (for example contact phone number, deal stage, and selected properties).
Call data — call transcripts, recordings, summaries, success evaluations, and any structured fields extracted from a conversation.
Credentials you provide — your VAPI API key, stored encrypted so we can place calls on your behalf.
Usage & technical data — log data, device/browser information, and privacy-friendly analytics about how the Service is used.

2. How we use information

To provide the Service: detect deal-stage changes, place AI calls via VAPI, and write outcomes back to HubSpot.
To operate, secure, maintain and improve the Service.
To provide support and respond to your requests.
To comply with legal obligations.

We do not sell your personal data, and we do not use your call content to train third-party models outside of delivering the Service.

3. Legal bases (GDPR)

Where GDPR applies, we process personal data under the bases of performance of a contract (to provide the Service you requested), legitimate interests (to secure and improve the Service), and consent where required. For CRM and call data processed on behalf of your organization, you are the data controller and Novisly acts as a data processor.

4. Sub-processors

We share data with the following sub-processors strictly to deliver the Service:

HubSpot, Inc. — CRM platform we read from and write to.
VAPI — the voice platform that places calls using your API key.
Our hosting/infrastructure provider — to run and store the application.

5. Data retention

We retain account and call data for as long as your account is active or as needed to provide the Service. You can request deletion at any time (see below). Where we are legally required to retain certain records, we will keep only what is necessary for that purpose.

6. Your rights & deletion

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights — including deleting your data — email [email protected] or use the deletion option in the app. Uninstalling Novisly from HubSpot revokes our access to your CRM.

7. Security

We use industry-standard measures including encryption in transit, encrypted storage of credentials, least-privilege HubSpot OAuth scopes, and access controls. No method of transmission or storage is 100% secure, but we work to protect your information.

8. International transfers

Your information may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

9. Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice.

11. Contact

Questions or requests: [email protected].

This document is provided as a starting point and should be reviewed by your legal counsel before launch to ensure it accurately reflects your data practices and applicable law.