Privacy Policy

Novella ("we", "our", or "us") values your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit www.novellahq.com, use our application at app.novellahq.com, or otherwise interact with Novella’s customer feedback platform and public resources, including library.novellahq.com and its Libby chat assistant (the "Services").

This policy is written in accordance with the EU General Data Protection Regulation (GDPR).

1. Who we are

Novella is a customer feedback platform and a brand of Invalshoek that helps organizations collect, analyze, and act on feedback from their customers.

For feedback submitted via Novella on behalf of one of our customers, the customer is the data controller and Novella acts as a data processor.

2. Personal data we collect

We collect different types of personal data depending on how you interact with Novella.

2.1 Website visitors

When you visit our website, we may collect:

• IP address
• Device and browser information
• Pages visited and referring URLs
• Cookie and tracking data (see section 6)

2.2 Account users (customers)

If you create or use a Novella account, we may collect:

• Name
• Business email address
• Company name
• Role or job title
• Login credentials (encrypted)
• Usage data within the application

2.3 Feedback respondents

When you submit feedback via Novella (for example via email surveys or website widgets), we may process:

• Email address or other identifiers provided by the customer
• Feedback responses (e.g. NPS, CSAT, CES, open text)
• Metadata such as timestamp, page URL, device type

The exact data collected depends on how the customer configures their feedback surveys.

2.4 Libby chat assistant

Libby helps visitors find information in the Novella Library. We process the questions you submit, recent conversation messages and generated answers to provide this service. Any personal information you enter in a message may be included. You do not need a Novella account to use Libby. Please do not enter passwords, payment details, sensitive personal information or confidential customer data.

When AI answers are enabled, your question and up to six recent conversation messages are sent through Novella's server to Mistral AI, together with relevant passages from our published guides. Account profiles, customer survey responses and respondent records are not automatically included. When AI is disabled, guide search runs in your browser without sending your question to Mistral. If an AI request fails, local guide search may provide fallback passages after the request has already been sent.

Libby is an automated assistant, not a live person. Answers may be inaccurate; check the linked guides before relying on them. The current Library chat accepts text, not audio recordings.

2.5 Contacting Novella through Libby

If you choose Contact Novella in Libby, the inline form collects your name, work email, optional company name and message, together with the page URL and the source of your inquiry. Query parameters and page fragments are removed from that URL. You can choose to include up to 20 recent conversation messages; this option is off by default. The form asks for permission to process your details and message to respond to your request.

On submission, these details and any conversation you chose to include are sent to our HubSpot CRM through the Forms API. We also use Mailgun to send an internal notification to [email protected], with your email address as the reply-to address. We use this information to handle your inquiry and follow up with you. Submitting an inquiry does not subscribe you to marketing communications. Contact form details are not added to Libby's AI conversation or saved by the form in browser session storage.

3. How we use personal data

We use personal data for the following purposes:

• To provide and operate the Services, including answering questions submitted to Libby and finding relevant published guidance
• To authenticate users and manage accounts
• To collect and display feedback results
• To improve our platform and user experience
• To communicate with users about service-related matters
• To comply with legal and regulatory obligations

We do not sell personal data.

4. Legal bases for processing (GDPR)

We process personal data based on one or more of the following legal grounds:

• Performance of a contract – when data is required to deliver the Services
• Legitimate interest – to improve and secure our platform
• Consent – for marketing communications and certain cookies
• Legal obligation – where required by law

For Libby, our legitimate interests are to respond to visitors' voluntary information requests and operate and secure the assistant. You may object to processing based on legitimate interests by contacting us using the details in section 10. Optional analytics remain subject to the consent controls described in section 6.

For feedback respondents, the legal basis is determined by the Novella customer who collects the feedback.

5. Data sharing and subprocessors

We may share personal data with trusted third parties only where necessary to provide the Services, including:

• Cloud hosting and infrastructure providers
• Analytics and monitoring tools
• Email delivery services
• CRM and integration partners (e.g. HubSpot), when enabled by the customer

All subprocessors are bound by data processing agreements and comply with GDPR requirements.

Respondents are people who answer customer surveys; Novella users are account holders and workspace members who manage surveys in the application. Our subprocessor list identifies which providers process respondent data, Novella user data, website visitor data, or a combination, including technical metadata and data shared through customer-enabled integrations.

When a Novella user requests optional AI writing, description or tag suggestions in the survey creation wizard or editor, Mistral AI processes the current survey configuration needed for that request. Writing and description requests include the survey name, current question, follow-up questions, thank-you text, language, survey type, channel, scale configuration, endpoint labels and score-to-sentiment mapping. Writing requests also include the survey description as context. When saved brand context is included, writing requests also send the organisation description, audience, tone of voice and terminology/preferences from Brand settings. Users can exclude this context before generation; description and tag requests do not use it. Writing requests may also include greeting templates, navigation and feedback-button labels, comment placeholders and enabled thank-you action labels and destinations relevant to the request. Tag requests include the survey name, description, main and follow-up questions, language, type, channel, scale configuration, endpoint labels, score-to-sentiment mapping, and existing workspace tag IDs, labels and sentiments. Tag generation is a separate action from writing and description assistance.

These requests exclude respondent records, submitted responses, respondent contact fields and Novella account profile fields. Personal data entered by a user into survey configuration text or tag labels may nevertheless be included. Suggestions are presented for review and editing before the user chooses what to apply. Processing location, retention and training use depend on the applicable Mistral AI service, account settings and agreement.

Mistral AI also processes Libby questions, recent conversation context and published guide passages when AI answers are enabled, and returns generated answers. Its processing is subject to the applicable service terms and data processing agreement. Provider retention, processing location and any model-training use depend on the service, account settings and agreement; browser-tab storage does not mean that Mistral retains no data. Contact us for information about the arrangements applicable to your request.

A current list of subprocessors is available on our Subprocessors page.

6. Cookies and tracking

Novella uses cookies and similar technologies for:

• Website functionality
• Analytics and performance measurement
• Marketing and advertising (where consent is given)

Where required, we ask for your consent before placing non-essential cookies. You can manage your cookie preferences at any time.

Libby uses browser session storage to keep the recent conversation and an unfinished question available while you browse Library pages in the same tab. This history is not shared automatically across devices or Novella subdomains. Where Plausible analytics consent is accepted, we measure chat actions such as opening the assistant, submitting a question, following a guide link, and retrying a failed request. These chat events do not include question text, answer text or conversation history.

7. Data retention

We retain personal data only as long as necessary:

• Contact inquiries: submitted details, correspondence and any conversation you chose to share are retained in our CRM and team email systems for as long as needed to respond to and manage the inquiry and meet applicable legal obligations. Clearing Libby's browser history does not delete these records; contact [email protected] for deletion requests.
• Account data: for the duration of the customer relationship
• Feedback data: according to the customer’s subscription plan and configuration
• Libby browser history: up to 40 recent messages, a limited amount of recent AI context and your unfinished question are stored in the current browser tab, subject to size limits. Use the New conversation reset control to clear this local history. Session storage normally clears when the tab is closed, although browser session restoration may restore it.
• Website analytics: according to our analytics retention settings

The current Library chat backend processes messages to answer requests and does not maintain a conversation database. Technical request metadata, including IP addresses, may be processed for rate limiting, hosting and service security. Mistral's retention is separate from browser storage and depends on the applicable provider arrangements described in section 5. Resetting Libby clears local history; it does not delete information already processed by Mistral or infrastructure providers. For requests concerning that processing, contact [email protected].

Customers can request deletion or anonymization of data via their account or by contacting us.

8. International data transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

9. Security measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encrypted data storage and transmission
• Access controls and role-based permissions
• Regular security updates and monitoring

Despite these measures, no system can be guaranteed to be 100% secure.

10. Your rights

Under the GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, contact us at [email protected].

If your data was collected via a Novella customer, you may also contact that organization directly.

11. Complaints

If you believe your rights have been violated, you may lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available at:

www.novellahq.com/legal/privacy-policy

Significant changes will be communicated where appropriate.

13. Cloudflare Turnstile

We use Cloudflare Turnstile, including invisible mode where enabled, to protect our website, forms, and Services from spam, abuse, and automated activity. Turnstile may process technical information such as IP address, device and browser data, interaction data, and other signals necessary to verify whether a visitor is human and to maintain service security.

Cloudflare processes this information under its Turnstile privacy terms. For more information, please review Cloudflare's Turnstile Privacy Addendum.

14. Contact

For questions about this Privacy Policy or our data practices:

📧 [email protected]