Privacy Policy

Rova is operated by Rova Ltd, registered in England and Wales. Our service helps small businesses automate their customer communications and booking management. You can contact us at support@getrova.xyz.

When you sign up: your name, email address, and business details.

When you connect integrations: access tokens for Google Calendar, Gmail, Outlook, Stripe, and WhatsApp. These are stored encrypted and used only to operate your agents.

When your agents run: customer names, email addresses, phone numbers, and booking details that your agents process on your behalf.

Usage data: which agents you use, when actions are taken, and basic analytics to help us improve the product.

• To operate your AI agents and carry out the actions you've approved.
• To send you product updates and support communications (you can opt out anytime).
• To improve Rova's functionality and performance using only aggregated, anonymised, non-Google-user data. Google user data (Gmail, Calendar) is never used for product improvement, training, or analytics — it is used solely to operate the features you have explicitly enabled.
• We never sell your data or your customers' data to any third party.

We implement appropriate technical and organisational measures to protect your data:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using AES-256
• Google API access tokens are stored encrypted and never logged
• Access to production systems is restricted and audited
• We comply with UK GDPR data security requirements under Article 32

When Rova processes messages or bookings on your behalf, your customers' data is handled under your instruction. You are the data controller; Rova is the data processor. You are responsible for having appropriate grounds to process your customers' data and for informing them that AI-assisted tools may be used in your business communications.

Your data is retained for as long as your account is active. You can export your data at any time from Settings → Account ("Export my data"). When you cancel your account, your data is deleted within 30 days.

You have the right to access, correct, or delete your personal data at any time. To exercise any of these rights, email support@getrova.xyz. We will respond within 30 days.

We use only essential cookies required to keep you logged in and the product functioning. We do not use advertising or tracking cookies.

Rova uses the following third-party services to operate:

• Supabase (database and authentication)
• Stripe (payment processing)
• Google APIs (Calendar and Gmail integration) — Rova's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Microsoft APIs (Outlook Calendar integration)
• Meta APIs (WhatsApp, Instagram, Facebook integration)
• OpenAI and Google (AI model processing)

Each provider has their own privacy policy and data processing terms.

We may update this policy from time to time. We'll notify you by email of any significant changes. The date at the top of this page shows when it was last updated.

Rova's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Rova uses Gmail API access (read and send) solely to:

• Read incoming customer messages so our AI can draft reply suggestions for you to review and send
• Send replies on your behalf only when you explicitly approve them

Google user data is never used to train, improve, or develop AI/ML models. Rova integrates with OpenAI and Google Gemini APIs for AI features. Google Workspace user data (Gmail, Calendar) is processed only to deliver the feature you requested and is never transferred to these or any other third-party AI services for training or secondary purposes.

If you have questions about our data practices, contact us at support@getrova.xyz.

For any privacy-related questions: support@getrova.xyz.