Legal

Privacy Policy

Last updated: June 2026

1. Who we are

Nova Wave Media ("we", "us", "our") provides automated Meta advertising management and analytics for Shopify store owners. This policy explains what data we collect, how we use it, and your rights regarding that data.

For any privacy-related questions, contact us at privacy@novawave.app.

2. Data we collect

Account data

When you create an account we collect your name, email address, and a hashed password. If you sign up via a third-party OAuth provider we receive only the profile fields that provider exposes.

Meta Ads data

When you connect your Meta Business account you authorise us to access your ad accounts, campaigns, ad sets, creatives, audiences, and performance metrics (impressions, clicks, spend, conversions). We access only the accounts and scopes you explicitly grant. This data is used solely to manage and optimise your campaigns on your behalf.

Shopify data

When you connect your Shopify store you authorise us to access product catalogue, order history, customer segments, and revenue data. We use this information to build audiences, match campaigns to your inventory, and generate performance reports. We do not store raw customer PII from your Shopify orders beyond what is required to compute aggregate analytics.

Payment data

Subscription payments are processed by Stripe. We never see or store your full card number, CVV, or bank details. Stripe shares with us only a payment token, billing status, and the last four digits of your card for display purposes. Stripe's own privacy policy governs how they handle your payment information.

Usage data

We collect standard server logs (IP address, browser type, pages visited, timestamps) and in-app events to monitor service health, detect abuse, and improve the product. This data is retained for a maximum of 90 days in raw form.

3. How we use your data

  • —Campaign management — creating, launching, and optimising your Meta ad campaigns based on your goals and Shopify data.
  • —Analytics and reporting — generating weekly and monthly performance reports visible on your dashboard.
  • —Audience building — constructing Custom and Lookalike Audiences on Meta using aggregated signals from your store.
  • —Billing — verifying your subscription status and sending payment receipts.
  • —Service communications — sending transactional emails (password resets, campaign alerts, report notifications).
  • —Product improvement — analysing aggregate, anonymised usage patterns to improve features.

4. We do not sell your data

We do not sell, rent, or trade your personal data or your customers' data to any third party, ever. We do not use your data to train AI models for other clients or for any purpose beyond operating this service for you.

We share data with sub-processors only where strictly necessary to deliver the service (e.g. Stripe for payments, our cloud infrastructure provider for hosting). All sub-processors are contractually bound to handle your data in compliance with applicable data protection law.

5. Data retention

We retain your account and campaign data for as long as your subscription is active, plus a 30-day grace period after cancellation to allow account recovery. After that period all personal data is permanently deleted from our systems within 30 days, except where we are required by law to retain certain records for longer.

6. Your rights and data deletion

You have the right to access, correct, export, or delete the data we hold about you. To exercise any of these rights:

  1. Email us at privacy@novawave.app with the subject line "Data Request".
  2. Include the email address associated with your Nova Wave account.
  3. Specify what you are requesting (access, export, correction, or deletion).

We will respond within 30 days. For deletion requests, once confirmed we will permanently erase your account data and revoke all Meta and Shopify API tokens we hold on your behalf.

7. Security

All data in transit is encrypted via TLS 1.2 or higher. Data at rest is encrypted using AES-256. API tokens for Meta and Shopify are stored encrypted and are scoped to the minimum permissions required. We conduct periodic security reviews and immediately revoke any credentials we suspect have been compromised.

8. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you by email at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

9. Contact

Nova Wave Media
For privacy enquiries: privacy@novawave.app