Book a call

Privacy Policy

Last updated: 2026-10-22

This policy explains what personal data we collect, why, and what rights you have when you use novaeon.studio or send us a request through one of our forms or an AI agent. We process your data in accordance with Regulation (EU) 2016/679 (the GDPR) and Romanian Law No. 190/2018 implementing it, as a controller established in Romania (EU).

1. Who we are

The controller responsible for processing your personal data is NOVAEON STUDIO S.R.L., a limited liability company (societate cu răspundere limitată) under Romanian law, Str. Rezervelor 56, Parter, Bl. 4, Ap. P12, Sat Dudu, Com. Chiajna, Jud. Ilfov, Romania (CUI 49517850, Reg. Com. J2024002152406). Novaeon Studio, The AI Agent Factory for AI agent consulting and engineering, is the brand of NOVAEON STUDIO S.R.L. Full company details are in the legal notice. For anything related to your data, reach us through the contact form on our site or at office@novaeon.studio.

2. What data we collect

We only collect what we need to respond to your request:

  • Contact details you provide in the contact or diagnostic form: name, email address and, optionally, phone number and company / role.
  • Details of your request, if you fill them in: the profile that best describes you, the topics you are interested in, your message, the desired timeline and a rough budget.
  • Diagnostic data, if you choose to send it: the values you enter in the cost calculator (people, hours, cost/hour, errors, waiting time, volume) and the resulting estimate.
  • Booking data, if you book a 30-minute Agent Strategy Call: your goal, area, company size and timeframe, the time slot you choose, your name, email address, company and, optionally, phone number and a message. Your browser's time zone is used only to display the times.
  • AI Agent Readiness Check: your answers are processed only in your browser and are not sent to us. We receive the result (score, level and answers) only if you book a call with the result attached, or send it to us through the contact form (the "Send me the result by email" button opens it pre-filled).
  • Your consent to be contacted, given by ticking the consent box.
  • Technical data, generated automatically with a request: the site language, submission time and browser type (user-agent). Your IP address is processed briefly for security and spam prevention (rate limiting); it is not stored with your request.
  • Requests sent by AI agents: if an AI assistant contacts us on your behalf through our agent interfaces (MCP or A2A), we receive the data it submits (name, email and the details of the request) and handle it like a form submission.
  • Chat with our assistant "Nova", if you use it: the messages you type, the site language and a technical timestamp. Nova is an AI assistant, clearly labelled as AI in the chat; it answers only from the public content of this website and can hand you over to the call booking (a booking made via the chat is marked as coming from the chat). Your IP address is used briefly for rate limiting (abuse prevention) and stored only as a salted hash with the chat log, never in clear text. Please do not enter sensitive personal data in the chat.

We do not collect sensitive data and we don't ask for information we don't need.

Separately from the website, our desktop software can, if you agree when its installer asks, send one anonymous install count (app version, macOS major version and a memory size class); we store only aggregated daily totals, never your IP address or any identifier.

3. Why we use it, and the legal basis

  • To answer your request or arrange the call you booked (including reserving the slot so it cannot be booked twice) and, where relevant, prepare a possible collaboration — steps taken at your request before a contract (Art. 6(1)(b) GDPR) and your consent, given by ticking the box (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • To answer requests sent by AI agents on your behalf — Art. 6(1)(b) GDPR, or our legitimate interest in answering inquiries addressed to us (Art. 6(1)(f) GDPR).
  • AI-supported handling of requests: requests and call bookings reach us by email at office@novaeon.studio, and an AI assistant helps us process them (for example, sorting the request, drafting the reply and preparing the call). This is part of answering your request (Art. 6(1)(b) GDPR) and of our legitimate interest in handling requests efficiently (Art. 6(1)(f) GDPR). No automated decision with legal or similarly significant effect is made; a human handles every request.
  • The chat assistant Nova: answering your questions and improving the assistant — our legitimate interest (Art. 6(1)(f) GDPR); for booking requests made via the chat, Art. 6(1)(b) GDPR, as for bookings. No automated decision with legal or similarly significant effect is made.
  • For security and abuse prevention (anti-spam, rate limiting, technical logs) — based on our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data and we do not use it for advertising.

4. How long we keep it

We keep your request or call booking and the data you sent for as long as needed to handle it, and at most 24 months after our last contact — unless a collaboration follows (then the statutory retention periods for contract documents apply) or you ask us to delete it sooner. Server and security logs are kept for at most 30 days.

Chat logs of the assistant Nova (questions and answers, with the hashed IP address) are kept for at most 30 days, only to improve the quality of its answers, and are then deleted automatically.

5. Who we share it with

We don't share your data with third parties for commercial purposes. Only the Novaeon team and the processors listed below have access to it. We use a small set of providers who help us run the service, as processors:

  • Cloudflare — website delivery, security and DNS (CDN, bot protection and the secure tunnel to our server). Every request to the site passes through Cloudflare; data may be processed in the EU and the USA.
  • Apple (iCloud Mail) — delivers the email with your request or booking to our inbox, office@novaeon.studio, and the automatic booking confirmation (with an .ics calendar file for the tentative appointment) to the email address you entered.
  • Microsoft (Teams) — the booked call takes place on Microsoft Teams; we send you the Teams invitation personally. The website itself does not create a video link.
  • Anthropic (AI assistant) — helps us process incoming requests and bookings, using its Claude models; it processes the content of your request (name, email, company, message, booking details). Data may be processed in the USA.
  • Our own server in Romania (EU) — where the site runs and where incoming requests and call bookings are stored securely. The chat assistant Nova also runs here: its language model and embedding model run on our own server in the EU, so no third-party AI provider receives the chat content (apart from transmission through Cloudflare, as with every request to the site).

We process your data in the EU (our own server in Romania). Some providers may process data outside the EU: Cloudflare, Apple (iCloud Mail), Microsoft (Teams) and Anthropic may process data in the USA. Such a transfer is safeguarded by the European Commission's Standard Contractual Clauses (SCCs) or, where the provider is certified, by the EU-US Data Privacy Framework, as applicable.

6. Your rights

Under the GDPR you have the right to: access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and to withdraw consent at any time.

You can exercise these rights through the contact form on our site or at office@novaeon.studio. If you are unhappy with how we handle your data, you have the right to lodge a complaint with our lead supervisory authority, ANSPDCP, the Romanian Data Protection Authority, or with the data protection authority of the EU country where you live or work.

7. Cookies

The site uses no tracking or advertising cookies. It only remembers your language choice in your browser's local storage. See our Cookie Policy.

8. Security

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss or disclosure.

9. Changes

We may update this policy. The version in force is the one published here, with the last-updated date shown above.

This page gives accurate information about our current practices but is not legal advice.