⚠️ DRAFT – needs legal review before publication

Generated from a Nova template. This is not legal advice and must not be published until a lawyer has checked it and marked it reviewed.

Missing facts to fill in: 11.

GYOP – Privacy Policy

Version 0.1.0-draft · Effective from: ⟦TO FILL: data zatwierdzenia / approval date⟧

This Privacy Policy explains how personal data is processed when you use GYOP (an app where people searching for a property and estate agents collect listings and each person's reactions and reach a shared decision), available in a web browser at https://yourownproperty.app (the "Service"). It is written to be read: every section says what we do, why, and what you can do about it.

1. Who we are

The controller of your personal data is NOVA AI VENTURES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Jasna 26, 00-054 Warszawa, Poland, entered in the register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, KRS 0001208266, NIP 5253069869, REGON 543362820, EU VAT PL5253069869, share capital PLN 156,000.00 ("NovaAI", "we", "us").

You can reach us at privacy@novaai.ventures, or by post at the address above.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the applicable Polish law.

2. Two kinds of data, two roles

When you use the Service, two kinds of personal data are processed, and our role is different for each:

1. Your account data (for example your name and e-mail address). For this data, we are the controller: we decide why and how it is processed, as described in this policy.
2. Personal data inside the content you add – property listings with links, photos and documents, needs and priorities, reactions, comments, messages to the assistant and transcripts of voice conversations and voice notes (in the Service called "Content", in this policy "User Content"), including data of other people who appear in it. For this data we are also the controller, and this policy applies to it in full.

3. What data we process

Account data

When you create an account and use the Service, we process: your e-mail address, your name or display name, the identifiers of your account and of the sign-in methods you use (if you sign in through another provider, we never receive your password for it), your language and other settings, and the history of your consents.

Technical and usage data

To run and secure the Service we process technical data: IP address, device and operating-system type and version, app version, time and type of requests, and error reports.

Payment data

When you buy something, we process data about the purchase: what you bought, when, for how much, its status and the related invoices. Card details are handled by the payment provider; we never see or store full card numbers.

User Content

You can add property listings with links, photos and documents, needs and priorities, reactions, comments, messages to the assistant and transcripts of voice conversations and voice notes. User Content may include personal data – yours and of other people, for example their names, faces or voices. You decide what you add and who can see it.

Members of your Search group

The Service lets you create or join a group (in the Service: "Search group") and invite others by e-mail or link. We process the e-mail addresses of the people you invite, their roles (Group admin, Member; in an agency: Agency admin, Agent), the invitation status, and which content is shared with whom.

4. Why we process data and on what legal basis

Giving your account data is voluntary, but without it we cannot create an account or provide the Service. Consents are always optional: refusing them does not limit the Service, and you can withdraw a consent at any time (⟦TO FILL: the consent settings screen in the app⟧) without affecting processing done before the withdrawal.

5. AI features

The Service uses artificial intelligence models to draft a listing from a link, text or screenshot, answer in chat and voice conversation, carry out actions you ask for in the app, summarise the group's reactions as insights and a compromise map, check asking prices and describe a property's area. To do this, the data needed for the specific task (for example the content you are working on) is sent to the AI model provider listed in section 6, which processes it on our instructions only to produce the result.

• Your data and User Content are not used to train or improve AI models – neither ours nor the provider's.
• AI results can contain mistakes. You decide whether to use, change or reject them.
• AI does not make decisions about you that have legal or similarly significant effects.

6. Who receives your data

We do not sell personal data. We share it only with service providers who help us run the Service and who process it on our instructions (processors), under data processing agreements required by Article 28 GDPR. The current list:

Some providers also decide themselves about part of the processing (for example a payment provider's own fraud-prevention and regulatory duties). For that part they are independent controllers and their own privacy policies apply:

We may also disclose data to public authorities when the law requires it, and to our advisers (lawyers, auditors, accountants), who are bound by confidentiality.

Content you share is visible to the people you share it with (the members of your Search group with access to it).

7. AI assistants and our team's tools

You can connect an AI assistant of your choice to your account (through the Model Context Protocol, "MCP"). The assistant acts only as you, the signed-in person: it has exactly the permissions you have in the Service, with the same limits, so it can see and change only what you can see and change yourself. Some actions are not available to it at all, for example requesting the deletion of your account. You choose the assistant; what it does with the data it receives is governed by the terms of its provider.

Administrative tools, however they are reached, are available only to authorised members of our team who need them for their work, under strict controls: personal accounts with a role that limits what each person may do, a second sign-in factor, access only from allowed network addresses, and a record of every time someone views a person's data. Deleting a person's data with these tools needs a separate, named authorisation and a reason, and the person is told about it.

8. Transfers outside the European Economic Area

Some providers listed in section 6 are based or process data outside the European Economic Area (EEA). In those cases data is transferred only with the safeguards shown in the table: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified US companies) or standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), together with additional technical measures such as encryption where needed. You can ask us for a copy of these safeguards at privacy@novaai.ventures.

9. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for:

When a period ends, the data is deleted or irreversibly anonymised. Data in backup copies is overwritten in the normal backup cycle. We may keep data longer only where the law requires it or for as long as needed to establish, pursue or defend legal claims.

10. Your rights

You have the right to:

1. access your data and get a copy of it;
2. rectify data that is wrong or incomplete;
3. erase your data ("right to be forgotten") – you can also delete your account yourself: https://yourownproperty.app/en/delete-account;
4. restrict processing;
5. data portability – receive the data you gave us in a machine-readable format;
6. object to processing based on our legitimate interest, and at any time to processing for direct marketing;
7. withdraw consent at any time, without affecting processing done before the withdrawal.

To use these rights, write to privacy@novaai.ventures. We answer within one month; in complex cases we may extend this by two further months and will tell you why within the first month (Article 12(3) GDPR). We may ask you to confirm your identity.

11. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

12. Cookies and similar technologies

The Service uses cookies and similar technologies (for example local storage in the browser or identifiers in the app). Strictly necessary ones are used without consent; all others only with your consent. Details are in the Cookie Notice: https://yourownproperty.app/en/cookies.

13. How we protect data

We use technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS) for all data in transit
• server-side access control: an agency sees only what the search group shared with it
• access to personal data only for the people who need it for their work
• deleting data within the periods described in this policy

If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay (Article 34 GDPR).

14. Supervisory authority

If you think we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority of the EU country where you live, work or where the infringement took place.

15. Children

The Service is intended for people aged at least 18. We do not knowingly create accounts for younger people; if you believe that a child has created an account, write to privacy@novaai.ventures and we will delete it. If User Content contains data of children (for example photos), the user who adds it is responsible for having a legal basis to do so.

16. Changes to this policy

We may update this policy, for example when we add a provider or a new feature. We will inform you about important changes in the Service or by e-mail before they take effect. The version and the effective date are shown at the top.

17. Contact

NOVA AI VENTURES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Jasna 26, 00-054 Warszawa, Poland Privacy questions: privacy@novaai.ventures · Support: privacy@novaai.ventures