← novoca

Privacy Policy

This is an English translation provided for convenience. The French version is the authoritative text.

Data controller: Novoca — Hugo Cossa, sole proprietor (EI), 22 rue de la Gare, 57300 Hagondange, France — hello@novoca.io. Last updated: September 15, 2026.

Data we collect

  • Creators: TikTok username, content description, product file, Stripe Connect account (managed by Stripe).
  • Buyers: email address (product delivery) and purchase amount. Payment data (card details) is processed exclusively by Stripe and never passes through our servers.
  • Interested visitors: if you leave your email address on the page of a creator whose sales are not open yet (“I want this product” button), Novoca stores that address and the shop concerned. Sole purpose: to tell the creator how many people are waiting for the product. Novoca sends you no email on this basis — neither when sales open nor otherwise. Never used for marketing, never shared with a third party. These addresses are deleted automatically 90 days after they are submitted.

Purposes

This data is used solely to operate the service: generating and hosting shops, processing payments, delivering products, and sales statistics for the creator. No data is sold or used for advertising purposes.

TikTok connection (optional)

If you connect your TikTok account (“Connect my TikTok” button), Novoca reads — with your explicit consent, through the official TikTok API — your public profile (display name, avatar, bio, follower and like counts) and the list of your public videos with their public counters (views, likes, comments, shares). Novoca never reads your messages, drafts, comment contents, or any other user’s data, and never posts on your behalf. This data is used solely to produce your analysis and recommendations. Access tokens are encrypted. Disconnecting (from the Studio or your creator dashboard, or by revoking access in TikTok’s settings) deletes the synced TikTok data; only already-produced analyses, which are aggregates, are retained.

Processors

Stripe (payments), Supabase (database and files), Vercel (hosting), Anthropic (generation of shop and product content, audience analysis), Resend (delivery emails).

What is transmitted to Anthropic, precisely:

  • Shop and product generation: the creator’s TikTok username, the public description of their content, the product’s title, format, price and pitch, the text of their sales page (headline, subheadline, benefits), the outcome the product must deliver, and the creator’s brief — the notes they write themselves, up to 4,000 characters, required before generation can start.
  • Audience analysis: the public metadata of their TikTok videos — id, title, description, hashtags and public counters (views, likes, comments, shares).
  • Reading assistant: when a buyer asks a product a question from the reader, that question and the product’s text are transmitted to produce the answer. The text of the question is never stored by Novoca.

Cookies

Novoca sets six cookies, all technical (HttpOnly: unreadable by JavaScript), first-party, never shared with an advertising third party:

  • nv_vid — anonymous visitor id, to measure site audience (visitors, page views). Retention: about 13 months.
  • nv_src — acquisition channel of your first visit (search, social, direct) and landing page, to measure which content works. Retention: 30 days.
  • nv_ref — if you arrive through a creator’s link or badge, attributes your sign-up to that creator (referral programme). Retention: 30 days.
  • nv_aff — if you buy through another creator’s affiliate link, attributes the sale to them so their commission can be computed. Retention: 14 days.
  • nv_video — if you arrive from a creator’s identified TikTok video, attributes the sale to that video for their statistics. Retention: 7 days.
  • nv_tt_oauth — set only if you start connecting your TikTok account. It carries the anti-forgery token for that request and a reminder of the shop you started from, so you are returned to it. Scoped to the /api/tiktok path, cleared at the end of the flow. Retention: 10 minutes.

None of these cookies serves advertising, and none tracks you outside novoca.io.

Retention

A shop’s data is retained for as long as the shop is online. Sales records are retained for the legally required accounting period. Email addresses submitted through “I want this product” are deleted automatically 90 days after submission.

Your rights

In accordance with the GDPR, you have the right to access, rectify, erase and port your data. Write to hello@novoca.io. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).