Privacy Policy

Effective date: August 4, 2026 Last updated: August 4, 2026 GreatSales AI™ is a brand and product of Novapro Lab LLC, a Florida limited liability company with its principal place of business in Broward County, Florida ("Novapro Lab," "GreatSales AI," "we," "us," or "our"). This Privacy Policy describes how we collect, use, disclose, and protect information when you visit our websites, create or use an account, subscribe to the Services, or otherwise interact with GreatSales AI™ (collectively, the "Services"). This Privacy Policy applies to information we process as the operator of GreatSales AI™. It does not apply to third-party websites, applications, or services that may link to or integrate with the Services, except as described in Section 14.

1. Scope and roles

1.1 Business customers

GreatSales AI™ is designed for use by businesses and organizations. When you register on behalf of an organization, you represent that you have authority to bind that organization to our Terms of Use and this Privacy Policy, and this Policy applies to your organization's use of the Services in addition to any separate Data Processing Addendum your organization has signed with us.

1.2 Controller and processor roles

Novapro Lab LLC is the data controller (or "business," as that term is used in certain U.S. state privacy laws) for the personal information described in Section 2 that we collect to operate our own business and the Services, such as account, billing, and website-visitor information. With respect to Customer Business Data that your organization submits about its own leads, contacts, or end customers, Novapro Lab LLC acts as a processor or service provider on behalf of your organization, which remains the controller or business for that data. Certain third parties process information on our behalf as subprocessors, as described in Section 6.1.

1.3 Customer Business Data

Information that your organization uploads, connects, or generates through the Services about its leads, contacts, appointments, sales activity, and other commercial operations is "Customer Business Data." Your organization controls this data. We process Customer Business Data only to provide the Services, in accordance with your organization's instructions (including instructions given through the Services' configuration and your Authorized Users' actions), and as described in our Terms of Use, this Privacy Policy, and any applicable Data Processing Addendum. If your organization is a GreatSales AI customer, you are responsible for ensuring that you have the notices and consents required by applicable law before you upload, connect, or otherwise submit personal information about your Contacts, leads, employees, or other individuals to the Services, as described further in Section 13.3 and Section 13.4 of the Terms of Use.

2. Information we collect

2.1 Account and authentication information

When you or your organization create or access an account, we and our authentication provider collect information such as:

• Name and email address
• Business or organization name
• Password, which is stored by our authentication provider in hashed form; we do not store plaintext passwords
• Multi-factor authentication and verification codes
• Invitation or registration tokens, for invitation-based registration
• Session and login metadata, such as sign-in timestamps

Provider: We use Clerk, Inc. to provide authentication services. Clerk processes account credentials and session data as our service provider, in accordance with Section 6.1.

2.2 Business and organization information

• Company name, business profile details, industry, service area, and stated commercial preferences you provide during onboarding
• Team member names, email addresses, and roles, when added to an account by an administrator
• Billing contact and billing address information, when provided
• Tax identification or business registration information, when provided

2.3 Customer Business Data

Depending on how your organization uses the Services, Customer Business Data may include:

• Lead and contact records, such as names, phone numbers, email addresses, notes, and status
• Appointment and calendar-related information
• Sales, pipeline, and outcome records
• Communications drafts, templates, and execution logs, where messaging or outreach features are enabled
• Metadata about connected third-party accounts, not including provider passwords, OAuth secrets, or access tokens
• Market, channel, and commercial-intelligence inputs that your organization provides or authorizes us to access

We treat Customer Business Data as confidential business information and apply tenant-isolation controls designed to keep each customer organization's data logically separated from other organizations' data.

2.4 Payment-related information

Payments for GreatSales AI™ are processed by Novapro Lab LLC through Stripe, Inc. for credit and debit card subscriptions. Stripe collects and processes payment card information under its own privacy policy. We do not store full payment card numbers on our systems. We receive payment-related information from Stripe that is typically limited to:

• Transaction identifiers and payment status
• The last four digits of a payment card, if provided by Stripe
• Billing address and payer name
• Subscription and invoice metadata

2.5 Communications and support information

• Support requests, feedback, and other correspondence you send us
• Survey responses you choose to provide
• Records of your communications with us, kept to respond to you and to maintain service quality

2.6 Device, browser, log, and usage information

When you use the Services, we automatically collect technical information, including:

• IP address
• Browser type and version, device type, and operating system
• Pages viewed, features used, and interaction events within the Services
• Referring URLs and timestamps
• Error logs and diagnostic data used to maintain and secure the Services
• Language and locale preference

2.7 Cookies and similar technologies

We use cookies, local storage, session storage, and similar technologies as described in our Cookie Policy, which is incorporated into this Privacy Policy by reference.

2.8 AI-related information

Where AI Features are enabled for your account, we may process:

• Prompts, instructions, and contextual information you or your Authorized Users submit to AI Features
• AI-generated outputs, recommendations, drafts, and analyses
• Records of approval, rejection, and execution of AI-prepared actions
• Feedback you provide on AI outputs
• Outcome and performance records used, within your organization's account, to improve the relevance of future recommendations for that same organization

Current implementation: As of the effective date of this Policy, AI Features are not, as a default and generally available capability, transmitting Customer Content to a third-party foundation model provider for inference. If and when we enable a third-party AI model provider to process Customer Content for a generally available AI Feature, we will identify that provider in the subprocessor table in Section 6.1 before that processing begins for your account, and we will describe the applicable data handling terms, including whether the provider is contractually prohibited from using your Customer Content to train its own models. We do not claim that Customer Content is, or will be, used to train GreatSales AI's own models across customer organizations; any tenant-scoped learning we perform is limited to improving recommendations for the same customer organization whose data was used, as described in Section 4.2.

2.9 Information from third-party integrations

If you connect a third-party service, such as a calendar, communications, advertising, or analytics platform, we receive the information you authorize through that connection. We do not receive or store the connected provider's OAuth secrets, refresh tokens, or access tokens in a form accessible through the customer-facing interface; those credentials are held and used server-side. Third-party services are governed by their own privacy policies, as described in Section 14.

3. Sources of information

We collect information from:

• You and the Authorized Users on your account
• Your organization's configuration and use of the Services
• Our authentication and, when live, payment processors, acting on our behalf
• Third-party services you or your organization choose to connect, with your authorization
• Automatic logging, security, and diagnostic systems
• Publicly available or licensed sources, only where your organization configures and authorizes that use for its own commercial research

4. How we use information

4.1 Provide and operate the Services

• Create and manage accounts and organizations
• Authenticate users and maintain account security
• Provide workspace features, onboarding, and plan entitlements
• Process billing once live billing is activated, as described in the Terms of Use
• Provide customer support and respond to inquiries

4.2 AI-assisted commercial intelligence and execution

• Generate recommendations, drafts, and workflow assistance within your account
• Prepare approval-ready actions within the boundaries your organization configures
• Execute an authorized action only where an Authorized User has approved it, or where your organization has configured and authorized delegated autonomy within limits, as described in Section 16 of the Terms of Use
• Maintain tenant-scoped commercial context and outcome records to improve the relevance of recommendations for your own organization over time; we do not use one customer organization's Customer Business Data to improve recommendations for a different, unrelated customer organization

4.3 Improve, secure, and maintain the Services

• Monitor performance, diagnose issues, and maintain reliability
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Develop new features and improve existing functionality, including through aggregated or de-identified analysis that does not identify an individual or a specific customer organization

4.4 Legal and compliance

• Comply with applicable law, regulation, legal process, and lawful governmental requests
• Enforce our Terms of Use and Acceptable Use Policy
• Protect the rights, property, safety, and security of Novapro Lab, our customers, and others

4.5 Marketing and administrative communications

• Send service-related notices, billing communications, security alerts, and other administrative messages necessary to operate your account
• With your consent or another lawful basis, and consistent with applicable law such as CAN-SPAM, send product updates and other informational communications; every such marketing message includes a way to opt out, and we honor opt-out requests promptly

5. Legal bases for processing (international users)

Where applicable law requires a legal basis for processing, such as for individuals in the European Economic Area, United Kingdom, or Switzerland, we rely on one or more of the following:

• Contract: processing necessary to provide the Services you or your organization requested, such as authentication, account administration, and support
• Legitimate interests: securing and improving the Services, preventing fraud and abuse, and administrative business-to-business communications, in each case only where those interests are not overridden by your rights and interests, and where you have a reasonable expectation of that processing given your relationship with us
• Consent: for optional cookies and similar technologies, and for marketing communications where consent is the applicable lawful basis under Section 4.5
• Legal obligation: compliance with a legal or regulatory obligation that applies to us

6. How we disclose information

We do not sell personal information for monetary consideration. Based on our current use of the technologies described in the Cookie Policy, which does not include cross-context behavioral advertising, advertising pixels, or audience-matching services, we do not consider our current practices to constitute a "sale" or "share" of personal information as those terms are defined under the CCPA/CPRA. If this changes, we will update this Policy and provide any legally required opt-out mechanism, including honoring the Global Privacy Control signal described in Section 10.3, before engaging in that practice. We disclose information as follows:

6.1 Service providers and subprocessors

We use the following third parties to process information on our behalf, as service providers, processors, or subprocessors, solely to provide the functions described below:

We have not identified an infrastructure hosting or cloud subprocessor to include in this table because our production hosting configuration has not been publicly finalized as of the effective date of this Policy. We will update this table with the specific hosting provider and processing location before any customer personal information is hosted in a newly finalized production environment. We do not currently use a separate third-party analytics, help-desk, or email-delivery platform beyond the providers listed above and Clerk's authentication-related email delivery; support correspondence is handled directly through the email addresses in Section 16. We require each service provider in this table to protect information under a written agreement and to use it only for the purposes we specify, consistent with applicable law. We will update this table before we add, remove, or materially change the role of a subprocessor.

6.2 Your organization and Authorized Users

Information in your account, including Customer Business Data, may be visible to administrators and Authorized Users within your organization according to the roles, permissions, and plan settings your organization configures.

6.3 Business transfers

If Novapro Lab is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, information may be transferred to the parties involved in that transaction, subject to continued protection consistent with this Policy or a policy that provides materially equivalent protection, and subject to notice to you as required by applicable law.

6.4 Legal disclosures

We may disclose information where we have a good-faith belief that disclosure is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, safety, or security of Novapro Lab, our customers, or the public, or to detect, prevent, or address fraud, security, or technical issues.

6.5 With your direction

We may disclose information at your organization's direction, including through an Integration you or your Authorized User chooses to connect and authorize, as described in Section 2.9.

7. Data retention

We retain information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. We apply the following criteria by category of information:

• Account and organization data: retained for as long as your account remains active, and, after cancellation, for the Post-Termination Access Period and deletion timeline described in Section 15.3 of the Terms of Use.
• Customer Business Data: retained under your organization's control while your Subscription is active, and deleted or de-identified following the same post-termination timeline described in Section 15.3 of the Terms of Use, except for copies retained in encrypted backups until they are overwritten or deleted in the ordinary course of our backup rotation.
• Billing and financial records: retained for the period required by applicable tax, accounting, and corporate recordkeeping law, which is generally up to seven (7) years from the date of the transaction.
• Security, access, and diagnostic logs: retained for a limited operational period that we determine is reasonably necessary for security monitoring, troubleshooting, and fraud prevention, after which they are deleted or aggregated into a form that does not identify an individual.
• AI interaction and execution records: retained for as long as reasonably necessary to provide the AI Feature, support your organization's audit and dispute-resolution needs described in Section 15.3 of the Terms of Use, and comply with Section 4.2.
• Consent records: retained as described in Section 6 of the Cookie Policy.
• Records subject to a legal hold, dispute, or investigation: retained until the hold, dispute, or investigation is resolved, regardless of the criteria above.

You may request an export of your Customer Content before deletion as described in Section 15.3 of the Terms of Use.

8. Security

We implement administrative, technical, and organizational measures designed to protect information, including access controls, tenant-isolation architecture designed to keep each customer organization's data logically separated, encryption in transit for the connections our infrastructure supports, and secure handling of credentials and provider secrets so that they are not exposed in the customer-facing interface. We do not currently claim a specific third-party security certification, such as SOC 2, ISO 27001, or a PCI DSS merchant-level certification; if we obtain such a certification, we will update this Policy to describe it accurately. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for configuring appropriate access controls and permissions within your organization.

9. International transfers

Novapro Lab LLC is located in the United States, and the Services are operated from the United States. If you access the Services from outside the United States, your information will be processed in the United States and may be processed in other countries where our service providers listed in Section 6.1 operate. Where we transfer personal information out of a jurisdiction that restricts such transfers, such as the European Economic Area, United Kingdom, or Switzerland, we rely on one or more of the following safeguards, to the extent applicable: (a) contractual confidentiality and data protection obligations we impose on our service providers; (b) participation by a service provider, such as Clerk, Inc., in the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework, to the extent that provider has self-certified under that framework; and (c) where required and not otherwise covered by (a) or (b), Standard Contractual Clauses approved by the European Commission incorporated into our agreement with the relevant service provider. We have not represented, and do not represent, that Novapro Lab itself holds a Data Privacy Framework certification; you can verify a service provider's current certification status on the U.S. Department of Commerce's Data Privacy Framework website.

10. Your privacy rights

Your rights depend on your location and the law that applies to you. We describe the general rights we make available in Section 10.1, and region-specific detail in Sections 10.3 through 10.7.

10.1 General rights

Subject to applicable law and its exceptions, you may have the right to: access the personal information we hold about you; correct inaccurate information; delete certain information; obtain a portable copy of certain information; opt out of certain processing, including any future sale, sharing, or targeted advertising; limit the use of sensitive personal information, where applicable; and appeal a denial of a request, where applicable law provides for an appeal.

10.2 How to submit a request

You may submit a privacy request by contacting us at: Email: contact@greatsalesai.com Mail: Novapro Lab LLC, Attn: Privacy, 2579 SW 81st Ter. Unit 2587, Miramar, FL 33025, United States We may need to verify your identity, using information proportionate to the sensitivity of the request, before fulfilling it. Where applicable law permits, an authorized agent may submit a request on your behalf if you provide the agent with signed permission or another form of authorization that applicable law recognizes, and we may still require you to verify your own identity directly with us. We will respond to a verifiable request within the time required by the law applicable to your request; where a law does not specify a deadline, we aim to respond within forty-five (45) days.

10.3 California residents

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to our processing of your personal information, you have the rights described below, which we make available to California residents as a matter of policy in addition to any rights that apply as a matter of law. Categories of personal information. In the preceding twelve months, we have collected the categories of personal information described in Section 2: identifiers (such as name and email address); account and commercial information (such as business profile and Customer Business Data you submit); internet or other electronic network activity information (such as the usage and log information in Section 2.6); and, where you enable AI Features, information described in Section 2.8. We do not knowingly collect sensitive personal information as a default part of the Services, as described in Section 11. Sources. As described in Section 3. Business or commercial purposes. As described in Section 4. Categories of third parties who receive personal information. The service providers listed in Section 6.1, and the other categories of recipients described in Section 6. Sale and sharing. As described in the introduction to Section 6, we do not sell or share personal information as those terms are defined under the CCPA/CPRA. Retention. As described in Section 7. Your CCPA/CPRA rights. Right to know and access the specific pieces and categories of personal information we hold about you; right to delete personal information we collected from you, subject to exceptions in the law; right to correct inaccurate personal information; right to opt out of sale or sharing (not currently applicable, since we do not engage in either practice); right to limit the use and disclosure of sensitive personal information (not currently applicable, since we do not use sensitive personal information for purposes that would trigger this right); and right to non-discrimination for exercising any of these rights. Global Privacy Control. Our website is configured to recognize and honor the Global Privacy Control (GPC) signal from a supporting browser or browser extension. Where we detect a GPC signal from a visitor who has not already made an explicit cookie choice, we treat it as a request to opt out of any sale or sharing of personal information and automatically apply the "reject non-essential" cookie preference described in the Cookie Policy, without needing you to interact with the cookie banner. Authorized agents; appeals. See Section 10.2 for how an authorized agent may submit a request. If we deny a verifiable consumer request, our response will explain how to request further review, consistent with applicable law. Minors. As described in Section 13, the Services are not directed to individuals under 18, and we do not knowingly sell or share the personal information of a minor under 16.

10.4 Other U.S. state privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive consumer privacy laws may have rights similar to those described in Section 10.1 and Section 10.3 where those laws apply to our processing, including rights to access, correct, delete, and obtain a portable copy of personal information, to opt out of processing for targeted advertising, the sale of personal information, or certain profiling, and to appeal a denied request. You may exercise these rights using the contact information in Section 10.2.

10.5 Cookie and similar technology choices

You can manage optional cookies and similar technologies at any time using the Manage privacy preferences control available on this Privacy Policy, on the Cookie Policy, and in the site footer. When you first visit and no valid consent choice is stored, we present a consent banner that lets you Accept all, Reject non-essential, or Manage preferences with equal prominence, before any optional analytics or marketing technology is activated. Withdrawing optional consent stops future optional processing through the withdrawn category and removes or expires the corresponding optional storage where technically possible. Withdrawing consent does not, by itself, delete personal information that was lawfully processed before the withdrawal, but you may separately exercise an applicable deletion right under Section 10.1. See the Cookie Policy for the category descriptions and technology inventory, and Section 10.3 for how we handle the Global Privacy Control signal.

10.6 Canada

If the Personal Information Protection and Electronic Documents Act (PIPEDA), or a substantially similar provincial private-sector privacy law, applies to our processing of your personal information, we apply the following principles, consistent with Canada's Personal Information Protection and Electronic Documents Act:

• Accountability: Novapro Lab is responsible for personal information under its control and has designated a Privacy contact, reachable using the information in Section 10.2, to respond to inquiries and complaints.
• Identifying purposes: we identify the purposes for which we collect personal information at or before the time of collection, as described in Section 4.
• Consent: we collect, use, and disclose personal information only with valid consent, or as otherwise permitted or required by applicable law, and you may withdraw consent for optional processing at any time subject to legal or contractual restrictions, using the controls in Section 10.5 or by contacting us.
• Limiting collection: we limit collection of personal information to what is necessary for the purposes we have identified.
• Limiting use, disclosure, and retention: we use and disclose personal information only for the purposes for which it was collected, except with additional consent or as required by law, and we retain it only as long as necessary to fulfill those purposes, as described in Section 7.
• Accuracy: we take reasonable steps to keep personal information as accurate, complete, and up to date as necessary for the purposes for which it is used, and you can request a correction as described in Section 10.2.
• Safeguards: we protect personal information with security safeguards appropriate to its sensitivity, as described in Section 8.
• Openness: we make information about our privacy policies and practices readily available through this Privacy Policy.
• Individual access: you may request access to the personal information we hold about you and information about how it has been used and disclosed, as described in Section 10.2.
• Challenging compliance: you may direct a question or complaint about our compliance with this Section 10.6 to the contact information in Section 10.2; we will investigate and respond to a complaint within a reasonable time.

Cross-border processing. As described in Section 9, your personal information may be processed in the United States and other countries, where it may be accessible to courts, law enforcement, and national security authorities of those countries under their applicable laws. By using the Services, you acknowledge this cross-border processing, consistent with PIPEDA's requirements for transparency about transfers to service providers outside Canada.

10.7 European Economic Area, United Kingdom, and Switzerland

If the General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection applies to our processing of your personal information, this Section 10.7 supplements Sections 1 through 9 with additional information required by those laws. Controller identity and contact. Novapro Lab LLC is the controller for the personal information described in Section 1.2. You can contact us using the information in Section 10.2. Categories of data, purposes, and legal bases. Described in Sections 2, 4, and 5. Recipients and international transfers. Described in Sections 6 and 9. Retention. Described in Section 7. Your rights. Subject to the conditions and exceptions in the GDPR, UK GDPR, or Swiss Federal Act on Data Protection, as applicable, you have the right to: access your personal information; request rectification of inaccurate personal information; request erasure of your personal information; request restriction of processing; receive your personal information in a structured, commonly used, and machine-readable format and, where technically feasible, have it transmitted to another controller (data portability); object to processing based on our legitimate interests, including profiling based on those interests; and withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may exercise these rights using the contact information in Section 10.2. Consequences of not providing data. Where we ask you to provide personal information to create an account, use a feature, or receive support, providing that information is necessary for us to perform the corresponding part of the Services; if you do not provide it, we may not be able to provide that part of the Services to you. Automated decision-making and profiling. Section 12 describes our use of automated processing, including that we do not make a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect concerning you, without human involvement, except where permitted by applicable law and subject to appropriate safeguards, including the right to obtain human intervention and to contest the decision. Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority in the EEA member state, the UK, or Switzerland where you live, work, or where an alleged infringement occurred. This right is in addition to, and does not require you to first pursue, any other remedy available to you. Representative. We have not currently appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or the UK GDPR. If our processing activities require us to appoint such a representative, we will do so and will update this Policy with that representative's contact details. Until then, you may direct an inquiry or exercise a right under this Section 10.7 directly to us using the contact information in Section 10.2. Cookies. Non-essential cookies and similar technologies are placed only with your prior consent, obtained through the mechanism described in Section 10.5 and the Cookie Policy. Children. As described in Section 13.

11. Sensitive information

We do not design the Services to intentionally collect sensitive personal information, such as government identification numbers, precise geolocation used for consumer tracking, racial or ethnic origin, health information, or similar special-category data, as a standard part of onboarding or account administration. If you choose to include sensitive personal information within Customer Business Data you submit to the Services, you are responsible for ensuring that you have an appropriate legal basis, and have provided any notices required by applicable law, for including that information.

12. Automated decision-making

GreatSales AI™ may use automated processing to generate recommendations, prioritize leads, suggest next actions, or prepare drafts, as described in Section 16 of the Terms of Use. A consequential action affecting a Contact or other individual, such as outreach, a pricing commitment, or a change to provider spending, requires human approval or properly configured and authorized delegated autonomy within limits your organization establishes, as described in Sections 16.2 and 16.3 of the Terms of Use. We do not make a decision based solely on automated processing that produces a legal or similarly significant effect on an individual without human involvement or another safeguard required by applicable law, such as the right described in Section 10.7 to obtain human intervention and contest an automated decision.

13. Children's privacy

The Services are business tools directed to organizations and to individuals who are at least eighteen (18) years old and acting in a business capacity, as described in Section 2.1 of the Terms of Use. The Services are not directed to children, and we do not knowingly collect personal information from an individual under the age of 13, or knowingly sell or share the personal information of a minor under 16. If you believe we have collected personal information from a child under 13, contact us at contact@greatsalesai.com and we will investigate and take appropriate steps to delete that information.

14. Third-party links and integrations

The Services may contain links to third-party websites, or allow you to connect a third-party platform through an Integration described in Section 2.9 and Section 14 of the Terms of Use. We are not responsible for the privacy practices of a third party. Review a third party's own privacy policy before providing it with information or authorizing it to share information with the Services.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, the Services, or applicable law. If we make a material change, we will provide notice by posting the updated Policy, updating the "Last updated" date, and, where required by law, providing additional notice, such as an email or an in-product notice, at least fifteen (15) days before the change takes effect, except where an immediate change is required to comply with applicable law or address an imminent security or legal risk. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy, except where further consent is required by applicable law, such as for a new use of optional cookies described in the Cookie Policy.

Related documents

• Terms of Use and SaaS Subscription Agreement
• Cookie Policy
• Acceptable Use Policy
• AI and General Legal Disclaimer
• Cancellation and Refund Policy