Privacy Policy

This policy explains how [legal entity name] (“ServerNova,” “we,” “us”) handles personal information on our websites and in our services, including the Client Hub, its applications, Cloud Services, and Managed IT Services.

We play two roles:

• For our own records (your account, your organization’s account details, billing, website visits, and messages you send us), we decide how the information is used.
• For Customer Data (the records your organization stores in the Platform or on Cloud Services, such as asset inventories, employee directories, onboarding requests, and data on hosted servers), we process it on your organization’s behalf and under its instructions. Your organization’s administrators control that data, and questions about it should go to them first.

• Account information. Your name, email address, role, and organizations. An optional profile photo. Whether you last signed in with email, Microsoft, or Google. If you sign in with Microsoft or Google, we receive your basic profile from that provider, and we never see your password for those services.
• Organization details. Your organization’s name, address, website, primary contact, logo, tax exemption status and number, and, if you answer our welcome questions, how you heard about us and what you plan to use ServerNova for.
• Customer Data your organization enters. For example IT asset records, locations, and assignment history; a people directory with names, email addresses, titles, departments, locations, and optional photos; and onboarding and offboarding requests, which can include start and end dates, managers, hardware, notes, and account credentials for new staff (credentials are encrypted and every reveal is logged).
• Hosted server activity. For Cloud Services, we record sign-ins to your servers: the account name, time, type of event, and the network address it came from. We also record update and backup status for your servers.
• Credentials we manage for you. Under Managed IT Services, ServerNova staff may store credentials for your systems in our credential vault. They are encrypted, and every reveal, copy, or share is logged with who did it and when.
• Documents and signatures. When you sign a document through the Platform, we record your name, email address, network address, device information, the signature itself, and timestamps, as part of the signature record. When you acknowledge a knowledge base article, we record the time, your network address, and your browser information.
• Billing information. Paid services are billed through our billing provider and payments are processed by our payment processor. We receive your plan, invoices, and payment status. We do not receive or store full card numbers.
• Messages to us. What you send through our contact form (name, email, company, topic, and message) and support requests.
• Usage and technical information. Sign-in and security events, actions recorded in your organization’s activity feed, knowledge base searches, technical logs, and page performance measurements (such as how quickly pages load), collected to keep the services secure and working.
• Security checks. Our sign-up, sign-in, and password reset forms use a bot check that may collect technical information about your browser and device.

• to provide, operate, secure, and support the services;
• to sign you in, and to enforce the roles and permissions your organization sets;
• to bill for paid services and keep required business records;
• to respond to requests and send service messages, such as security alerts when a sign-in email changes;
• to audit sensitive actions, such as credential reveals and document signing;
• to diagnose problems and improve reliability.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your information to train artificial intelligence models.

We share information only with service providers that help us run the services, under contracts that limit how they use it:

We may also disclose information if required by law, to protect the services and their users, or as part of a merger, acquisition, or sale of assets. In that case this policy continues to apply to information collected before the transfer.

• Asset labels. If your organization prints QR labels for its assets, anyone who scans a label can see the asset’s details, including the name, title, and department of the person it is assigned to, and your organization’s name.
• Images. Profile photos, people directory photos, organization logos, and images in knowledge base articles are stored at addresses that anyone with the address can open.

We use a small number of cookies and browser storage entries, all to run the services. We do not use advertising or cross-site tracking cookies. Page performance measurement does not use cookies.

• Data is encrypted in transit and at rest.
• Stored credentials and new-staff credentials are encrypted with AES-256-GCM using separate keys, and every reveal is logged.
• ServerNova staff accounts require an authenticator app to sign in.
• Every request is checked against the signed-in user's organization and permissions, with database policies as an additional safeguard.
• Sensitive actions are logged and auditable.

No system is perfectly secure. If we learn of a breach affecting your information, we will notify affected organizations and people as required by law.

When an organization is deleted by its owner in the Platform, its records are deleted immediately and cannot be recovered. When an account ends another way, your organization may request an export for 30 days, after which we may delete its data, except records we must keep.