This policy explains how NovaBranch Pte. Ltd. ("we", "us") collects, uses and protects personal data when you use NovaUnit: the resident app for iPhone and Android, the management portal at admin.novaunit.co, and this website.
By registering for or using NovaUnit, you agree to the collection and use of information as described in this policy.
1. Who we are
NovaUnit is developed and operated by NovaBranch Pte. Ltd., a company incorporated in Singapore. Questions about this policy: privacy@novabranch.co.
Your building's management corporation (MCST) and its managing agent decide how they use NovaUnit for their building, for example which records they keep in it. For those records we act on the building's behalf.
2. Information we collect
- Account information: full name, email address, phone number (optional), unit number and building.
- Service requests: descriptions, categories, and any photos or videos you attach, and the conversation with your building's management.
- Facility bookings: facility, date and time, fees, deposits (including any amount refunded or kept, and the reason management gives) and booking status. Other residents see only that a time slot is taken, never who booked it.
- Applications: access item (for example keycard), move-in and renovation applications, the documents you upload with them (for example contractor details or permits), and related fees and deposits.
- Community noticeboard posts: post content, category, photos, any contact number you choose to add, and your unit. Posts are visible to verified residents of your building.
- Announcement read status: which residents have read each announcement. Your building's management can see this.
- Ask the Building: the questions you ask the building assistant in the app. They are kept without your name or account, so management can see which questions it couldn't answer.
- Building finance records (if your building uses NovaUnit Finance): owner name, email and mailing address, share value, levies and other charges, payments received (amount, date and reference), and arrears notices. We do not collect card numbers or online banking credentials.
- Device information: a Firebase Cloud Messaging token used to send push notifications to your phone.
- Crash and diagnostic data: Firebase Crashlytics crash reports (device model, OS version, app version and the steps leading to the crash), linked to your account's internal user ID and your building's ID (not your name or email).
- Demo requests: if you ask for a demo on this website: your name, company, email, phone (optional), building size and message, plus a scrambled (hashed) form of your IP address and your browser type, used only to block spam.
We do not collect government identification numbers or sensitive personal data as defined under Singapore's Personal Data Protection Act (PDPA).
3. How we use your information
We use personal data only to provide and improve NovaUnit:
- to create and manage your account, and verify your unit when you register
- to process service requests, bookings and applications
- to let you and your building's management communicate
- to send push notifications about your requests, bookings, applications and building announcements
- to keep your building's records, such as levies and payments, when the building uses those features
- to provide the AI features described in section 4
- to diagnose crashes and fix problems in the app
- to reply to demo requests
We do not use personal data for advertising or profiling, and we do not sell it.
4. AI features
Some NovaUnit features use artificial intelligence. They are switched on per building (by NovaUnit, at the building's request), and AI features are marked for the people who use them: insights carry an AI tag, and suggested replies are marked as AI drafts.
- Ask the Building answers residents' questions using only the information and documents management chooses to share with residents.
- For management: suggested replies to requests, answers from the building's documents, reading uploaded documents and contracts, nightly insights from recent requests, report summaries, and drafting and reading emails with vendors when the building asks for quotations.
To do this, the relevant content (for example a question, a request and its conversation, or a building document) is sent to Google Cloud's Vertex AI and processed in the United States. Under Google Cloud's terms, Google does not use this data to train its AI models without our permission. Google may keep it for a short time to run the service: briefly for caching, and for up to 30 days for abuse monitoring.
AI output can be wrong. Drafts are reviewed by a person before they are sent (except quotation requests when a building has switched on one-click sending), and Ask the Building tells residents to contact management for anything it can't answer.
5. Data sharing
- Your building's management: the MCST and its managing agent can see your name, unit, contact details, requests, bookings, applications and announcement read status, and use them to manage the building.
- Other residents (community posts only): what you post on the noticeboard is visible to verified residents of your building.
- Vendors: when management requests quotations through NovaUnit, the emails describe the work needed. Management reviews each email before it is sent, unless the building has switched on one-click sending for quotation requests.
- Google: we use Firebase and Google Cloud for sign-in, database and file storage, server functions, push notifications, crash reporting and AI (Vertex AI).
We do not share personal data with any other third parties for commercial purposes. We may disclose information if the law requires it.
6. Where your data is stored
NovaUnit runs on Google Cloud. The database is stored in Google's United States region; photos, videos and documents are stored in Singapore; the server functions and the AI features run in the United States. When data is transferred outside Singapore, we rely on Google's contractual commitments to protect it to a standard comparable to the PDPA.
7. Separation between buildings
Each building's data is kept separate. Residents of one building cannot see another building's data, and management accounts can only access the building they are authorised to manage.
8. Retention
We keep personal data while your account is active or as needed to provide NovaUnit. You can delete your account at any time from the Profile tab in the app; your personal data is removed within 30 days, together with photos and videos you attached to requests and posts. Your building's own records stay with the building without your name: past bookings and their payments, and applications (for example renovation permits and the documents filed with them). Records your building must keep by law, such as its financial records, are kept for as long as the law requires.
9. Your rights
Under the PDPA you can ask to access or correct your personal data, withdraw consent (subject to legal and contractual limits) and ask for deletion. Email privacy@novabranch.co; we reply within 30 days. For records your building keeps, we may refer your request to its management.
10. Push notifications
You can turn off NovaUnit notifications at any time in your phone's settings. The app keeps working without them.
11. Children
NovaUnit is not intended for anyone under 18. We do not knowingly collect personal data from children; if you think a child has given us personal data, contact us and we will delete it.
12. Security
- encrypted connections (HTTPS/TLS)
- security rules that limit every record to the people allowed to see it
- separate access for residents, building management and NovaUnit staff
- an audit trail of changes to finance records
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
13. Third-party services
- Firebase (Google LLC): authentication, Firestore database, Cloud Storage, Cloud Functions, Cloud Messaging and Crashlytics. Firebase privacy
- Google Cloud Vertex AI (Google LLC): the AI features in section 4. Google Cloud data processing terms
- Porkbun: hosts the rfq@novaunit.co mailbox that sends quotation requests to vendors and receives their replies.
14. Changes to this policy
We will update the date at the top when this policy changes, and tell you through the app or by email if the changes are significant.
15. Contact
NovaBranch Pte. Ltd., Singapore
privacy@novabranch.co · novabranch.co