Privacy Policy

1. Who We Are (Data Controller)

Nova X ('we', 'us') is the data controller for the personal data processed through the novax.com platform and its mobile apps. Contact for any privacy matter: privacy@novax.com.

2. Categories of Data We Collect

• Account data: first name, last name, username, email address, password (stored only as a cryptographic hash), date of birth, gender, country, language, avatar, OAuth identifiers (Google, Apple) when you sign in with those providers.
• Content and social data: articles, forum posts, wall entries, events, reactions, follows, comments, reports, notifications, and any content you publish voluntarily.
• Dating data: your dating profile, preferences, likes, matches, profile visits, gifts sent and received, and 'hot' votes.
• Health data (special category, Art. 9 GDPR): for the Health Pass service we process blood group, rare-blood status, first-aid and medical certifications, documentary evidence you upload, and related review notes. This data is processed only with your explicit consent, protected with restricted access, two-person review and full audit trail.
• Communication data: private messages, conversations, push notification subscriptions and technical logs necessary to deliver them.
• Technical data: IP address, user agent, access logs, security events, and aggregated analytics (only with consent where required).
• Payments and crypto: wallet transactions in NVX points and TON, wallet address, transaction history, mint records for Soulbound Tokens (SBT).

3. Legal Bases for Processing

We process your data on the following legal bases: (a) performance of a contract - to provide your account and the services you signed up for; (b) legitimate interest - platform security, fraud and abuse prevention, service improvement; (c) consent - analytics, optional communications, dating features, and Health Pass health data; (d) legal obligation - accounting, tax and legally required disclosures.

4. How We Use Your Data

We use your data to: create and manage your account; provide social, forum, dating and chat services; issue and verify Health Passes; process payments and crypto transactions; keep the platform secure (2FA, rate limiting, audit logs); send service notifications; comply with law. We never use your data for automated decision-making with legal effects; matching is a purely technical function you control.

5. Cookies and Tracking

We use only essential cookies (session, authentication, language). Analytics and preference cookies require your prior consent. See our Cookie Policy for the full list and retention periods.

6. Data Sharing and Recipients

We do not sell your personal data. We share data only with: hosting and infrastructure providers; email delivery services; analytics providers (only with consent); medical reviewers for Health Pass verification; and public authorities where legally required. Aggregated, non-identifying statistics may be published.

7. Blockchain and Decentralized Services

Health Passes can be minted as Soulbound Tokens (SBT) on the TON blockchain. Data written on a public blockchain is irreversible: we only ever write the certificate type, an opaque verification code and the issue status - never your health data, identity or evidence documents. Federation (ActivityPub) may make your public profile, articles and posts visible on other servers that apply to your followers.

8. International Transfers

Some providers may be located outside the EEA. In such cases we rely on adequacy decisions or EU Standard Contractual Clauses, plus additional safeguards where needed. A copy of the safeguards is available on request at privacy@novax.com.

9. Retention

Account data is kept for the life of your account. Chat messages are kept while the conversation is active and for 12 months after. Health Pass evidence is kept for the validity of the certificate plus 24 months. Security and audit logs for 12 months. After deletion, data is removed or irreversibly anonymized within 30 days, except on-chain data which is immutable by nature.

10. Your Rights (Art. 15-21 GDPR)

You have the right to: access your data; obtain a copy in a portable format; rectify inaccurate data; erase your data ('right to be forgotten'); restrict processing; object to processing based on legitimate interest; withdraw consent at any time (without affecting prior lawful processing); lodge a complaint with your data protection authority (for Italy: Garante per la protezione dei dati personali). To exercise any right, write to privacy@novax.com; we will reply within 30 days.

11. Minors

The platform is not intended for persons under 18. Dating services require adulthood verification. If we learn that a minor's data has been collected, we delete it immediately.

12. Security Measures

We apply technical and organizational measures including encryption in transit, password hashing, two-factor authentication, role-based access control, two-person review for sensitive Health Passes, append-only audit trails, rate limiting and evidence hashing. No system is perfectly secure: if a breach is likely to result in a high risk to you, we will notify you and the supervisory authority within 72 hours.

13. Automated Processing and Profiling

We do not carry out profiling or automated decisions with legal or similarly significant effects. AI features (assistant answers) are optional tools whose output does not determine your access to services.

14. Changes to This Policy

We may update this policy to reflect changes in the service or the law. The 'last updated' date at the top shows the current version; material changes will be notified in-app before they take effect.

15. Contact

For any request or question about privacy: privacy@novax.com. You can also contact your national data protection authority.