Privacy Policy

Novalyra LLC ("Novalyra," "we," "us," or "our") operates Kovex, an AI-powered social media management platform designed for dental practices. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at kovexagent.com and use the Kovex platform (collectively, the "Service"). Please read this policy carefully. By accessing or using the Service, you agree to the terms described here. If you do not agree, please discontinue use of the Service.

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, and password (stored in hashed form). You may also provide your dental practice name, location, and professional details during onboarding.

Practice Profile Data. To generate social media content, we collect information you provide about your practice, including: clinic name, services offered, brand colors, logo, preferred tone of voice, target audience details, and scheduling preferences. We do not collect, process, or store any patient health information, protected health information (PHI), or medical records.

Social Media Account Data. When you connect your Instagram or Facebook accounts through the Meta API, we receive access tokens, page identifiers, and basic profile information for those accounts. We use this solely to publish content on your behalf.

Payment Information. All payment processing is handled by Whop, our third-party payment processor. We do not directly collect or store credit card numbers, bank account details, or other payment credentials. We receive only subscription status and plan information from Whop.

Usage Data. We automatically collect certain technical information when you use the Service, including IP address, browser type, operating system, referring URLs, pages visited, and timestamps. This data helps us understand how the Service is used and improve performance.

Cookies and Similar Technologies. We use cookies and similar tracking technologies to maintain your session, remember preferences, and gather basic analytics. See Section 7 for more details.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your account
• To generate AI-powered social media content tailored to your dental practice
• To publish approved content to your connected Instagram and Facebook accounts
• To process your subscription and manage billing through Whop
• To send transactional emails (account verification, password resets, subscription confirmations)
• To provide customer support and respond to your inquiries
• To analyze usage patterns and improve the Service
• To detect, prevent, and address technical issues or security threats
• To comply with legal obligations

We do not use your information for purposes unrelated to providing and improving the Service. We never use your practice data to train general-purpose AI models that would be accessible to other users.

3. Third-Party Services

We integrate with the following third-party services to operate the platform. Each has its own privacy policy governing its handling of your data:

Meta (Facebook/Instagram) API. When you connect your social media accounts, we interact with Meta's API to read basic page information and publish content you have approved. We request only the permissions necessary to perform these functions. Your use of Meta's services is also subject to Meta's Data Policy.

Whop. Whop processes all subscription payments. When you subscribe to Kovex, you interact directly with Whop's checkout system. We receive webhook notifications from Whop regarding subscription status but do not access your full payment details. See Whop's privacy policy for more information.

Resend. We use Resend to send transactional emails such as account confirmations, password resets, and important service notifications. Your email address is shared with Resend solely for email delivery purposes.

Vercel. Our Service is hosted on Vercel's infrastructure. Vercel may process server logs and request metadata as part of hosting operations. See Vercel's privacy policy for details on their data handling practices.

AI Service Providers. We use third-party AI APIs (such as Google Gemini and Anthropic Claude) to generate social media content and images. Practice profile data (clinic name, services, brand preferences) is sent to these providers to generate content. These providers process data according to their respective privacy policies and API terms of service, which generally prohibit using API inputs for model training.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers. With trusted third-party vendors who assist us in operating the Service (as described in Section 3), subject to confidentiality agreements.
• Legal Requirements. When required by law, regulation, legal process, or governmental request.
• Protection of Rights. When we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers. In connection with a merger, acquisition, or sale of all or a portion of our assets, in which case you will be notified of any change in ownership or use of your personal information.
• With Your Consent. When you have given us explicit permission to share your information for a specific purpose.

5. Data Security

We take the security of your data seriously. We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of sensitive data both in transit (TLS/SSL) and at rest
• Encrypted storage of social media access tokens
• Hashed and salted password storage
• Regular security reviews of our codebase and infrastructure
• Access controls limiting employee access to personal data on a need-to-know basis

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any breach in accordance with applicable law.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. If you close your account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it for legal, accounting, or regulatory purposes.

Social media content generated through the Service and published to your accounts remains on those platforms and is subject to the respective platform's data retention policies. We do not control content once it is published to Meta's platforms.

Usage logs and analytics data are retained in aggregated, non-identifiable form and may be kept indefinitely for service improvement purposes.

7. Cookies

We use the following types of cookies:

• Essential Cookies. Required for the Service to function, including session management and authentication. These cannot be disabled.
• Analytics Cookies. Help us understand how visitors interact with the Service by collecting anonymous usage data. We use basic website analytics to measure traffic and improve user experience.

We do not use advertising or tracking cookies. You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of any inaccurate or incomplete personal data.
• Deletion. Request deletion of your personal data, subject to legal retention requirements.
• Portability. Request a machine-readable copy of your data to transfer to another service.
• Restriction. Request that we limit processing of your personal data in certain circumstances.
• Objection. Object to our processing of your personal data for certain purposes.
• Withdraw Consent. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@kovexagent.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt out of the sale of your personal information (note: we do not sell personal information)
• Non-discrimination for exercising your CCPA rights

To make a CCPA request, email us at support@kovexagent.com with the subject line "CCPA Request." We will verify your identity and respond within 45 days as required by law.

10. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis. We process your data based on: (a) your consent, (b) the necessity to perform our contract with you, (c) our legitimate interests in operating and improving the Service, or (d) compliance with legal obligations.
• Data Controller. Novalyra LLC is the data controller for personal data collected through the Service.
• Right to Lodge a Complaint. You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed unlawfully.

11. International Data Transfers

Our Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from your country of residence.

By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this policy. Where required by applicable law, we implement appropriate safeguards (such as standard contractual clauses) to protect your data during international transfers.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at support@kovexagent.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email notification.

We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Novalyra LLC
30 N Gould St Ste R
Sheridan, WY 82801
Email: support@kovexagent.com