Last updated: May 25, 2026
This Privacy Policy explains how Noviak ("Noviak", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use our web-based content approval platform for creative and user-generated-content ("UGC") agencies (the "Service"). The Service lets registered agency users upload deliverables, generate public approval links, and receive approvals or revisions with written feedback from their clients via browser — without requiring those clients to register. Noviak is currently in public beta and is offered free of charge during this period. It is software-as-a-service accessed through a compatible web browser; we do not currently provide a standalone mobile application. We do not sell your personal data to third parties as a product. This Policy also summarizes your legal rights where applicable under laws such as the General Data Protection Regulation (GDPR).
Words with initial capital letters (e.g., "Personal Data," "Service," "You") have specific meanings defined herein. These definitions apply equally in singular or plural form.
A unique account created for You to access and use our Service.
The Noviak web application, provided by Noviak.
Any entity that controls, is controlled by, or is under common control with a party to this Privacy Policy (where "control" means ownership of 50% or more of voting securities).
Noviak, operated by Aleksa Vujisic, an individual based in Serbia, responsible for collecting and processing your data under this Privacy Policy.
A trading name (alias) used by Aleksa Vujisic for billing, checkout, and payment processing—including on Paddle receipts and account records. It is not a separate legal entity and refers to the same operator as Noviak.
Serbia (Republic of Serbia).
Any device (e.g., desktop, laptop, tablet) that can access the Service.
A person representing a creative or UGC agency who registers for an account and uses the dashboard and related features.
An individual who opens a public approval link shared by an Agency User to review deliverables and submit an approval or revision request without creating a Noviak account.
Any information that identifies or can identify a person directly or indirectly (for example name, email address, or content that clearly identifies someone when combined with other data).
The Application and any features or functionalities we provide through that Application.
Third parties that process data on our behalf to host, secure, authenticate, send transactional email, or analyze usage (for example Supabase and our email delivery provider).
Information collected automatically when you use the Service (e.g., Device type, browser, pages/screens visited, timestamps).
The individual who accesses or uses the Service.
We collect different types of information depending on whether you are an Agency User with an account, a Client Reviewer using a public link, or a visitor to our website or Service:
We collect and store your name and email address (and similar profile fields you provide) to authenticate you, operate your account, and communicate service-related messages such as responses from Client Reviewers.
Emails or messages you send to us (for example bug reports or feature requests).
When you associate a Client Reviewer or contact with deliverables or workflows, we process the identifiers you supply (typically name and email) to support invitations, reminders, attribution in the dashboard, and related features.
We store uploaded deliverables (such as videos, images, documents) and URLs or references you link for review. This content exists solely so we can provide the approval workflow—it is accessible to the uploading Agency User and to anyone the Agency User shares an active approval link with, as described in our Terms.
When a Client Reviewer submits an approval or a revision request with written feedback through a public link, we record that response, associated metadata (for example timestamps and status history), and any technical identifiers needed to correlate the submission with the correct deliverable and Agency User.
We process this usage data for security, troubleshooting, billing readiness, roadmap decisions, and to improve reliability during beta. Where you consent to analytics cookies, we also use LogRocket in production to capture session diagnostics (such as pages viewed, clicks, errors, and approximate session metadata). LogRocket may associate activity with your account email when you are signed in. See our Cookie Policy for details and how to opt out.
Client Reviewers do not normally register or log in. We may nevertheless process a limited amount of Personal Data tied to link access (such as coarse technical logs and the content they submit—feedback may itself contain personal opinions or information). The Agency User who configured the workflow is primarily responsible for ensuring they have instructed us lawfully regarding end-client data; we process such data strictly to operate the workflow and as described here.
Depending on context, we use information to:
If you are located in the EEA or Serbia, our legal bases for processing your Personal Data under the GDPR include:
Residents of the EEA (including Serbia) have the following rights:
We do not sell your Personal Data to third parties in the conventional sense of selling lists or profiles for their independent marketing. We share data only as needed to run Noviak or as required by law, as follows:
Hosts application data, authentication, and file storage for deliverables in line with our configuration. Supabase processes data on our instructions as a processor / sub-processor for infrastructure.
We use a transactional email provider (for example Resend) to send service-related messages such as notifications when a Client Reviewer responds. That provider sees recipient addresses and message content required for delivery.
When you accept analytics cookies, we use LogRocket for session replay and product diagnostics in production. LogRocket processes technical and usage data on our instructions as a processor. It runs only after consent; see the Cookie Policy.
We may add hosting, logging, support tooling, or additional vendors from time to time; when we do, we endeavor to impose appropriate data-protection terms.
If Noviak merges with or is acquired by another entity, your data may be transferred.
In case of merger, acquisition, or sale, Personal Data may be transferred as part of the transaction with prior notice.
We may disclose your Personal Data if required by law or valid legal requests.
Any other data sharing occurs only with your explicit consent.
Noviak is headquartered in Serbia. Supabase servers may be in the EU or other jurisdictions.
Transfers outside the EEA rely on:
We retain your data only as long as necessary to fulfill this Privacy Policy or as required by law:
Specific timelines may evolve during beta as we stabilize features; material changes will be reflected in updates to this Policy.
We implement technical and organizational measures:
Our Service is not intended for anyone under 13 years old. We do not knowingly collect or solicit personal information from anyone under 13. If you are a parent or guardian and you learn that your child under 13 has provided us with Personal Data, please contact us at vujsa7@gmail.com. We will promptly delete any such information in accordance with applicable law.
For EU residents under 16, verifiable parental consent is required.
We use a cookie banner on first visit so you can accept or reject non-essential cookies. You can change your choice anytime via Cookie preferences in the footer or on our Cookie Policy page.
The web app uses:
Updates will be posted with a new "Last Updated" date.
Notifications may be sent via email or displayed in-app.
You have the right to delete your account and all associated data at any time. You can do this directly from your account settings page within the Service.
Navigate to the Settings page in your account dashboard and use the "Delete Account" option. You will be asked to confirm this action before it is processed.
When you delete your account, all of your Personal Data will be permanently and immediately removed from our systems. This includes:
Once your account is deleted, we do not retain any of your Personal Data. All information is permanently removed from our servers and cannot be recovered. This deletion is immediate and irreversible.
Please note that deleting your account triggers removal or irreversible anonymization in our primary systems and instructions to subprocessors (such as Supabase and our email provider) consistent with their retention and backup cycles. If you have separate direct accounts with vendors (uncommon), you must manage those yourself.
We are not responsible for third-party websites or services linked within the Service. Review their privacy policies separately.
If you have questions or requests regarding this Privacy Policy:
We will respond as soon as possible and within statutory timeframes.
Thank you for trusting Noviak with your approvals workflow. We are committed to protecting privacy and safeguarding the deliverables and responses you rely on when collaborating with clients.