| Version | v1.1 — For publication |
| Effective Date | 18 September 2026 |
| Last Updated | 18 September 2026 |
| Service Provider | RSQUAD TECHNOLOGIES LLC, United Arab Emirates |
1. Who we are
Novacula is provided by RSQUAD TECHNOLOGIES LLC, a company registered in the United Arab Emirates ("RSquad", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, retain and protect personal data in connection with Novacula.
For privacy, legal and data protection requests, contact us at legal@novacula.io
For support, contact support@novacula.io
For security reports, contact security@novacula.io
Privacy requests are handled through legal@novacula.io
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed by RSquad in connection with Novacula websites, hosted online services, public RPC endpoints, account and organization functionality, documentation pages, demo scheduling, sales and business communications, billing, and support communications.
Product functionality, service eligibility, commercial terms and technical characteristics are described in the applicable Terms of Service, customer agreements and product documentation. This Privacy Policy is limited to how RSquad processes personal data.
3. Information we collect
We collect the categories of information described below. Novacula is not intended to be used as a general-purpose repository for arbitrary personal data.
3.1 Website and business contact data
When you browse Novacula websites, book a demo through Google Calendar or Calendly, contact us, or otherwise communicate with RSquad, we may process information such as your name, work email address, company, role or title, meeting details, message content, and related correspondence. Website and scheduling services may also process technical information such as IP address, browser or user-agent information, timestamps and similar connection metadata.
3.2 Sales and CRM data
RSquad uses HubSpot as a CRM. RSquad personnel currently enter business contact and sales information into HubSpot manually. This may include name, work email, company, role, correspondence, meeting notes, deal status and related sales information. Current HubSpot use does not by itself deploy HubSpot website tracking cookies or website analytics. If website tracking or other HubSpot integrations are enabled later, this Privacy Policy and the applicable cookie controls will be updated as needed.
3.3 Billing and payment data
RSquad uses Polar for checkout, billing, payment and subscription administration for applicable paid products and services. Information processed in connection with a transaction may include buyer identity and contact information, organization information where provided, product or order information, subscription identifiers, billing country, checkout data, transaction identifiers, amount, currency, payment status, tax status, refund status and related payment documentation. RSquad uses this information to administer access, provide support, reconcile payments and maintain accounting, tax and legal records.
3.4 Account, authentication and organization data
When you create or use a Novacula account, we may process account registration data, authentication data, session data, organization or workspace data, roles, invitations, access permissions and related account-management records.
- Account and profile fields: email, password hash, name, company and role/title where provided.
- Authentication and session data: password hash, session ID or token ID, login timestamp, IP address, user-agent, magic-link status, email verification status, active organization ID, impersonation metadata where applicable, and account restriction metadata such as ban status, reason or expiry where applicable.
- Credential and API metadata: API key ID, token creation date, token last-used date, token scopes or permissions and hashed token values.
- Organization and workspace data: organization name, members list, user roles, invite emails, invited role, organization ID, node types, chains and related workspace settings.
- Roles and invitations: Owner, Admin, Member and RSquad Platform Admin roles; invitation emails, inviter user ID, organization ID, invite status, invite expiry date and invited role.
- Audit events: sign-in and sign-out, password reset or change, invitations sent, accepted or revoked, role changes, member removal, suspension or restoration, organization creation or deletion, API or executor key creation or revocation, node or executor deletion and executor-release changes.
3.5 Hosted service technical data
When you use hosted Novacula functionality or connect compatible infrastructure to it, we may process technical data required to provide, monitor, secure, troubleshoot and improve the service.
- Identifiers: executor ID, agent or operator ID, organization ID, node ID, host name, RPC endpoint and IP address.
- Infrastructure metadata: cloud provider, CPU/RAM/disk capacity, storage class and network information.
- Node configuration: chain, network, node type, client, client version, resource limits, deployment configuration, ports and endpoints.
- Node status and metrics: sync status, block height, lag, peer count, CPU/RAM usage, disk usage, RPC latency, uptime or health and error status.
- Storage: control-plane inventory and observed state are stored in DigitalOcean Managed PostgreSQL; metrics and log time-series data are stored in OpenObserve within the DigitalOcean environment in Frankfurt, Germany.
3.6 Public RPC request data
When you send requests to a public Novacula RPC endpoint, we do not keep access logs of those requests. We do not store client IP addresses, request bodies, signed transaction payloads, response bodies or authorization headers, and we do not correlate wallet addresses or transactions with IP addresses.
Rate limits are enforced per API key and, for unauthenticated traffic, per endpoint. Where per-client limiting of unauthenticated traffic is enabled, the endpoint keeps short-lived in-memory counters keyed by a truncated (network-prefix) form of the client IP address. These counters are never written to disk, are not exported to logs, metrics or analytics, and are discarded when they expire or when the service restarts.
We record aggregate service metrics such as request counts per RPC method, error rates and latency. These metrics contain no IP addresses, wallet addresses or request contents. RPC traffic is not used for advertising, profiling or any purpose other than operating and securing the endpoint.
Public RPC endpoints are served directly from our own infrastructure. No third-party CDN or analytics provider sits on the request path. Signed transactions you submit are broadcast to the blockchain and become public on-chain as part of normal network operation.
3.7 Logs, audit records and support communications
We may process logs, error reports, diagnostic information, audit records and support communications to operate, secure and support Novacula.
- Application and service logs: request logs, API errors, authentication events, administrative actions, executor connection events, deployment events and similar operational records.
- Raw node logs: where enabled, an agent may transmit operational logs and raw node journal logs to the hosted logging system. Raw node journal logs may include technical information such as peer IP addresses and are not guaranteed to be secret-redacted.
- Redaction limits: structured application logs may apply key-based redaction for certain sensitive field names, but redaction is not guaranteed for free-text values or raw node journal logs.
- Support channels: support may be provided through company email, Telegram, in-app support and Slack. Support-related data may be stored in company email, Telegram, Slack and Linear.
- GitHub Issues: if GitHub Issues are used for open-source components, users should avoid posting personal data or secrets unless expressly requested through an appropriate private channel.
- Calls and meeting assistance: if a call is recorded, transcribed or processed using call-assistance tools, we will provide notice where required and may process the recording, transcript and related metadata for the stated purpose.
3.8 Information we do not intentionally collect
Novacula does not require or intentionally collect private keys, seed phrases, validator private keys, signing credentials or other means of control over blockchain assets. Users should not submit such secrets through Novacula, logs, support channels, GitHub Issues, Telegram, Slack, email or other communication channels. If users include secrets or personal data in logs, screenshots, support messages or other materials, such information may be processed as part of the relevant support, security or diagnostic workflow.
4. How we use information
- to provide, operate, maintain and secure Novacula websites, hosted online services and public RPC endpoints;
- to create and manage accounts, organizations, roles, invitations and access permissions;
- to process technical status, telemetry, configuration and diagnostics for hosted services, and to operate rate limiting and aggregate service metrics for public RPC endpoints;
- to monitor service reliability, troubleshoot issues, detect abuse, investigate incidents and maintain audit records;
- to schedule demos, manage business relationships, respond to enquiries and maintain sales and CRM records;
- to provide support and respond to legal, privacy and security requests;
- to improve product functionality, reliability, diagnostics, documentation and user experience;
- to administer checkout, billing, subscriptions, refunds, payment disputes, accounting and tax records;
- to comply with applicable legal, regulatory, sanctions, export-control, accounting, tax and security obligations.
5. Legal bases and data protection roles
Where applicable data protection law requires a legal basis, we rely on performance of a contract or steps prior to entering into a contract, legitimate interests in operating, securing and improving Novacula and conducting our business, compliance with legal obligations, and consent where required, including for non-essential cookies or marketing communications.
For website, business contact, sales, account, platform administration, security, billing and support data, RSquad generally acts as an independent controller. Where RSquad processes personal data on behalf of a customer under that customer’s documented instructions, the applicable customer agreement or Data Processing Addendum governs that processing.
6. Cookies, local storage, analytics and similar technologies
We use cookies and similar technologies for authentication, session management, security, user preferences and analytics. Current and planned production use is summarized below.
| Tool / storage | Status | Purpose and notes |
|---|---|---|
| better-auth.session_token | Enabled | Strictly necessary authentication and session cookie. Lifetime: 7 days. HttpOnly, Secure and SameSite=Lax defaults. |
| Local storage / session storage | Enabled | May store the last active organization, notification read-state and impersonation-return URL. Data may remain until cleared by the user or product logic. |
| Google Analytics | Enabled | Used for website analytics and performance measurement. Non-essential analytics cookies or identifiers are subject to consent requirements where applicable. |
| HubSpot website tracking | Not enabled | HubSpot is currently used manually as a CRM; HubSpot website tracking and cookie integration are not enabled. |
| Vercel Analytics | Not enabled | Not currently used for website analytics. |
| Retargeting / advertising pixels | Not enabled | No retargeting or advertising pixels are currently enabled. |
Where non-essential analytics or marketing cookies or similar technologies are used, RSquad provides notice and consent or preference controls where required by applicable law. The cookie information in this section forms part of this Privacy Policy; a separate cookie settings layer may be used to manage non-essential technologies.
7. Sharing information and service providers
We may share personal data with service providers, infrastructure providers, communication and support tools, analytics providers, payment and billing providers, professional advisers and authorities where necessary for the purposes described in this Privacy Policy. Providers process data under their own terms and/or contractual obligations applicable to the relevant service.
| Category | Provider / service | Region / location | Data categories / purpose |
|---|---|---|---|
| Website / online service hosting | DigitalOcean, including App Platform, Managed PostgreSQL and Spaces | Primarily Frankfurt, Germany | Website and service hosting; account, organization, technical, logging and storage data. |
| Transactional email | Resend | Provider infrastructure may vary | Email addresses, email content and delivery records. |
| Sales / CRM | HubSpot | Provider infrastructure may vary | Business contact information, correspondence, meeting notes and sales pipeline data; currently entered manually. |
| Demo scheduling | Google Calendar; Calendly | Provider infrastructure may vary | Name, email, meeting details, scheduling metadata and related communications. |
| Website analytics | Google Analytics | Provider infrastructure may vary | Website usage, device/browser and analytics identifiers, subject to applicable consent requirements. |
| Support / communications | Company email; Telegram; Slack; Linear; GitHub Issues where applicable | Provider locations vary | Support messages, attachments, issue content, technical information and related communications. |
| Billing / payments | Polar | Provider infrastructure may vary | Buyer/contact information, order/subscription data, transaction identifiers, amount/currency, tax/payment/refund status and related records. |
8. International transfers
RSquad is established in the United Arab Emirates, while core hosted infrastructure is currently located primarily in Frankfurt, Germany through DigitalOcean. Some providers used for scheduling, email, analytics, CRM, support, billing and communications may process data in other countries. Where applicable law requires safeguards for an international transfer, we use appropriate contractual or other legally recognized transfer mechanisms.
9. Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including service operation, security, diagnostics, support, accounting, tax, legal compliance and dispute resolution. Current operational retention is summarized below.
| Data category | Current retention statement |
|---|---|
| Account and organization data | No fixed automatic deletion period is currently implemented. Data is retained while the account or organization is active and as necessary for service operation, security, audit, legal and business purposes. |
| Public RPC request data | Not retained. Per-client rate-limit counters exist only in memory and are discarded on expiry or restart (see Section 3.6). |
| Technical logs and telemetry | No fixed automatic deletion period is currently implemented. Data is retained as necessary for diagnostics, reliability, security, abuse prevention and service operation. |
| Audit and security logs | No fixed automatic deletion period is currently implemented. Data is retained as necessary for security, abuse prevention, audit and dispute resolution. |
| Support and business communications | Retained as necessary to provide support, manage business relationships, maintain records, resolve disputes and improve service quality. |
| Billing, payment, accounting and tax records | Retained for the periods required or permitted by applicable accounting, tax, dispute and legal recordkeeping requirements. |
| Backups | Current backup rotation is 7 days. |
10. Your rights and deletion requests
Depending on applicable law, you may have rights to request access to, correction of, deletion of, restriction of or objection to processing of your personal data, to withdraw consent where processing is based on consent, and to receive a copy of certain data in a portable format. You may also have the right to complain to a competent data protection authority.
To exercise a privacy right, contact
legal@novacula.io
. We may need to verify your identity or authority before acting on a request. Account or organization deletion may also be available through product functionality where implemented. We may retain certain information where required or permitted for legal, security, audit, backup, accounting, tax, dispute-resolution or other legitimate purposes.
11. Security
We use administrative, technical and organizational measures designed to protect personal data processed through Novacula. Confirmed measures include role-based access controls, administrative access logging, TLS in transit, encryption at rest for database and storage, encrypted backups, logging, monitoring and alerting. No system can be guaranteed to be completely secure.
Users remain responsible for securing their own credentials, access permissions, infrastructure and operational environments and should not submit private keys, seed phrases, signing credentials or other sensitive secrets to Novacula or support channels.
12. Compliance and restricted access
We may process account, organization, usage and technical data where necessary to comply with applicable laws, sanctions, export-control requirements, anti-abuse requirements, security obligations and internal compliance policies. Access may be refused, limited, suspended or terminated where required or permitted under the Terms of Service, applicable law or RSquad compliance policies.
Service eligibility, prohibited use and access restrictions are governed by the Terms of Service and RSquad internal compliance policies. This Privacy Policy does not publish the internal country or sanctions access policy.
13. Children
Novacula is a business and developer infrastructure product and is not intended for children. We do not knowingly collect personal data from people under 18.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We may notify users of material changes through website posting, email, in-app notice or another reasonable method where practicable. The “Last Updated” date above identifies the current version.
15. Contact us
For legal, privacy or data protection requests: legal@novacula.io
For support: support@novacula.io
For security reports: security@novacula.io
Company: RSQUAD TECHNOLOGIES LLC, United Arab Emirates.