Nuvo keeps a permanent maintenance record for a home. To do that it stores your home's address, the equipment in it, the work done on it, and how to reach you.

Three things are unusual enough to state up front rather than bury:

1. The record belongs to the address and transfers to whoever owns the house next. It is designed to outlive your ownership.
2. Photographs you take of equipment data plates are kept permanently and are read by a third-party AI service (Anthropic). They are not deleted after processing.
3. The record cannot be edited or deleted. Not by you, not by us. A correction is a new entry. A person cannot currently be fully removed, except through our erasure process (see section 8).

If any of those is unacceptable to you, do not use Nuvo.

Your identity. Whichever of these you sign in with: a phone number, an email address, or a Google account. Nuvo stores your name if you give it, plus your email and/or phone as your identifiers. Nuvo does not use passwords and does not store one.

Your home. Street address, city, state, ZIP. Optionally coordinates, the county parcel number, year built, square footage, and lot size. The ZIP is also used to look up your climate zone, which drives your maintenance schedule.

Address autocomplete (when enabled). When the address-autocomplete feature is active (it requires a configured API key; it is not active by default), the characters you type into the street-address field are sent to Google, keystroke by keystroke, to look up matching address suggestions as you type. This happens whether or not you end up selecting a suggestion; typing without picking one is always allowed and never blocked. Nuvo's own server relays this lookup; the lookup key is never present in your browser. See section 5's provider table.

Your relationship to that home. Your role (owner, co-owner, manager, tenant, viewer), when it started and ended, who invited you, and whether it has been verified.

The equipment in the home. Nickname, make, model, serial number, install date, condition, where it is in the house, and a photo if you add one.

The maintenance record. For each entry: what happened, the date, who logged it, how it was evidenced (self-reported, a receipt, or a verified professional visit), a summary, the cost, the vendor's name, and any files attached (typically receipts and photographs).

Scheduled tasks. What is due, when, and whether you completed, skipped, or snoozed it.

Ownership-transfer evidence. If you claim a property, the documents you submit (a deed, settlement statement, or county record). These identify you and usually a seller.

Confirming your home. The document you upload to prove the home is yours: a deed, tax statement, mortgage statement, insurance declarations page, or closing disclosure.

Concierge requests. The task you asked about and any note you write.

Provider referrals. If you use the referral form: a company name, contact name, phone, email, and note about a service provider you already use.

Plate scans and uploaded documents. When you submit a photograph of equipment data plates or upload a document like an inspection report, Nuvo processes, stores, and sends the complete image or file to Anthropic for analysis. See sections 4 and 4b.

Operational records. Ordinary server and platform logs kept by the hosting and database providers listed in section 5 (request records, error traces, and timing). Nuvo's own scan records also store how long each AI call took and what it cost.

What Nuvo does not collect. The app runs no advertising trackers, no behavioural analytics product, and no third-party marketing pixels. There is no "sign in with Apple" — Apple is not in the data path. Nuvo does not buy data about you.

• To show you your home's record and tell you what maintenance is due.
• To identify equipment from a photograph.
• To let the people who share the home see the same record.
• To transfer the record when the property changes hands.
• To arrange service when you ask (the concierge path).
• To send you the emails described in section 6.
• To improve the accuracy of equipment identification (section 4).
• To keep the service running and secure.
• To confirm your relationship to a home before its record becomes permanent.

When you add a home to Nuvo, Nuvo confirms your relationship to that address. Until then, the data you enter is not part of the home's permanent record. The confirmation process varies by situation: if you are the departing owner initiating a handoff, confirmation is automatic when you start the transfer. If you are the new owner filing a claim, confirmation happens when a Nuvo administrator reviews your proof of ownership. In alpha, this is managed by James, who may contact you to verify information.

We use that document for the review and nothing else. Once we approve or decline it, we delete the file. We keep a record of what kind of document it was, who reviewed it, and when.

Read this section before you use the scanner.

What is captured

When you point Nuvo at an equipment data plate (the metal or sticker label on a water heater, furnace, air handler, or appliance), the app takes a photograph. These plates are typically inside your home: in a garage, closet, attic, laundry room, or behind an appliance. The photograph therefore captures whatever else is in the frame.

Before the image leaves your phone, the app:

• shrinks it (longest edge 1568 pixels) and re-encodes it as a JPEG, and
• strips the EXIF metadata, including GPS location, keeping only the orientation flag.

Nuvo does not want, and does not upload, the location coordinates embedded by your camera in a photo taken inside your house.

What is retained, and for how long

The photograph is kept indefinitely. It is not deleted after the equipment is identified.

Alongside each photograph, Nuvo permanently keeps:

• the raw output of the AI model (every field it read and how confident it was, plus a verbatim transcription of every line of text on the plate);
• the full ranked list of catalog matches Nuvo considered, including the ones it got wrong; and
• your correction (what you actually confirmed, when Nuvo's answer differed from the truth).

This is deliberate and it is enforced in the database: the tables and the storage bucket holding scan images grant no delete permission to anyone, and a trigger rejects deletion even from an administrative connection.

Why

Every correction you make is a labelled example: a human saying "that reading was wrong, here is the right one," recorded at the moment you were standing in front of the equipment. That collection is what lets Nuvo get better at reading plates over time, and eventually run its own identification model rather than sending every photograph to a general-purpose AI service.

Nuvo is telling you this plainly rather than describing it as "service improvement," because the honest description is: your photographs and your corrections become part of a training corpus that Nuvo keeps and benefits from.

Who else sees the photograph

The image is sent from Nuvo's servers to Anthropic, which operates the AI model that reads it. It is sent to identify the equipment. Nuvo's account credentials for that service stay on the server and never reach your phone or your browser.

The stored image lives in a private Supabase storage bucket. Only people with an active tenure on that property, and Nuvo administrators, can read it.

What your options are

Honest answer, as the software stands today:

• You can decline the scanner. It is optional. Every system can be added by typing the make, model, and serial number by hand, and every failure path in the scanner falls back to that same form. Nothing about the product requires you to take a photograph.
• You can control the frame. Get the plate in shot and nothing else.
• You cannot delete a scan once it is taken. There is no delete button and the database will refuse the operation. If you scan something you did not mean to scan, contact us. The remedy is manual and its limits should be understood before you rely on it.
• You cannot currently opt out of your corrections being used to improve identification while still using the scanner.

An inspection report is a document describing the systems in a home and their condition. When you upload one, Nuvo processes and stores the entire document.

What is in an inspection report

A professional home inspection report may contain:

• Interior photographs of a home, including equipment, defects, and surrounding space.
• Detailed findings on equipment condition, defects, and maintenance recommendations.
• The name of the previous owner of the property.
• The inspector's name, company name, and licence number.

What is stored and where it goes

The entire document is stored indefinitely in Nuvo's private storage. It is also sent in full to Anthropic, which operates the AI model that reads and extracts data from it.

Alongside the document, Nuvo permanently stores:

• The extraction results (the equipment identified, condition readings, and structured data Nuvo read from the report);
• Your confirmations and dismissals (what equipment you added to your property's record and what you rejected); and
• How the document was processed and when.

The inspector's personal data (name, company, and licence number) is extracted and stored for two purposes only:

• Display so you can see who performed the inspection.
• Duplicate-report detection so Nuvo does not process the same report twice.

This is the only use made of the inspector's information. It is not compiled into a lead list, used for marketing, enriched with other data, or shared outside Nuvo.

Purge path

When your account is erased (see section 8), the uploaded documents and photographs are destroyed from Nuvo's storage. The extraction results, your confirmations and dismissals, and the ledger entry remain. This is by design: removing the storage copy prevents new re-processing while preserving the record of what happened and what you chose to keep.

What this means for the inspector's privacy

An inspection report contains a third party's professional data and identifiers. Nuvo retains this information as part of the document and the extraction results.

The inspector's name, company, and licence number are used only as described above: for display and duplicate detection. They are not used to build a referral network, make recommendations, contact the inspector, or enrich inspector data with other sources. An uploaded report creates no automatic relationship between Nuvo and the inspector.

The previous owner's name, if it appears in the report, is retained as part of the original document. It is subject to the same confidentiality and access controls as the rest of the property's record.

Nuvo is a small product built on other companies' infrastructure. These are the ones in the data path:

Apple is not used. Nuvo does not offer Apple sign-in.

Nuvo does not sell your data and does not share it with advertisers.

Nuvo may also disclose data if legally required to, and would disclose it to a buyer if the business were sold.

• Sign-in codes and links, when you sign in.
• Invitations, when someone invites you to a home, or when you invite someone. An invitation email names the property and the person inviting you.
• A weekly digest, listing the maintenance that is overdue or due this week for your property. It goes to the people with an active tenure on it.

Nuvo does not send marketing email today.

• People with an active tenure on the property, according to their role. This is enforced at the database level, not just in the interface.
• The next owner of the property, once a transfer or an approved claim is executed. This is the product working as intended. See the Terms, section 4.
• Nuvo administrators. In the alpha, that means James, who reads concierge requests, reviews ownership claims, logs verified professional visits, and clears the queue of scans the software could not read.

Provider referrals are visible only to Nuvo administrators, not to other people on the property.

This section is written plainly because the honest answer is not the usual one.

Nuvo supports two paths for account deletion: account deactivation (reversible) and full account erasure (permanent).

Account deactivation

When you request account deactivation:

Your sign-in is disabled. You can no longer sign in. The sign-in identity is disabled permanently; it is not deleted, so no one else can re-register with the same email address or phone number.

Your sessions end. Any active sessions are revoked. You are signed out everywhere.

Your data is held briefly, then erased. After you delete your account, your personal details, documents, photographs, and activity records are held in a deactivated state in case you ask us to restore your account. If you do not, they are permanently erased automatically after one year at the latest. A Nuvo administrator may complete the erasure sooner.

You can still be reinstated. If you request reinstatement before your data is erased, your account can be restored and you can sign in again.

Full account erasure

When erasure is approved (either by your request during the holding period or by an administrator decision):

Your personal details are removed. Your name, email address, and phone number are cleared from both your profile and the sign-in identity. Identification is removed; accountability is retained by internal ID only.

Documents and photographs you uploaded are destroyed. Any images you submitted to the scanner, and any inspection reports or other documents you uploaded, are permanently purged from Nuvo's storage.

The home's record stays. What was serviced, when, and by whom is part of the property's history and remains for whoever owns or manages the home next. Without that record, the home's maintenance history would be worthless.

An erasure record is kept. Nuvo retains a record that an account existed, and that it was erased. This record identifies the property only, not you. It does not record any personal data.

What Nuvo cannot remove, stated plainly. The equipment-identification photographs (images of data plates you scanned) are kept indefinitely even after erasure, along with the raw AI readings and your corrections. They are not your records; they are part of Nuvo's ability to improve equipment identification over time. The database enforces these limits, not just in the software interface but structurally, with permissions and triggers that no administrator can override.

There is no self-service account closure today. To request deactivation or erasure, contact us. We will apply the mechanisms that exist and tell you honestly what we cannot do.

Access to every record is enforced in the database by row-level security tied to your tenure, not only in the app. Storage buckets holding scans and receipts are private. Server-side credentials (including the AI provider key) never reach the browser. Administrative access is limited to an explicit allowlist.

Nuvo is alpha software. No system is perfectly secure, and Nuvo has not been independently audited.

For privacy requests and questions about this policy:

Email: privacy@nuvohome.io