Data & Privacy Protocol
Establishing full control over your digital infrastructure. Last Updated: February 2026
Hypernova Co builds your own AI infrastructure. We do not just process data; we ensure our partners retain 100% control over their data stack, from the logic to the compute environment. We treat your business logic as a private digital asset.
1. Our approach (DUAA 2025)
Our systems are built specifically for the UK Data (Use and Access) Act 2025 (DUAA). This ensures legal dominance through:
- Automated Decision-Making (ADM): Mandatory human oversight is built into every pilot (Human-in-the-Loop).
- your own infrastructure: We prioritize UK-based data processing to mitigate EU AI Act extraterritorial risks.
- Stop the Clock: We utilize 2025 reforms to handle complex DSAR requests without administrative penalties.
2. Technical Processors & The "No-Training" Guarantee
We operate on a Strict Opt-Out basis. Your data is processed transiently and is never used to train public models (OpenAI/Gemini).
Logic: OpenAI & Google Gemini
Processed transiently via secure APIs. We strictly employ "Zero-Retention" modes for proprietary business data.
Orchestration: Make.com (Celonis)
The system connecting your tools. Data is encrypted via TLS 1.2+ in transit through secure EU/US servers.
Xero / QuickBooks / HubSpot
Connected via secure OAuth 2.0 tokens. We never see or store your raw login credentials.
Analytics: Microsoft Clarity
Optional, consent-based session analytics. Loads only after you accept analytics cookies on the consent banner.
Scheduling: Calendly
Booking information is processed by Calendly when you schedule a free audit.
Payments: Stripe
Card payments are processed securely by Stripe. Hypernova Co never sees or stores your card details.
3. Data Retention & Security
Once a task is executed by a system, transaction-specific data is flushed from our transient logs within 30 days. We enforce 2FA and hardware-key access for all automation blueprints.
4. Cookies & Analytics
We use Microsoft Clarity for optional, consent-based session analytics. Clarity sets a first-party cookie only after you accept the on-site consent banner. You can decline at any time, and clear the cookie from your browser settings.
5. Your Rights (DSAR & Erasure)
Under the UK GDPR and the Data (Use and Access) Act 2025, you may request access, correction, or erasure of your personal data. Email [email protected] with the subject "DSAR". We respond within 30 days and do not charge for standard requests.
David
Founder, Hypernova Co
London, UK
[email protected]