Privacy Policy and Data Protection
Version 2.0 · Updated November 2026
We, at Nova, are committed to following the guidelines of Law No. 13,709/2018, better known as the Brazilian General Data Protection Law or LGPD, and to informing you about how we use your Personal Data while You use our platform and browse our website. To that end, we have prepared this Privacy Policy with all the information about our access, use, storage and other topics involving the processing of your Personal Data.
The information set out herein applies to the services provided through our website and through our platform made available via a mobile app, called the “Nova Platform”, available for use and access on electronic devices (mobile phone, tablet, computer), by UP DESENVOLVIMENTO DE TECNOLOGIA LTDA., a company registered under CNPJ/MF No. 51.709.241/0001-45, headquartered at Rua Fernão Dias, nº 323, apto. 52, bairro Pinheiros, CEP 05427-010, in the city of São Paulo, State of São Paulo (“Nova”).
To better understand how our Platform works, the protection of your Personal Data and the guarantee of your privacy, we recommend that this Privacy Policy be read together with our Terms and Conditions of Use.
If You have any questions or requests, please contact Nova through the channel privacidade@explorenova.com.br.
To make it easier for you to understand, We have divided this Privacy Policy as follows:
1. HOW DO WE COLLECT YOUR PERSONAL DATA?
2. WHAT PERSONAL DATA ARE COLLECTED AND FOR WHAT PURPOSE?
3. FOR WHAT PURPOSES ARE PERSONAL DATA USED?
4. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
5. HOW LONG DO WE STORE YOUR DATA?
6. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?
7. HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL DATA?
8. COOKIES: WHAT THEY ARE AND HOW WE COLLECT THEM
9. CHANGES TO THIS PRIVACY POLICY
10. ANY QUESTIONS?
SUMMARY:
WHO ARE WE?
UP DESENVOLVIMENTO DE TECNOLOGIA LTDA. (“Nova”) CNPJ/MF No. 51.709.241/0001-45
WHERE ARE WE LOCATED?
Rua Fernão Dias, nº 323, apto. 52, bairro Pinheiros, CEP 05427-010, in the city of São Paulo, São Paulo.
WHAT DATA DO WE USE?
Identification data: full name, CPF/RG, telephone number, date of birth, nationality, full address, indication of whether the person is a politically exposed person (PEP), e-mail and photograph, among other information;
Financial data: salary, bank details, and credit card numbers and information, among other information.
Browsing data: IP, access history, ad impressions, among others.
FOR WHAT PURPOSES?
Identification and creation of a Platform access account; Sending purchase orders to financial institutions; Maintaining essential communications with users of the Nova Platform; Issuing a virtual card; Carrying out anti-fraud measures; Promotion and Marketing; among others.
FOR HOW LONG?
As a general rule, until the purpose for which the Personal Data are used has been achieved. However, the data may also be retained (i) for the period required by law; (ii) until the end of the Processing of Personal Data at the request of the Data Subject; (iii) for the period necessary to preserve our legitimate interest, as applicable; (iv) for the period necessary to safeguard the regular exercise of rights by Nova in judicial, administrative or arbitral proceedings.
WHAT IS THE CONTACT CHANNEL?
privacidade@explorenova.com.br
Before we proceed with the information about your Personal Data, We have set out some technical terms that You may come across in this document and explain the meaning of each of them:
User or You: any person who uses the services of Nova to enjoy the features offered through the Platform under the conditions set forth in our Terms of Use and in this Privacy Policy;
National Data Protection Authority or "ANPD": the body responsible for overseeing compliance with the provisions of the LGPD within Brazilian territory;
Controller: the party responsible for decisions regarding the Processing of Personal Data, especially with respect to the purposes and means of Processing;
Processor: a natural or legal person, governed by public or private law, that carries out the Processing of Personal Data on behalf of the Controller;
Data Subject: the natural person to whom the Personal Data that are the subject of Processing refer;
Data Protection Officer: the person appointed by the Controller and the Processor to act as the channel of communication between the Controller, the Data Subjects and the National Data Protection Authority (ANPD);
Personal Data: any information relating to an identified or identifiable natural person, such as: name, CPF, RG, residential or business address, landline or mobile telephone number, e-mail address, IP address, location, among others;
Sensitive Personal Data: Personal Data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of an organization of a religious, philosophical or political nature, data concerning health or sex life, and genetic or biometric data, when linked to a natural person;
Incident(s): any accidental, unlawful or unauthorized access, acquisition, use, modification, disclosure, loss, destruction or damage involving Personal Data;
Brazilian General Data Protection Law or "LGPD": Federal Law No. 13,709/2018, which regulates the Processing of Personal Data;
Security, Technical and Administrative Measures: measures adopted that are capable of protecting Personal Data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful Processing;
Third Party: clients, partners, suppliers, client representatives or any entity that is external to Nova and whose Personal Data are processed; and
Processing: any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, deletion or destruction.
Should a new concept arise that has not been clarified, please consult Article 5 of the LGPD to learn more.
1. HOW DO WE COLLECT YOUR PERSONAL DATA?
Personal Data are processed when they are necessary to achieve the purposes mentioned in this Privacy Policy, especially to enable the provision of our services.
We at Nova may collect your Personal Data:
directly from You, as the Data Subject of such data;
from third parties, such as the partner institutions that enable the financial operations and, with your consent, institutions participating in Open Finance; or
automatically.
2. WHAT PERSONAL DATA ARE COLLECTED AND FOR WHAT PURPOSE?
We are responsible for the Processing of Personal Data of various categories arising from your access to, registration with and use of our Platform, as shown in the list below:
Registration Data; You are the Data Subject; Data provided directly by the Data Subject; Registration data include full name, CPF/RG, telephone number, date of birth, nationality, full address, indication of whether the person is a politically exposed person (PEP), e-mail and photograph. In addition to these, we may collect other information and additional answers for the purpose of identifying you.
Financial Data; You are the Data Subject; Data provided directly by the Data Subject; Bank branch, bank account number, credit and debit card banking details, among other information.
Access Logs; You are the Data Subject; Data collected automatically; IP address, date and time of access, precise or approximate geolocation, GPS data, access log, browser type, device type, hardware model, network data, operating system and browser used, among other data collected.
Data collected through Cookies and similar technologies; You are the Data Subject; Collected automatically by Us from the Data Subject’s use of the Platform. We may use Cookies and electronic device identifiers when the User uses the Platform.
2.1. PROCESSING OF PERSONAL DATA OF MINORS
The Platform is intended exclusively for persons aged 18 (eighteen) or over, and Nova does not knowingly collect or process Personal Data of children or adolescents. During registration, we verify the User’s date of birth and do not allow accounts to be opened by persons under 18 (eighteen) years of age.
If Nova identifies that an account has been opened by a person under 18 (eighteen) years of age, or that Personal Data of a minor have been collected, the account will be closed and the respective Personal Data will be deleted, except for those whose retention is required by law or regulation.
3. FOR WHAT PURPOSES ARE PERSONAL DATA USED?
We will use the Personal Data described in the item above for the following purposes and in accordance with the applicable legal basis:
Identification and creation of a Platform access account: We will use your Personal Data to identify, authenticate and individualize you on the Platform in order to grant you access to the modules.
Providing the services offered by the Nova Platform: We will process your financial and registration Personal Data to provide the services available under the Platform’s Terms of Use, including, in particular: (i) issuing a virtual card, (ii) sending purchase orders to financial institutions, (iii) carrying out anti-fraud measures, and (iv) maintaining essential communications with users via the Nova Platform, such as purchase status and promotions. When You contact us via WhatsApp, the messages are processed for customer service and for identity verification and security purposes, and may be analyzed by artificial intelligence systems that help us answer and classify requests. You may request a review of decisions made solely on the basis of automated processing, pursuant to Article 20 of the LGPD.
Promotion and Marketing: We will process your Personal Data to send you offers, notices and content related to the financial services offered by Nova.
Platform Protection and Security: We may use Access Logs and part of the Registration Data, such as photographs, to detect possible fraud and security incidents on the Platform. We may also use browsing data from your browser to improve your experience, as well as access logs to detect errors on the Platform. To confirm your identity at registration and in subsequent checks, we carry out facial recognition based on your selfie, with the support of QI Sociedade de Crédito Direto S.A. (“QI SCD”). As biometric data are sensitive personal data, this processing is based on fraud prevention and the security of the data subject in identification and registration authentication processes in electronic systems (Article 11, II, “g”, of the LGPD).
Know Your Client (“KYC”): We may process Personal Data to collect information relating to our clients and to verify whether the Data Subject’s profile is compatible with the requirements set forth in the Terms of Use of Nova. We also process, with your consent within the Open Finance environment, data on your cards and accounts to verify the ownership of the registered cards and your eligibility to use the Platform.
Compliance with Nova’s legal or regulatory obligations: We will process the User’s Personal Data to comply with our legal and/or regulatory obligations to the extent necessary. These obligations may include, for example, tax obligations, obligations regarding the maintenance of technical records, documentation of contracted services, rendering of accounts, among others.
Exercise of rights in connection with judicial and administrative proceedings: We may process your Personal Data to exercise our own rights and/or to defend our rights and interests. This may include out-of-court dealings between the parties, judicial or arbitral proceedings, administrative procedures, among others.
With respect to the other activities involving the Processing of Personal Data, the legal bases applicable to the case will be used, such as the performance of a contract or preliminary steps; compliance with legal or regulatory obligations; the exercise and defense of our rights and interests; or a legitimate interest on our part, always considering and respecting your fundamental rights and guarantees.
4. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
We may share your Personal Data with:
Partner institutions subject to the supervision of the Central Bank of Brazil (“BCB”), currently QI SCD, that assist us with opening and operating accounts, banking transactions, facial recognition and anti-fraud measures. This sharing is based on the performance of the contract with You, compliance with legal and regulatory obligations (such as customer identification and anti-money laundering obligations) and, in the case of biometric data, fraud prevention and the security of the data subject (Article 11, II, “g”, of the LGPD). If Nova enters into an agreement with a new institution, You will be notified; and
Third Party service providers engaged by Nova, such as cloud database hosting providers, messaging platforms (such as WhatsApp) and artificial intelligence providers used in customer service.
In addition to the situations already mentioned in this Privacy Policy, Personal Data may be shared with third parties in the following cases:
Regular exercise of rights through administrative, judicial or extrajudicial channels: we may share Personal Data with third parties, such as law firms, consulting firms, collection agencies, accounting firms and the like, in order to exercise our own rights or to ensure compliance with and enforcement of this Privacy Policy and the Terms and Conditions of Use;
Judicial or Administrative Request: we may share Personal Data in response to a judicial or administrative request;
Compliance with a legal or regulatory obligation: we may share Personal Data with governmental bodies, authorities and other governmental entities, as well as with private natural or legal persons, in order to comply with legal or regulatory obligations.
4.1. INTERNATIONAL TRANSFER OF PERSONAL DATA
Some of the services that Nova uses to operate the Platform, such as cloud hosting, WhatsApp and artificial intelligence tools, are located outside Brazil. As a result, your Personal Data are transferred abroad as a regular part of our operations.
In these transfers, we adopt the mechanisms provided for in Article 33 of the LGPD and in ANPD regulations, such as standard contractual clauses, to ensure a level of protection compatible with that required in Brazil.
5. HOW LONG DO WE STORE YOUR DATA?
Our responsibility is to take care of your Personal Data and to use them only for the purposes described in this Policy.
We at Nova will also store and retain your information:
for the period required by law;
until the end of the Processing of Personal Data;
for the period necessary to preserve our legitimate interest, as applicable;
for the period necessary to safeguard our regular exercise of rights in judicial, administrative or arbitral proceedings. Accordingly, we will process your data, for example, to comply with any legal, regulatory or contractual obligations, to safeguard the rights of Nova, among others.
The Processing of Personal Data will end when:
the purpose for which we collected your Personal Data has been achieved and/or the Personal Data collected are no longer necessary or relevant to achieving such purpose;
You request that we delete your Personal Data; or
there is a legal determination to that effect.
Upon the end of the Processing, the Personal Data will be deleted.
6. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?
The LGPD sets out a list of rights of the Data Subject, namely:
Confirmation of the existence of processing: Data Subjects may confirm whether Nova is processing their Personal Data;
Access to Personal Data: Data Subjects may access their Personal Data, including by requesting a copy of the Personal Data processed;
Correction of incomplete, inaccurate or outdated Data: Data Subjects may request the alteration or correction of their Personal Data that prove to be incorrect;
Anonymization, blocking or deletion: Data Subjects may request the anonymization, blocking or deletion of data that are unnecessary, excessive or processed in non-compliance with the provisions of the LGPD;
Portability: Data Subjects may request the portability of their Data through the service channels indicated in this Privacy Policy;
Deletion of Personal Data: Data Subjects may request the deletion of their Personal Data processed by Us through the service channels indicated in this Privacy Policy;
Information on sharing: Data Subjects may request information about the public and private entities with which Nova has shared their Personal Data, pursuant to this Privacy Policy;
Information on the possibility of not consenting: Data Subjects and/or parents and legal guardians should be aware that they are not required to give consent to the Processing of Personal Data if Nova requests it. This information is guaranteed by means of this Privacy Policy;
Revocation of Consent: Data Subjects may, at any time and at their discretion, revoke the Consent previously given for the Processing of Personal Data, with the processing carried out on the basis of such Consent up to that time remaining valid;
Right to petition the National Data Protection Authority (ANPD): Data Subjects may exercise their rights if their requests are not fulfilled or if the response given by the Controller has not been satisfactory, and may notify the ANPD by means of a “data subject petition”.
Exercise of your rights. You may exercise your rights by contacting us through the channel disclosed in this Policy. When you contact us, Nova may request further information or documents to substantiate your claims. However, we emphasize that there are circumstances that may restrict the exercise of certain rights provided for by law, for example, when providing the information could reveal a trade secret of Nova.
7. HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL DATA?
We are committed to the security of your Personal Data and adopt all reasonable technical and organizational measures available on the market to maintain such protection. We use security systems and take all precautions to protect your Personal Data and prevent Security Incidents.
However, no method of transmission or storage of electronic data is completely secure and free from possible external attacks. Therefore, Nova cannot guarantee the absolute security of the measures adopted or the absence of interference by third parties (such as hackers). By its nature, despite our best efforts, any security measure may fail, resulting in a possible security incident involving Personal Data. Such measures extend to the Third Parties with whom we share Personal Data, considering our absence of liability in the event of incidents, but also our care to ensure partnerships that have at least minimum good practices in information security.
8. COOKIES: WHAT THEY ARE AND HOW WE COLLECT THEM
Cookies are basically internet files that may be temporarily stored on your devices. We use cookies to facilitate your browsing on our website, adapting it to your interests and needs. They are also important for providing us with information about how our website and our services are being used, which is essential to improving our relationship.
Cookies may store certain information, such as your IP address, information about the content You view, information about the content You provide so that You do not have to type it again each time You visit our site, and your preferences and settings, as set out below:
COOKIE CATEGORY
Necessity
Necessary: Cookies used so that the site functions properly and without which You and other users would not be able to use the main service of the app.
Non-necessary: Cookies which, if disabled, do not prevent full use of the app or its proper functioning.
Purpose
Analytics: Cookies that collect information about navigation in the app for statistical purposes. In this way, we will understand how You use our Platform, the app’s error rate with users, among other information.
Functionality: Cookies that provide the basic service of the app and make it possible to remember preferences, such as your username, when You visited us, your location and your language.
Advertising/Marketing: Cookies that build your user profile based on data extracted from your browsing habits and, on that basis, are able to target advertisements and marketing to You.
Storage Period
Temporary: Cookies discarded when You leave our app by ending your session.
Persistent: Cookies that remain stored even after your session ends and that may have a defined storage period.
By using our site, You acknowledge the use of cookies in accordance with the conditions described herein. You can manage or disable cookies at any time through your browser settings, as described below.
If You do not agree to the use of these cookies, You may disable them at any time by adjusting your browser settings. Browsers differ, so please consult your browser’s settings menu for instructions on how to change your cookie preferences. If You choose not to receive cookies, our sites may not function properly and some features may become unavailable.
9. CHANGES TO THIS PRIVACY POLICY
We may revise this Privacy Policy at any time, whether due to the use of new technologies or whenever we deem it necessary. When a revision occurs, we will publish the updated version on our website with an indication of the version.
10. ANY QUESTIONS?
Should you have any questions about the Processing of your Personal Data, You may contact us through the channel privacidade@explorenova.com.br. Our Data Protection Officer is André Boulanger, who can be contacted at a.boulanger@novapaytech.com. If You have received communications from Nova or QI SCD about an account You did not open, or believe that your data have been used by third parties, write immediately to privacidade@explorenova.com.br with the subject “I do not recognize this account”. We may block the account preventively while we investigate the case, and we will respond within 15 (fifteen) days.