Hova Enterprise Privacy Policy

This Privacy Policy explains how Hova ('we', 'us', 'our') collects, uses, protects, and handles customer data in our multi-tenant SaaS platform architecture. We are committed to strict tenant data isolation, zero cross-tenant data leakage, and compliance with global data privacy frameworks including GDPR, CCPA/CPRA, and HIPAA.

1. Multi-Tenant Architecture & Data Isolation

Hova is designed ground-up as a multi-tenant enterprise system. Each tenant organization operates inside a logically segregated data boundary with dedicated cryptographic keys, database row-level security (RLS), and schema isolation.

Customer data is strictly segregated by Tenant ID and encrypted at rest using AES-256 GCM.
Cross-tenant data access is programmatically impossible and prevented at the database and application API routing layers.
Tenant administrators have exclusive management capabilities over their organization's identity providers and user directory.

2. Information We Collect

We collect minimal necessary personal and organizational data required to deliver high-availability cloud services:

Account & Identity Data: Work email address, full name, job title, and SSO identity provider metadata (e.g. SAML assertions, OIDC tokens).
Tenant Configuration Data: Workspace name, tenant slug, custom branding assets, and security preference configurations.
System Telemetry & Audit Logs: IP addresses, access timestamps, API calls, browser user-agent strings, and diagnostic telemetry for compliance auditing.

3. How We Use Your Information

Information collected is strictly utilized to operate, secure, and maintain your tenant instance. We NEVER sell, monetize, or train AI foundation models on customer tenant data without explicit opt-in agreements.

Providing authenticated access to your tenant workspace.
Executing multi-factor authentication (MFA) and single sign-on (SSO) routines.
Generating automated security logs and administrative audit traces.
Delivering platform performance alerts and platform health monitoring.

4. Data Retention & Deletion

Tenant data is retained for the duration of the active subscription agreement. Upon tenant offboarding or explicit deletion request by a verified Tenant Admin, data is wiped in accordance with NIST 800-88 guidelines within 30 days.

5. Compliance & Rights (GDPR / CCPA / CPRA)

Depending on your geographic location, individual users and tenant organizations possess statutory rights regarding personal data processing:

Right to Access & Data Portability: Export tenant data in machine-readable JSON/CSV formats at any time.
Right to Erasure ('Right to be Forgotten'): Request permanent deletion of user profile logs.
Right to Object & Restrict Processing: Manage telemetry collection preferences directly within tenant settings.