How we handle your data — and what we ask of the platforms we build on.

ScarlettNova is a consulting practice helping organizations adopt AI through policy, strategy, automation, and adoption support. This page describes the controls in place for this website and the way we work with client data inside engagements.

Specific client engagements are governed by the contract and any Data Processing Agreement signed for that engagement, which take precedence over the general statements below.

When you submit the contact form or the AI Readiness Assessment, we collect the name, work email, organization, role, and message you provide so we can respond to your request and send the requested report.

The on-site chat assistant stores the messages of the conversation and a randomly generated visitor identifier so it can recall context within a session. Conversation contents are not publicly readable.

We do not sell personal data. We do not use the data collected through this site for advertising profiling.

The site runs on Lovable Cloud (Supabase + Cloudflare Workers). Database access is protected by row-level security, sensitive operations run server-side with scoped service credentials, and secrets are stored in managed secret storage — never in client code.

Traffic is served over HTTPS. Email notifications are sent from a domain we control with SPF, DKIM, and DMARC configured.

• Lovable Cloud — hosting, database, authentication, edge functions.
• Cloudflare — edge runtime and CDN for the website.
• Lovable AI Gateway — model access for the on-site chat assistant.
• Email delivery — transactional email from notify.scarlettnova.ai.

Contact and assessment submissions are retained while there is an active conversation or engagement. Chat transcripts are kept to improve responses and follow up on leads. You can ask us to delete your data at any time using the contact details below; we will confirm once removal is complete.

Inside an engagement, we follow the data scope defined in the statement of work. We default to least-privileged access, work in environments you control where possible, and remove our access at the end of the engagement.

AI governance is a deliverable in most of our engagements — we are happy to share the policy templates, risk register, and model-evaluation patterns we use. See What We Do and Approach.

If you believe you have found a security issue, or want to make a privacy request (access, correction, deletion), email security@scarlettnova.ai. Please include enough detail for us to reproduce the issue and a way to reach you. We aim to acknowledge reports within one business day.

For general inquiries, use the contact page.