Legal
Privacy Policy
This Privacy Policy explains how Novaclad LLC, a Missouri limited liability company ("Novaclad," "we," "us"), collects, uses, shares, and protects personal information when you use the Novaclad mobile app, the novaclad.com website, and related features (together, the "Service"). It applies to the app and the website alike.
The Service is offered only in the United States to individuals 18 or older.
At a Glance
| What we collect | Your name and email, the measurements and photos you capture, your material and design choices, your project location, and basic device and usage data. |
| Why | To generate your estimate, to connect you with a fabricator, to operate and secure the Service, and to improve our measurement and pricing technology. |
| Who we share it with | The fabricator or retail partner handling your project, and the service providers listed in Section 5. Rock Creek Granite, our St. Louis fabricator, is a separate company under common ownership with Novaclad — see Section 6. |
| AI processing | Your photos and geometry are processed by Anthropic's Claude models to detect features and write your scope of work. |
| Selling data | We do not sell your personal information for money and we do not share it for cross-context behavioral advertising. Sending your project to a fabricator may still count as a "sale" under state privacy law — see Section 8.3, which explains how to opt out. |
| Advertising | None. We run no ad network and no ad tracking. |
| De-identified data | We keep and use de-identified, aggregated data derived from scans to improve our technology. This survives account deletion. See Section 7. |
| Your controls | Access, correct, delete, and port your data; delete your account in-app at Settings → Delete Account; limit use of precise location. See Section 9. |
| Contact | privacy@novaclad.com |
1. Information You Give Us
Account information. Your name and email address. If you sign in with Apple or Google, we receive your name and an email address (which may be a private relay address if you choose to hide your email with Apple). We do not receive your Apple or Google password.
Contact and project information. Phone number, project address or ZIP code, an optional profile photo, and any notes you provide.
Onboarding answers. The responses you give during onboarding — your renovation purpose, expected timeline, the room you're working on, and your stated priorities — used to tailor the flow and to route your project appropriately.
Design and program selections. Material, color, edge profile, cutouts, sink type, backsplash, waterfall, and related choices; the services you request; and any self- declared membership or program flag (for example, indicating that you are a warehouse-club member) that determines which pricing set or retail partner applies to your project.
Communications. Messages you send to support, and records of calls or messages relating to your project.
2. Information Collected Automatically When You Use the Service
Spatial measurements and project geometry. When you scan, the app uses your camera, motion sensors, and — on supported devices — the LiDAR depth sensor to capture the approximate shape and dimensions of the surfaces you trace. This produces geometry data: corner points, polygons, edge lengths, angles, plane positions, and derived square footage. We do not build or retain a full three-dimensional model of your home, and we do not scan rooms you do not point the camera at.
Photographs and AR captures. Camera photographs and screenshots of your space that you capture during scanning and analysis. These may incidentally include parts of your home beyond the countertop surface.
Location. Depending on the permissions you grant and how you use the Service: - Precise location (GPS) — read only at the moment you begin a scan, and only if you grant location permission, to identify the install ZIP for your project, determine regional availability, and route your project to the nearest participating fabricator. We do not track your location continuously and we do not collect location in the background or when the app is closed. - Approximate location from IP address — collected automatically, at city/state level, for security, fraud prevention, and regional availability. Used as a fallback if you decline location permission. - Postal code / project address — as you enter it. Used as the final fallback if neither of the above is available.
Under California law, precise geolocation is sensitive personal information. See Section 9.5 for how to limit its use.
Device and usage data. Device model, operating-system version, app version, device identifiers, language, time zone, LiDAR capability, crash and diagnostic logs, and in-app events such as screens viewed, scans started and completed, and projects submitted. Used for operating, debugging, securing, and improving the Service — not for advertising.
What we do not collect. We do not collect biometric identifiers or biometric information. We do not perform facial recognition or facial-geometry analysis. We do not collect audio. We do not use advertising identifiers or third-party ad SDKs, and we do not track you across other companies' apps or websites. We do not knowingly collect information from anyone under 18.
3. How We Use Information
We use personal information to:
- Create and operate your account and authenticate you.
- Generate your project outputs — analyze your scans and photos, compute square footage and slab requirements, produce an estimate, and generate a written scope of work.
- Connect you with a fabricator — route your project to the participating fabricator or retail partner serving your area or that you select, and support their follow-up.
- Communicate with you about your account, your project, and support requests, and — with your consent — send marketing.
- Operate, secure, and troubleshoot the Service, including fraud prevention, abuse detection, and debugging.
- Improve our technology — evaluate and improve scanning accuracy, feature detection, estimating and pricing models, and product design, including training and tuning machine-learning models. See Section 7 for how we de-identify data for this purpose.
- Comply with law and enforce our Terms of Service.
We do not use your information for advertising, and we do not make decisions producing legal or similarly significant effects about you by automated means without human involvement.
4. AI Processing
Photographs and geometry you capture are transmitted to Anthropic PBC and processed by Claude models to detect countertop edges and corners, classify features such as sinks and cooktops, and generate the written scope-of-work summary shown in your project.
Anthropic acts as our service provider. Under our commercial agreement, data we submit through Anthropic's API is processed to return results to us and, per Anthropic's commercial terms, is not used to train Anthropic's models. Anthropic retains data only as needed to provide the service and for trust-and-safety purposes as described in its own terms.
AI output can be inaccurate. It is provided to help you and is not a professional measurement or design. See the Terms of Service, Section 8.
5. Service Providers (Sub-processors)
We share personal information with vendors who process it on our behalf, under contract, only for the purposes we specify. As of the date above:
| Provider | Role | Data involved |
|---|---|---|
| Anthropic PBC | AI analysis of scans and photos; scope-of-work generation | Photographs, geometry, project selections |
| Amazon Web Services (S3) | Image and file storage | Photographs, AR captures |
| MongoDB (Atlas) | Application database | Account, project, measurement, and selection data |
| Railway | Backend application hosting | All data in transit through the backend |
| Resend | Transactional email delivery | Name, email address, project summary |
| Apple / Google | Authentication (Sign in with Apple, Google Sign-In) | Name, email or private relay address, authentication token |
We maintain a current list at novaclad.com/privacy and will update this table when providers change. All are located in the United States.
6. Sharing With Fabricators and Retail Partners
When you submit a project, we transmit the project to the participating fabricator or retail partner who will handle your inquiry. What we send includes: your name, email address, phone number, project address or ZIP code, the measurements and square footage you captured, the photographs and AR captures from your scan, your material and design selections, the generated estimate and scope of work, and any membership or program flag you declared.
This is the point of the Service, and it is not reversible once sent. You control it by choosing whether to submit a project. If you do not submit, we do not send your project to anyone.
Rock Creek Granite is a separate company under common ownership with us. Rock Creek Granite is a trade name of Fourfold Futures LLC. Fourfold Futures LLC is a different legal entity from Novaclad LLC, and the two are under common ownership. So when your project is routed to Rock Creek Granite, your information does leave Novaclad LLC and goes to a related — but separate — company, which becomes an independent controller of it and handles it under its own privacy practices. We identify this relationship in the app before you submit.
Because of the common ownership, we have made two commitments that we would not be able to make about an unrelated fabricator: we require Rock Creek Granite by contract to use your project information only to respond to and fulfill your inquiry, and we will pass your deletion request through to them (Section 9.3).
Other fabricators and retail partners are independent businesses and independent controllers of the information once it is delivered. Their use of it — including their own follow-up, marketing, and retention — is governed by their privacy policy, not this one. We require our participating fabricators by contract to use project information only to respond to and fulfill your inquiry, to protect it appropriately, and not to sell it. We cannot control what a fabricator does after delivery, and we ask you to review their privacy policy before engaging them.
Corporate reorganization. Novaclad LLC may convert or reincorporate into a corporation or other entity form in connection with a financing. When that happens, your account and the personal information described in this Policy transfer to the successor entity, which will be bound by this Policy or by a successor policy that we will notify you of before it takes effect. A reorganization will not reduce your rights under this Policy or expand how we use your information.
Other sharing. We may also disclose personal information: to comply with law, legal process, or a lawful government request; to enforce our Terms or protect the rights, safety, or property of Novaclad, our users, or the public; to investigate fraud or security incidents; to our professional advisors under confidentiality; and in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business, in which case personal information may be transferred to the successor, subject to this Policy or a successor policy of which you will be notified.
7. De-identified and Aggregated Data
We create de-identified and aggregated datasets from the scans, measurements, selections, and estimates that pass through the Service, and we use them to improve scanning accuracy, measurement and estimating models, material and pricing intelligence, and product design, and to produce industry benchmarks and analytics.
Before data is used for any of these purposes — or disclosed to anyone other than the fabricator handling your project — we remove or replace direct identifiers (name, email address, phone number, street address, and precise geolocation), generalize geography to no more specific than a five-digit postal code, and aggregate records so that no individual person, household, or property is identifiable.
Our public commitment. Consistent with Cal. Civ. Code § 1798.140(m) and comparable state law, Novaclad: (a) takes reasonable technical and organizational measures to ensure that de-identified information cannot be used to infer information about, or be linked to, a particular consumer or household; (b) publicly commits to maintain and use such information in de-identified form and not to attempt to reidentify it, except solely to test the effectiveness of our de-identification measures; and (c) contractually obligates any recipient of such information to comply with (a) and (b) and to impose the same obligations on its own recipients.
De-identified data is not personal information. It is therefore not subject to deletion or access requests, and it survives the deletion of your account. Deleting your account will not require us to delete de-identified or aggregated data, or to retract or retrain any model that was previously improved using it. This is explained further in the Terms of Service, Section 9.
8. Selling and Sharing
#8.1 We do not sell your personal information for money. We do not operate an ad network, we do not share personal information for cross-context behavioral advertising, and we do not disclose personal information to data brokers.
#8.2 We do not knowingly sell or share the personal information of anyone under 16. The Service is limited to adults 18 and older.
#8.3 Referral compensation — read this. Novaclad LLC may receive referral fees, per-lead payments, revenue share, or other compensation from a fabricator or retail partner — including Rock Creek Granite, which is under common ownership with us — in connection with connecting you to them. Under the California Consumer Privacy Act and several other state privacy laws, disclosing personal information to a third party for "other valuable consideration" can constitute a "sale" of personal information, even where no money changes hands for the data itself and even where the disclosure is exactly what you asked us to do. Because Rock Creek Granite is a separate legal entity from Novaclad LLC and uses your project information for its own purposes rather than only ours, it is a third party for this purpose — common ownership alone does not make it part of Novaclad.
Where that characterization applies, you have the right to opt out — but note that opting out of this disclosure means we cannot deliver your project to any fabricator, which is the core function of the Service. You may exercise that right at novaclad.com/do-not-sell or by emailing privacy@novaclad.com. Opting out does not stop you from using the Service to measure your space and see an estimate.
#8.4 Rock Creek Granite. Rock Creek Granite is a separate legal entity (Fourfold Futures LLC) under common ownership with Novaclad LLC, not a Novaclad brand and not our service provider — once your project is delivered, it uses that information for its own purposes, namely quoting and contracting with you. That makes it a third-party recipient under state privacy law, and the analysis in Section 8.3 applies to it in the same way it applies to any other fabricator. Your opt-out rights under Section 8.3 cover disclosures to Rock Creek Granite.
#8.5 Opt-out preference signals. We honor Global Privacy Control (GPC) and comparable opt-out preference signals transmitted by your browser on novaclad.com.
9. Your Privacy Rights and Choices
Depending on where you live, you may have some or all of the following rights. We extend the core rights below to all U.S. users, regardless of state.
#9.1 Access and portability. Request confirmation of whether we process your personal information, a copy of it, and the categories of sources, purposes, and recipients.
#9.2 Correction. Ask us to correct inaccurate personal information.
#9.3 Deletion and account closure. Delete your account at any time from Settings → Delete Account in the app, or by emailing privacy@novaclad.com. Deleting your account removes your account record, contact information, projects, measurements, and photographs from our production systems within 30 days and from encrypted backups within 90 days, except where we must retain information to comply with law, resolve disputes, prevent fraud or abuse, or enforce our agreements. Deletion does not reach de-identified or aggregated data (Section 7), and it does not automatically recall project information already delivered to a fabricator. We will tell you who received your project if you ask.
For Rock Creek Granite specifically, we will forward your deletion request and, under our agreement with them, they will honor it — except for records they must keep for work you actually contracted for, and for warranty, tax, and legal-hold purposes. For any other fabricator, contact them directly; we will give you their contact information.
#9.4 Opt out of sale or sharing. See Section 8.3.
#9.5 Limit use of sensitive personal information. Precise geolocation is sensitive personal information under California law. We use it only to determine regional availability and to route your project to the nearest fabricator, and never to infer characteristics about you — a use for which the right to limit does not apply under the CCPA. You may in any case revoke location permission at any time in your device settings (iOS → Settings → Novaclad → Location), and the app will fall back to the ZIP code you enter.
#9.6 Opt out of marketing. Use the unsubscribe link in any marketing email, or email privacy@novaclad.com. Reply STOP to any text message. Transactional and service messages will continue while you hold an account.
#9.7 Non-discrimination. We will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised a privacy right. Where a request makes it impossible to deliver a feature — for example, opting out of disclosure to fabricators — we will tell you plainly rather than degrade the Service silently.
#9.8 How to exercise. Email privacy@novaclad.com or use the in-app controls. We will verify your request by confirming control of the email address on your account, and may ask for additional information for sensitive requests. We respond within 45 days and may extend once by another 45 days with notice.
#9.9 Authorized agents. An authorized agent may submit a request on your behalf with written permission signed by you; we may also ask you to verify the request directly.
#9.10 Appeals. If we deny your request and you live in a state that provides an appeal right (including Virginia, Colorado, Connecticut, and Texas), you may appeal by emailing privacy@novaclad.com with the subject line "Privacy Appeal." We will respond within 60 days. If we deny the appeal, we will tell you how to contact your state attorney general.
#9.11 California "Shine the Light." We do not disclose personal information to third parties for their own direct-marketing purposes.
10. Categories Disclosed Under U.S. State Privacy Law
The following table describes, in the categories used by the CCPA, the personal information we have collected in the preceding 12 months.
| CCPA category | Examples we collect | Sources | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email, phone, account ID, device identifiers, IP address | You; your device | Account, project delivery, security | Fabricator; service providers |
| Customer records (Cal. Civ. Code § 1798.80) | Name, address, phone | You | Project delivery | Fabricator; service providers |
| Commercial information | Project selections, estimates, service requests, program flags | You; the Service | Estimating, project delivery | Fabricator; service providers |
| Internet / network activity | App and site usage, screens viewed, crash logs | Your device | Operation, debugging, improvement | Service providers |
| Geolocation data | Precise GPS location (with permission); IP-derived location; ZIP code | You; your device | Fabricator routing, regional availability | Fabricator; service providers |
| Visual information | Photographs and AR captures of your space | You | Analysis, estimating, project delivery | Fabricator; service providers |
| Professional information | None | — | — | — |
| Education information | None | — | — | — |
| Sensitive personal information | Precise geolocation; account log-in credentials | You; your device | Fabricator routing; authentication | Service providers |
| Inferences | Project scope and material-preference signals derived from your selections | The Service | Estimating, product improvement | Service providers |
We do not collect biometric information, audio recordings, health information, financial account numbers, government identifiers, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or the contents of your mail, email, or messages.
Retention. We retain each category for the period described in Section 11.
11. Retention
| Data | Retention |
|---|---|
| Account record (name, email, credentials) | While your account is active; deleted within 30 days of account deletion |
| Photographs and AR captures | 24 months from capture, or until you delete the project or your account, whichever is first |
| Measurements, geometry, and project selections | 24 months from capture, or until deletion, whichever is first — then retained only in de-identified form |
| Submitted project records and delivery logs | 7 years, for dispute resolution, warranty, and legal-hold purposes |
| Support and communications records | 3 years |
| Security, audit, and fraud-prevention logs | 24 months |
| Encrypted backups | Rolling 90 days |
| De-identified and aggregated data | Indefinitely (see Section 7) |
We may retain information longer where required by law, to establish or defend legal claims, or subject to a litigation hold.
12. Security
We protect personal information with encryption in transit (TLS) and at rest, access controls and least-privilege permissions on our storage and database systems, private (non-public) object storage with signed, time-limited URLs for image access, audit logging, and vendor security review. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as the law requires.
13. Children
The Service is not directed to children and is intended only for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. If you believe a child has provided us information, email privacy@novaclad.com.
14. Third-Party Sites and Apps
The Service links to third-party sites and services, including fabricator and retail partner sites. We are not responsible for their privacy practices. Review their policies before providing information.
15. International Users
The Service is intended for use in the United States, and all information is stored and processed in the United States. We do not offer the Service in the European Economic Area, the United Kingdom, or Switzerland. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law.
16. Changes to This Policy
We may update this Policy. We will post the updated version with a new "Last updated" date, and for material changes we will notify you by email or in-app notice at least 14 days before the change takes effect. Changes to how we use previously collected personal information for a materially different purpose will be made only with your consent where the law requires it.
17. Contact Us
Novaclad LLC Privacy: privacy@novaclad.com Security: security@novaclad.com General: hello@novaclad.com Mailing address: 3118 Allen Avenue, Saint Louis, MO 63104
California residents may also contact us by the methods in Section 9.8 to exercise their rights. If you have an unresolved concern, you may contact your state attorney general.
Novaclad Privacy Policy, version 2.0. Draft pending legal review.
Questions about this document? legal@novaclad.com