Factual Website Notice: This notice reflects NovaSoul Lab's current static pre-launch codebase (no active intake form, analytics SDK, or database storage). Automated inquiry intake is planned for Milestone 6, formal accessibility auditing for Milestone 7, and production hosting/domain launch for Milestone 8. Informational disclosures only — not legal advice or formal compliance sign-off.
1. Scope & Practice Identity
This Privacy Policy applies to the website of NovaSoul Lab, an India-based technology and software engineering practice operating across four specialized divisions: NovaSoul Public, NovaSoul AI, NovaSoul Software, and NovaSoul Cloud.
This document describes what the current website codebase does today, including the server-validated inquiry submission endpoint on /contact (/api/contact), alongside hosting deployment milestones scheduled for Milestone 8. It provides transparency disclosures only and does not constitute legal advice or a formal regulatory compliance sign-off.
2. Current Website Behavior & Inquiry Submissions
Informational pages across this site execute without user accounts, login portals, online checkout, or client dashboards. On the Contact page (/contact), visitors may optionally complete the Project Inquiry Form and transmit inquiry details to our server endpoint (/api/contact).
NovaSoul Lab does not maintain an application database for contact submissions: validated inquiries are forwarded exclusively as email notifications to our configured server recipient when provider credentials are active.
- Voluntary Project Inquiry Fields: When you submit the /contact form with explicit affirmative consent, the server receives only the fields you enter (full name, work email, organization name, country, division interest, project subject, and project description). We do not use the form to create user accounts or marketing subscriptions.
- No Analytics SDKs or Advertising Trackers: No web analytics SDKs, advertising pixels, or cross-site behavioral tracking scripts are installed in the website codebase.
- External Font Requests: Page templates load fonts (Inter, Manrope, and JetBrains Mono) from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser sends standard HTTP connection metadata directly to Google Fonts when retrieving font assets.
- Abuse Protection & Rate-Limit Hashing: To prevent automated spam floods on /api/contact, incoming request IP metadata is hashed irreversibly with SHA-256 on the server (using ephemeral memory or a configured Upstash Redis rate-limit store) for temporary rate-limit counting without logging full names, emails, or project descriptions.
- Hosting & Server Logs: When deployed to web hosting infrastructure (scheduled for Milestone 8), standard HTTP host infrastructure may process transient connection metadata to serve pages and diagnose transport failures.
3. Inquiry Processing & Purpose Limitation
Information voluntarily submitted through /contact is processed strictly to evaluate technical scope, assign an appropriate engineering division review, and reply directly to your organization.
- Purpose Limitation & Consent: Explicit unchecked opt-in consent is required prior to transmitting an inquiry submission to /api/contact.
- No Data Sale: NovaSoul Lab does not sell, rent, or trade business inquiry details to data brokers or third-party marketing lists.
- Provider Credential Guard: When server email provider credentials are absent in pre-launch or local environments (/contact status: "Pending Email Configuration"), /api/contact declines dispatch with a safe status notice instead of storing data or silently discarding your message.
5. Security Engineering Practices & Scope
The codebase applies strict server-side Zod validation, same-origin checks, request size caps, HTML email escaping, rate limiting, and secret isolation (keeping email provider and rate-limit credentials out of client-side bundles).
HTTPS/TLS certificate provisioning and production hosting hardening remain scheduled for Milestone 8. Statements on this page describe implemented repository controls rather than third-party operational guarantees or security audits.
6. Access, Correction & Deletion Context
Because the website does not collect user accounts or persist contact inquiries in a website database, no visitor inquiry database records are stored on the site.
When email provider credentials are configured and you submit an inquiry via /contact, your inquiry is routed directly by email to NovaSoul Lab. You may request access to, correction of, or deletion of that email correspondence in accordance with applicable data protection laws.
7. Current Contact Status & Privacy Questions
Interactive submission via the /contact form is active at the application level, and the sidebar displays live email routing readiness ("Pending Email Configuration" when environment credentials are unset, or "Transactional Email Delivery Active" once configured).
Official published privacy inquiry email routing will be updated here once Milestone 8 production domain launch and email channel configurations are finalized.