Last Updated:2026.05.25
This Privacy Policy explains how CMCF Limited doing business as NashNova ("NashNova", "we", "us", or "our") collects, uses, discloses, protects and stores ("processes") personal data when you use our website, mobile applications, and related services (the "Platform").
By visiting, accessing, or using the Platform, you acknowledge that you (a) have the right, capacity and authority to accept this Privacy Policy; and (b) have read and understand this Privacy Policy, so please read it carefully to understand our data processing practices.
This Privacy Policy applies to personal data processed in connection with your access to and use of the Platform, including communications and interactions between you and us.
1. What Personal Data We Collect
Where the provision of personal data is mandatory, we will identify this at the point of collection. Failure to provide mandatory personal data may prevent us from providing certain Platform features (such as account creation or reward payouts). All other personal data is provided voluntarily.
Information you provide directly
We may process personal data you voluntarily provide to us, including:
a) name, email address, phone number, social media accounts, and authentication credentials you choose to provide;
b) profile information, such as display name, and any descriptive information you choose to provide;
c) information about your preferences and interests;
d) the contents of any public comments and postings;
e) any personal data contained within AI prompts, inputs and outputs;
f) financial and payment information, including payment wallet account identifiers;
g) communications with us, including enquiries, feedback, support requests, complaints, or reports;
h) Investment judgments, predictions, and analysis inputs you submit to the AI system;
i) Questions and responses in AI-assisted Q&A sessions;
j) Preference Tags and behavioral patterns inferred from your interactions; and
k) Key Statements (notable inputs you have made) and Action Milestones (significant Platform events) stored in the NashNova memory system.
Technical and usage data
We may collect or generate:
a) IP address;
b) device identifiers, operating system, browser type, and version;
c) cookie identifiers;
d) behavioral analytics data; and
e) service usage and interaction logs, including clicks, scrolls and navigation patterns, judgement voting activities, session timestamps and duration within the Platform.
2. Purposes of Use
We process personal data only for purposes that are lawful and directly related to the Platform's functions, including:
a) providing the Platform, including user authentication, account creation and management, community feature enablement, and user support and enhancement;
b) allowing you to participate in the features we offer on the Platform;
c) personalizing and tailoring content, recommendations and offers we display to you on the Platform, solely for the purpose of enhancing your experience and engagement with the Platform;
d) administering rewards programs, including determining eligibility and processing payouts;
e) sending you direct marketing communications about our products, services, and promotional offers, where you have given your consent -- please refer to the "Direct Marketing" section below;
f) sending you service and transactional communications, such as verification messages, security alerts, and important notices about your account or the Platform;
g) operating, maintaining, troubleshooting and administering the Platform;
h) providing customer support and handling enquiries or complaints;
i) enforcing our Terms of Service and community rules;
j) ensuring security, preventing fraud or abuse, and managing technical and operational risks;
k) complying with legal and regulatory obligations;
l) analyzing usage and improving the Platform, including diagnostics, analytics, and performance optimization;
m) providing the NOVA AI assistant and other AI-powered features, including by transmitting your inputs and conversation content to our third-party AI service providers as described in this Privacy Policy;
n) generating, calculating, and displaying your NQ Score, rank tier, and related automated assessments;
o) operating the NashNova memory system, including storing and using Preference Tags, Key Statements, and Action Milestones to personalise your experience;
p) training, developing, and improving our AI and machine-learning models, using aggregated and de-identified data wherever practicable;
q) operating community and competitive features, including the NE Points Leaderboard, where you choose to participate;
r) verifying your identity when you make a data access, correction, deletion, or other rights request;
s) facilitating a merger, acquisition, financing, reorganisation, or sale of assets, in which case personal data may be transferred to the relevant successor or counterparty; and
t) any other purpose disclosed to you at the time the personal data is collected, or to which you have otherwise consented.
3.AI Data Use and Your Controls
NashNova's core product relies on artificial intelligence and machine learning. This section explains specifically how your personal data interacts with our AI systems, including the NOVA AI assistant and the NQ Score.
How AI uses your data
a) Your prediction inputs, judgments, and interaction history are used to generate your personalised NQ Score across four dimensions: Accuracy, Alpha Accuracy, Activity, and Contrarian Score;
m) Aggregated and de-identified interaction data may be used to train and improve our AI models;
b) We maintain a three-layer memory system comprising Preference Tags (inferred interests), Key Statements (notable inputs you have made), and Action Milestones (significant platform events), which are used to personalise your experience.
Your AI data controls
a) You may request deletion of your AI interaction history at any time through account settings or by contacting us at [contact@nashnova.com];
b) You may opt out of having your personal data used for training our AI models; however, opting out may affect the personalisation quality of your experience;
c) You may request a summary of the data stored in your NashNova memory profile.
Please note that opt-out and deletion requests stop the future use of your data and remove it from our active systems, but we cannot retroactively extract data that has already been incorporated into trained AI models in de-identified form. These AI-specific controls operate at the Platform level. They are distinct from your statutory rights, and do not limit or affect any rights you may have under applicable data protection laws. Requests will be handled in accordance with applicable laws and our data retention obligations.
Automated decision-making
Your NQ Score and rank tier are calculated through automated processes based on your prediction accuracy and activity. These scores are intended as a self-assessment and engagement tool and do not constitute investment advice. If you believe your score is inaccurate, you may contact us at [contact@nashnova.com] to request a review by our team.
NE Points Leaderboard
If you choose to participate in the NE Points Leaderboard, we will publish your display name and NE points data on the global leaderboard, which is visible to all users. The leaderboard displays only your display name and points; no other personal data is shown. Participation is optional, you may opt out before your data is first published, and you may request removal at any time by contacting us at [contact@nashnova.com].
Direct Marketing
We intend to use your name and contact information ("Marketing Data") to send direct marketing materials to you in relation to our AI-powered analysis, prediction, and self-assessment tools, subscription plans, new features, and related educational content, services, and promotional offers that we think may interest you, and your consent is required in order to do so.
We also intend to share your Marketing Data with our group companies and our financial data or financial education partners to enable them to direct market their investment information and analytics to you, and your written consent is required in order to do so.
Data Transfers
We may transfer your personal data to the following parties which may be located outside of your home jurisdiction:
our group companies;
our service providers and vendors who need access to such information to carry out work or perform services on our behalf, such as identity verification and authentication, fraud prevention, payment processing, customer support, data analytics, information technology, cloud hosting, security, advertising and marketing, and consumer research;
professional advisers, including legal and compliance advisers;
andregulators, law enforcement agencies, or courts, where required or permitted by law.
To elaborate on the service providers mentioned above, the NOVA AI assistant is powered by large language models provided by third-party AI infrastructure. Queries, inputs, and conversation content you submit to the Platform may be processed by the following providers:
a) OpenRouter, an AI request gateway that routes requests to underlying model providers. Data transmitted through its API typically includes prompt content and contextual metadata such as previous conversation history; and
b) OpenAI and other underlying model providers, which process inputs routed through OpenRouter. Certain downstream model providers may retain data for a limited period (typically up to 30 days) for safety and monitoring purposes.
OpenRouter states that data transmitted through its API is not used to train its proprietary models. Where supported by the underlying model, we will prioritise zero-retention configurations. We take reasonable measures to minimise the personal data included in AI queries, and we will not intentionally transmit your account credentials, financial account details, or government-issued identification information to AI providers. We recommend you avoid submitting sensitive personal information in AI conversations.
Our other key sub-processors include Google Firebase and Google Analytics (analytics and crash reporting), Sentry (crash reporting, performance monitoring, and session replay), hCaptcha (human verification), Apple Push Notification service and Google Firebase Cloud Messaging (push notifications), and our cloud hosting providers. Sentry is currently configured to capture additional user context, including identifiers associated with your session; you may request deletion of your Sentry-held data by contacting us at [contact@nashnova.com].
NashNova is based in Hong Kong SAR. Our Platform infrastructure operates on cloud platforms with servers located outside Hong Kong, including in the United States. As such, your personal data may be transferred to and processed in jurisdictions outside your place of residence. Where we transfer personal data outside Hong Kong, we will take reasonable steps to ensure that such data is handled in accordance with this Privacy Policy and applicable laws.
4.Data Retention
We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Anonymised and aggregated data may be retained indefinitely where it no longer reasonably identifies you. When personal data is no longer required, we will take reasonable steps to securely delete or anonymise it.
By way of indicative guidance, we retain account information for the duration of your account and for up to 90 days after a deletion request; usage and behavioural data for up to 24 months from collection; device and technical data for up to 12 months; AI interaction records for the duration of your account (which may be deleted on request at any time, subject to compliance with applicable laws); and payment transaction records for up to 7 years to meet legal and tax obligations.
5.Cookies and Tracking Technologies
We may use cookies or similar technologies to:
a) enable core Platform functionality;
b) remember user preferences; and
c) analyse usage patterns and performance (where analytics are enabled).
We may use the following types of cookies:
a) Strictly Necessary Cookies, which are required for the operation and security of the Platform, including for session management (such as login session tokens with limited validity periods), security verification and anti‑abuse measures (including protection against replay attacks and cross‑site request forgery);
b) Functional Cookies, which are used to remember user preferences and settings, such as language selection, visual themes, and dashboard layout configurations; and
c) Analytics Cookies, which are used, where enabled, for Platform performance monitoring, error tracking, diagnostics, and analysis of usage patterns, and which may correspond to the collection of technical data as described in this Privacy Policy.
Cookies and similar technologies may be managed through browser or device settings. If cookies are disabled or restricted, certain features or functions of the Platform may be unavailable or may not operate as intended.
You may control certain cookies through your browser or device settings. Disabling cookies may affect certain Platform features.
6.Security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption, access controls, and security monitoring.
7.Data Subject Rights
The following rights are available to all users in relation to personal data, to the extent available to you under applicable law:
a) Access: request a copy of the personal data we hold about you;
b) Correction: request correction of inaccurate or incomplete data;
c) Deletion: request deletion of your personal data, subject to applicable legal and retention requirements;
d) Withdraw consent: withdraw your consent for optional processing of your personal data at any time; and
e) Opt out of direct marketing at any time.
To exercise your rights, or if you have any queries regarding our privacy practices and policies, please contact our Privacy Officer by sending an email to us at: contact@nashnova.com, and we will respond to your request in accordance with the requirements of applicable laws. We may require reasonable information to verify your identity before responding. Where permitted by applicable law, we may charge a fee that is not excessive for complying with a data access request.
8.Children's Privacy
The Platform is not directed to persons under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [contact@nashnova.com]. This age threshold should be read consistently with the age requirements in our Terms of Service and our app store age ratings.
9.No Sale of Personal Data
NashNova does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.
10.Changes to Our Privacy Policy
We may update this Privacy Policy at any time by posting the amended version on the Platform, including the effective date of the amended version, so please check frequently to see if there are any updates and changes. Your continued access to or use of the Platform constitutes your acknowledgment and acceptance of such changes to this Privacy Policy, unless your express consent is required by applicable laws.