United States · California · Pacific Coast

Privacy Notice

Published by Novra Foods concerning personal information on novrafoods.com

Version 2026-09-08-A · Effective 8 September 2026 · Last revised 8 September 2026

House monogram for brand identification — not a notary seal

What the house collects when you leave an address for the first hundred, precisely where it goes, who else touches it, how long it is kept, and what you can ask us to do about it — read together with Legal.

Table of contents

1. 1. Who we are
2. 2. Scope of this notice
3. 3. Information we collect
4. 4. The first hundred · what we send · how to stop it
5. 5. How the form works
6. 6. Service providers · where the information sits
7. 7. Cookies, storage, and analytics
8. 8. Do Not Track and Global Privacy Control
9. 9. How we use information
10. 10. How we share — and do not sell
11. 11. Retention
12. 12. Security
13. 13. Children under 13
14. 14. Reviewing, correcting, and removing your information
15. 15. California privacy rights
16. 16. Visitors outside the United States
17. 17. Automated decisions
18. 18. Changes to this notice
19. 19. Related notices
20. 20. Contact

Article 01Who we are

“Novra Foods,” “we,” “us,” and “the house” mean the Novra Foods house operating https://novrafoods.com on the Pacific Coast of the United States. The house is the party responsible for the information described in this notice, and the party you write to about it.

This Site is the official house website. It is a brand and invitation surface only. No products are sold, priced, carted, or checked out here. Retail and other sales — when available — will be announced separately.

The house trades as Novra Foods. This Site does not publish the house’s registered corporate particulars — its entity form, state of organisation, registered agent, or postal address — and nothing here should be read as a statement of them. When those particulars are published, they will be published on this Site and named in this notice. Until then, the mailbox below is how you reach the house, and it is answered.

We are not Novra Technologies Inc., not the NOVA nutrition classification, and not other similarly named food businesses abroad. Stale regional “Coming Soon / 2026” references do not describe this Site. The live identity is the Pacific Coast, 2027.

Article 02Scope of this notice

This Privacy notice explains how we handle information in connection with:

• browsing https://novrafoods.com and the pages we publish there (the “Site”);
• the first-hundred invitation form, which posts to /api/join, and the house correspondence that follows it;
• the opt-out route at /api/unsubscribe;
• mail you send to info@novrafoods.com;
• the ordinary request and security logs our host keeps in order to serve and protect the Site.

It does not cover third-party websites, marketplace listings, social accounts that are not ours, or future commerce systems that do not yet exist on this Site. Those will carry their own notices if and when they launch.

The home page links to this Privacy Notice beside the invitation form and in the footer. This page controls on privacy details. Use of the Site is also governed by our Legal notices (terms of use, brand protection, disclaimers, limitation of liability, and related house terms).

Article 03Information we collect

If you only read the Site, we ask you for nothing. No cookie is set, no identifier is assigned, no form is required, and there is no account to create. Our host records the request as any web host does; that is described below and in Article 11.

If you leave an address for the first hundred, the submission carries:

• Your email address — what you typed, trimmed of spaces, lower-cased, and cut at 254 characters.
• The time of the submission, as a UTC timestamp.
• A fixed source label naming this Site’s join form. It is identical for every visitor; it identifies the form, not you.
• The IP address the request arrived from — the address your network presented to our host. It may be your home connection, your employer’s, a mobile carrier’s, or a proxy’s.
• The first 180 characters of the user-agent string your browser sent. That string ordinarily names your browser, its version, and your operating system.
• Form-integrity signals — a short-lived signed token this Site issues before you submit, a marker that scripting ran, the human-confirmation tick, and how long the form was open before it was sent. They are used to judge the submission and are not written to the worksheet or to the mailbox. They are not advertising trackers. See Article 05.

Where those go, plainly stated. Two of them reach the house mailbox in a short notification: your address and the time. All of them except the integrity signals are also written as one row of a private Google Sheet the house controls. The row has six columns, in this order:

• the UTC timestamp of the submission;
• your email address;
• the fixed source label for the join form;
• the IP address;
• the user-agent string, cut at 180 characters;
• a sixth column recording the state of that row — whether the one courtesy note is still owed to you, has been sent, or no longer applies because you asked to be left alone, in which case it reads “unsubscribed”.

We state that plainly because it deserves to be stated plainly. That row joins your email address to your IP address and to your browser string, in one place, under our control. Describing it as infrastructure logging would be a way of not saying it. It is a record about you, and the list above is what is in it. Article 09 says what we use it for, Article 11 says how long each part of it lives, and Article 14 says how to have it corrected or removed.

If you write to info@novrafoods.com, we process what you send, the ordinary mail headers that come with it, and our replies.

If you opt out, we process the signed token from the link — which encodes the address it belongs to — together with the IP address and user-agent of that request, and the fact and time of the opt-out. That is written to the same worksheet as its own row, with the sixth column marked “unsubscribed”. See Articles 04 and 11.

What this Site never asks for. Payment cards. Government identifiers. Passwords — there is no account to hold one. Precise location. Health, biometric, racial or ethnic origin, religious or philosophical belief, union membership, sexual orientation, immigration status, or any other category California treats as sensitive personal information. Please do not send information of that kind through the public form or the general mailbox. If we ever need something of that kind, it will be through a separate written process that says so.

Article 04The first hundred · what we send · how to stop it

When you leave an address for the first hundred, it reaches the house at info@novrafoods.com for the invitation list and related house correspondence only, and it is recorded in the private worksheet described in Article 03. We do not sell that list.

What we send. One courtesy note goes to you when your address arrives. If you asked to be remembered among the first, we may write once more from the same mailbox when there is something real to say. That is the whole of it: no newsletter, no sequence, no cascade, no account, no drip. If the house ever wants to write more often than that, it will ask you first.

Who the sender is. Every message comes from info@novrafoods.com and identifies Novra Foods as the sender. The subject line describes what the message actually is. We do not use forged headers, borrowed sending identities, or subject lines written to mislead you about what is inside.

How to stop it — three routes, all of them free.

• The unsubscribe link in the note. Each note carries a link to /api/unsubscribe with a signed token unique to your address. Following it removes that address and nothing else. It asks nothing further of you — no login, no form, no reason given, no other detail.
• Your mail client’s own unsubscribe control. The notes we send you carry the standard list-unsubscribe headers, so the button your mail application shows uses the same route.
• Reply “Remove me.” Reply to any note from the house with those two words, or write to info@novrafoods.com with “Remove me” in the subject line. A person reads it.

The window. We honour an opt-out within ten business days of receiving it, which is the outer limit United States law allows a sender. We never charge for it, never require you to visit more than a single page, and never ask you for anything beyond the request itself as a condition of honouring it.

What an opt-out does to the record. An opt-out adds a second row to the worksheet for your address, marked “unsubscribed”. That row is what stops the house writing to you again; the earlier row is not erased by the act of unsubscribing. If you would rather the address were gone from the worksheet altogether than marked, say so — Article 14 explains how, and what the consequence is.

What leaving an address does not do. It does not create a contract to ship goods, reserve product, lock pricing, or guarantee a case, and it does not create an account. Allocation of any future invitation remains in the house’s sole discretion. You represent that the address is yours (or that you are authorised to submit it) and that your submission is lawful.

Article 05How the form works

Your email application does not open when you use the on-site form. The address is received on this Site by /api/join and routed to the house systems named in Article 06. If scripting is switched off in your browser, the form is not shown at all and the page points you at the house mailbox instead — and then your mail application does open, because in that case you are writing to us directly.

The form is protected by a set of first-party checks that together indicate a real person, using a real browser, filled it in at a plausible pace. Those checks include the short-lived signed token this Site issues before you submit, a marker that scripting ran, the human-confirmation tick, and the elapsed time. This Site also limits how many submissions it will accept from one network address in an hour, and refuses requests that identify themselves as known automated clients. That is what the IP address and the user-agent string are for at the moment of submission.

We do not publish the complete list of these checks, for the same reason a shop does not publish its alarm code. What we will tell you is what they are not: none of them is an advertising tracker, none of them is a third-party service, none of them follows you anywhere, and none of them builds a profile of you.

If the form is unavailable, you may write the house directly at info@novrafoods.com. Mail sent that way is still house correspondence, not an account product.

Article 06Service providers · where the information sits

Two companies process this information for us. They are not a mystery and there is no reason to leave them unnamed.

• Vercel Inc. — hosting and edge delivery. Vercel serves every page and asset on novrafoods.com, terminates the encrypted connection, and runs the /api/join, /api/challenge and /api/unsubscribe functions. In the ordinary course of doing that it keeps the request and function logs described in Articles 03 and 11.
• Google LLC — three services, inside one Google Workspace account the house controls. The Gmail API sends the short notification to the house mailbox and the courtesy note to you. Google Sheets holds the private first-hundred worksheet described in Article 03. Google Workspace holds the info@novrafoods.com mailbox itself and the correspondence in it.

Each acts as a service provider processing on the house’s instructions, under that provider’s standard terms for business customers — which is to say, to provide the service to us, and not for that provider’s own advertising. We do not receive money or anything of value for giving them access; access is how the Site runs. Neither of them is given the information for their own marketing, and neither is authorised to use it for anything other than the service they perform for us.

These are the only two. There is no analytics vendor, no email marketing platform, no customer data platform, no advertising network, no data broker, and no enrichment service anywhere in this Site’s path.

Article 07Cookies, storage, and analytics

Cookies: none. This Site sets no cookies. Not advertising cookies, not analytics cookies, not preference cookies, not a session cookie. None. That is why there is no cookie banner on this Site — there is nothing here to ask you to consent to.

Analytics: none. There is no analytics product on this Site, first-party or third-party. No tag manager, no software development kit, no tracking pixel, no web beacon, no heat map, no session replay, no split-testing tool, no fingerprinting. Nothing on this Site measures you, and nothing on this Site reports you anywhere.

Browser storage: exactly one item. This Site shows a short entry notice on your first visit. When you continue past it, the notice records that acknowledgment in your own browser’s local storage under the single key nf_notice_ack. That item holds two things and nothing else: an ISO 8601 timestamp of when you acknowledged the notice, and the version of the notice you acknowledged. It is not an identifier. It is never transmitted to us or to anyone else — we have no way to read it, and nothing on this Site sends it anywhere. It stays in your browser until you clear this Site’s storage; clearing it simply means the entry notice appears again the next time you visit. That is the entire inventory of what this Site puts in your browser.

Motion and sound. Motion and sound choices made on the house page are held in the page only. They are not written to browser storage, and they are not sent to us.

Server logs. Our host records requests to the Site — the sort of standard web-server metadata every host records, including the IP address, the request path and time, the response code, and the user-agent string. This is how the Site is served, debugged, and defended. It is not analytics and it is not joined to the invitation list. Retention is in Article 11.

Form-integrity fields. The checks described in Article 05 ride inside the form submission itself. They are not stored in your browser and they set nothing.

If any of this changes — if this Site ever sets a cookie or adds a measurement tool — this Article is the first thing that will change, and it will change before the tool ships.

Article 08Do Not Track and Global Privacy Control

California law (Business and Professions Code section 22575, the California Online Privacy Protection Act) requires an operator to say how it responds to a browser’s Do Not Track signal, and to say whether other parties may collect personally identifiable information about a visitor’s activity across other websites. Here is the answer to both.

This Site does not track you across other websites or over time. It sets no cookies, runs no analytics, embeds no advertising technology, and hands nothing to a third party for that purpose. There is therefore nothing here for a Do Not Track or Global Privacy Control signal to switch off.

We do not change our behaviour when we receive one — not because we disregard it, but because our behaviour is already what those signals ask for. A Global Privacy Control signal is treated under California law as a valid request to opt out of the sale or sharing of personal information. We do not sell or share personal information at all (Article 10), so that request is already satisfied for every visitor, whether or not their browser sends the signal.

No third party collects personally identifiable information about your online activities over time and across different websites when you visit this Site. There are no third-party trackers here to do it.

If that ever changes — if this Site adds analytics, advertising, or any cross-context technology — we will treat a Global Privacy Control signal as a valid opt-out request, and this Article will say so.

Article 09How we use information

We use the information described in this notice to:

• receive and keep the first-hundred invitation list;
• send the courtesy note, and the one further note described in Article 04;
• honour opt-outs, and keep enough of a record to make sure an opt-out holds;
• answer correspondence sent to the house mailbox;
• operate, serve, debug, and defend the Site;
• detect and stop automated abuse of the invitation form, and investigate it when it happens;
• comply with law and enforce our Legal notices;
• protect the house against impersonation and brand misuse.

Nothing outside that list is a use we make of the information. The IP address and the user-agent string in particular are in the record for one reason: to keep the invitation list from being flooded, and to let us tell one abusive submitter from a hundred real ones. We do not use them to profile you, to estimate where you live, to score you, to enrich your record from another source, or to target advertising. We do not run retargeting from this Site, and we do not sell personal information.

Article 10How we share — and do not sell

We do not sell personal information or invitation lists. We do not share personal information for cross-context behavioural advertising, as those two terms are used under California law. We have not received, and do not receive, money or other value in exchange for anyone’s personal information.

Shine the Light — California Civil Code section 1798.83. California residents may ask a business whether it disclosed their personal information to third parties for those third parties’ own direct-marketing purposes. We do not disclose personal information — invitation addresses or anything else — to any third party for that party’s direct marketing. There is no exception to that in this notice and no carve-out elsewhere. You may still make a Shine the Light request at info@novrafoods.com with “Shine the Light” in the subject line, and we will answer it.

These are the only categories of third party that ever receive personal information from this Site:

• The two service providers named in Article 06 — Vercel for hosting and delivery, Google for mail and the worksheet — processing on our instructions, for the purposes in Article 09;
• professional advisors (counsel, accountants) under a duty of confidentiality, where a matter needs them;
• law-enforcement or other authorities, and parties to legal process, where the law, a lawful demand, or the defence of legal claims requires it, and no further than that requires;
• a successor, in connection with a reorganisation, financing, or transfer of house assets — subject to protection consistent with this notice, and a successor who will not honour it does not get the list;
• anyone you direct us to, with your consent.

Public Site content is public. Do not submit confidential business proposals through the open form expecting secrecy; see Legal on unsolicited ideas.

Article 11Retention

“As long as necessary” is not a retention period, so here are the actual ones. Where a period is stated as an outer bound, we delete sooner when the purpose is finished sooner.

• Invitation addresses. Kept until the first-hundred programme concludes and the notes described in Article 04 have been sent, and then deleted or de-identified within 30 days. Whatever becomes of the programme, no invitation address is kept for more than 24 months from the day it arrived. That is a hard stop, not the start of another window.
• The IP address and user-agent string in a worksheet row. They are there to investigate abuse of the form, which is a short-lived need. They are cleared from the row within 12 months of the row being written, leaving the timestamp, the address, and the source label.
• Opt-out records. The address and the fact and date of the opt-out are kept for as long as we hold an invitation list at all, and afterwards only for as long as it takes to be sure we do not write to you again. This is the one record in this notice that is not on a clock, and the reason is that a request to be left alone should outlive the list it was made against. You can have it deleted too — Article 14 explains the consequence.
• Correspondence to the house mailbox. Kept while the exchange is live and for 24 months after the last message in it, then deleted — longer only where the matter is under a legal hold.
• Host request and function logs. Held by our host on the host’s own schedule, which is short and is set by the host rather than by us. We do not export them and we do not keep a separate copy. If we ever take an extract for a specific security investigation, we delete the extract within 90 days of taking it, unless a legal hold requires otherwise.
• Anything a legal hold reaches. Kept for the duration of the hold, limited to what the hold requires, and deleted when it lifts.

Nothing described in this notice is kept indefinitely except an opt-out record, and that exists only so that a request to be left alone survives.

Article 12Security

We use administrative, technical, and organisational measures appropriate to a corporate invitation site: the Site is served only over an encrypted connection with strict transport security; the pages run under a strict content-security policy; the invitation endpoint is rate-limited and refuses submissions that did not come from this Site; the opt-out link is authenticated by a signed per-recipient token; and the worksheet and the mailbox sit in a Google Workspace account under house control, reachable only by the house operators who run the invitation list and by Google as the provider of those services (Article 06).

No method of transmission or storage is perfectly secure, and we will not pretend otherwise. You use the Site understanding the residual risk.

If we learn of a security incident affecting information you left with us, we will notify you and the authorities where the law requires it — and we will tell you where the law does not require it but you would plainly want to know.

If you believe you have found a security issue affecting novrafoods.com, write to info@novrafoods.com with a clear subject line. Do not publicly weaponise a vulnerability.

Article 13Children under 13

This Site is not directed to children under 13. It is a corporate brand and invitation surface for a general adult audience, and nothing on it is designed for, marketed to, or of particular appeal to children.

We do not knowingly collect personal information from anyone under 13. If we learn that an address on the invitation list belongs to a child under 13, we delete that address and the row that carries it, and we do not write to it. A parent or guardian who believes we hold a child’s information may write to info@novrafoods.com with “Child’s information” in the subject line; we will delete it and confirm that we have.

This Site does not ask a visitor’s age, because it collects nothing that would let it verify one. Our Legal notices ask you to affirm that you are of legal age to make the request where you live; that affirmation, and this Article, are the whole of our age posture.

Article 14Reviewing, correcting, and removing your information

There is no account product on this Site, so there is no self-serve portal and no password to reset. The process is a mailbox, and it is deliberately short.

Write to info@novrafoods.com from the address you left with us, and say which of these you want:

• Review. We will tell you what we hold about that address — the worksheet row and its contents, and whether the mailbox holds correspondence from you.
• Correct. We will fix an address you mistyped, or any other detail that is wrong.
• Remove. We will take the address off the invitation list. See Article 04 for the faster routes and the ten-business-day window.
• Delete entirely. We will delete the worksheet rows for that address rather than merely marking them, and keep only a single suppression entry — the address, and nothing else — so that we do not write to you again. If you want that gone as well, say so and we will delete it, on the understanding that we will then have no way to recognise the address if it is ever submitted again.

Verification. Because the only identifier we hold is an email address, we verify a request by the address it comes from: write from the address the request concerns, or reply to a short confirmation we send to it. We ask for nothing else, and we do not create a new record about you in order to answer you.

Timing. We acknowledge a request within 10 business days and answer it within 45 days. If a request is genuinely complicated we may take one further period of up to 45 days, and we will tell you before we do. There is no charge.

Authorised agents. An agent may make a request on your behalf where the law allows. We may ask for proof of authority and may confirm the request with you directly.

Article 15California privacy rights

First, honestly, about whether the CCPA applies to us. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, reaches a business that meets one of three thresholds: more than 25 million dollars in annual gross revenue; buying, selling, or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50 per cent or more of annual revenue from selling or sharing personal information. This house meets none of them. It is pre-revenue, its invitation list is the small one this Site exists to gather — a first hundred — and it does not sell or share personal information at all.

We say that rather than implying a statutory duty we do not have, because a privacy notice that overstates its own legal basis is itself a misleading statement. What follows is not a recital of a law that binds us. It is the house choosing to honour the same rights anyway, as a matter of practice, for every visitor and not only for California residents. Every right below is one we will actually honour on request. None of it is decoration.

• Know and access. What we collect, why, who receives it, and the specific information we hold about your address. Articles 03, 06, 09 and 10 answer this in advance; ask, and we will answer it for your record specifically.
• Delete. As set out in Article 14.
• Correct. As set out in Article 14.
• Portability. A copy of what we hold, in a readable form. For an invitation address that is a short answer, and you will get it.
• Opt out of sale or sharing. There is nothing to opt out of: we do not sell or share personal information, and we do not run cross-context behavioural advertising. See Article 08 on Global Privacy Control.
• Limit the use of sensitive personal information. We collect none of the categories California treats as sensitive (Article 03), and we use none of them, so there is no Right to Limit control to offer here.
• No retaliation. We will not discriminate against you, deny you anything, or move you down any list for exercising any of these rights.

The categories, in the statute’s own terms. This Site collects two of the statute’s categories and no others: identifiers (an email address and an IP address), and internet or other electronic network activity information (a user-agent string and the ordinary request logs described in Article 07) — together with whatever you choose to put in correspondence you send us. All of it is collected from you directly and from nowhere else: we buy no lists, we run no enrichment, and we receive personal information from no third party. It is collected for the business purposes in Article 09, disclosed only to the categories of recipient in Article 10, and retained for the periods in Article 11. We collect no sensitive personal information, no biometric information, no geolocation beyond what an IP address implies, and no commercial, employment, education, or inference data.

California Online Privacy Protection Act. This notice is the notice that statute requires: the categories collected are in Article 03, the categories of third party are in Articles 06 and 10, the process for reviewing and requesting changes is in Article 14, the response to Do Not Track is in Article 08, the way we announce a change is in Article 18, and the effective date is on the letterhead above and in the record of versions below.

Other states. Several other United States privacy statutes confer similar rights, generally on businesses above thresholds this house also does not meet. Write to us anyway. We will handle the request in good faith and on the same terms as everyone else’s.

Article 16Visitors outside the United States

This Site is aimed at the United States. We do not advertise, price, offer, or ship outside it, we take no payment in any currency, and we publish in English only. On the usual targeting test, the European Union and United Kingdom General Data Protection Regulations are unlikely to reach a site in that posture. We are not going to lean on that. If you write to us from outside the United States, this is how we will treat you.

• Where the processing happens. In the United States. Our providers (Article 06) are United States companies and may operate in other locations; we do not direct any transfer of your information out of the United States for our own purposes. Data-protection rules where you live may differ from those here.
• Why we may lawfully process it. If rules of that kind apply to you, then: your consent is the basis on which we hold your address on the invitation list and write to you, and you may withdraw it at any time by any route in Article 04 without affecting what was lawful before you withdrew it; and our legitimate interest in running a site that is not overrun by automated abuse is the basis for the request logs and the form-integrity checks in Article 05. We have weighed that interest against yours and kept the data minimal and short-lived, which is what Article 11 is.
• Your rights. Access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent. Ask at info@novrafoods.com. We do not charge, and we do not ask you to justify the request.
• Automated decision-making. None that produces legal or similarly significant effects — see Article 17.
• Complaints. You may complain to your local supervisory authority, or in the United Kingdom to the Information Commissioner’s Office. We would rather you wrote to us first, but that is your right and not ours to gate.
• What we are not claiming. We do not hold a certification under the EU–US Data Privacy Framework or its United Kingdom extension, and we have not appointed a representative in the European Union or the United Kingdom. We say so rather than letting a boilerplate sentence imply otherwise. If that changes, this Article changes with it.

Article 17Automated decisions

We make no legal or similarly significant decision about you by algorithm on this Site. The form checks in Article 05 do automatically refuse a submission that looks automated, and a refusal is the only automated decision this Site makes. If you are a person and it refuses you, write to info@novrafoods.com and a person will put your address on the list by hand.

Allocation of any future invitation is a house decision made by people. It is not a credit, employment, housing, insurance, or education determination, and nothing here profiles you for one.

Article 18Changes to this notice

We may revise this notice by posting an updated version on this page with a new version number and a new effective date, and by adding a row to the record of versions at the foot of this page describing what changed. The current version and date are on the letterhead above.

If we make a material change to how we handle information we have already received — a new purpose, a new recipient, a longer retention period — we will not apply it to that information silently. We will say so on this page and, where the change is material and we hold an address for you, write to you at that address before it takes effect. Continued use of the Site after a change is posted means you are on notice of it for future browsing; it is not consent to a new use of information you gave us earlier.

Article 19Related notices

Read together with:

• Legal — terms of use, site notices and the invitation, brand identity, anti-impersonation, intellectual property, accessibility, disclaimers, limitation of liability, indemnity, governing law;
• the invitation notice beside the home-page form — a quick reference only. This page controls if the two are ever in tension on privacy detail.

Forward-looking brand statements (2027, arriving, the first hundred) are direction, not guarantees — see Legal.

Article 20Contact

Privacy, invitation-list, and removal correspondence: info@novrafoods.com

Useful subject lines: “Remove me”, “Privacy request”, “Shine the Light”, “Child’s information”, “Accessibility”.

Official site: https://novrafoods.com

Pacific Coast · United States

Novra Foods · Pacific Coast · English controlling