Summary of Privacy Principles Novus ERP is enterprise software built and maintained by Dataicraft (Private) Limited. We treat corporate financial records, employee payroll data, and supply-chain transactions with absolute confidentiality. We do not sell corporate data, monetize commercial telemetry, or feed proprietary business transactions into shared machine learning models.

Effective Date: October 1, 2026
Published by: Dataicraft (Private) Limited ("Dataicraft", "we", "us", or "our")

1. Scope and Applicability

This Privacy Policy outlines the policies and practices of Dataicraft (Private) Limited regarding the collection, processing, storage, and protection of information when organizations, administrators, and end-users interact with:

The public Novus ERP website (https://novuserp.dataicraft.com/)
The Novus ERP cloud management console and customer portal (https://novus.dataicraft.com/)
Managed cloud and on-premises software deployments of Novus ERP
Novus ERP mobile applications and native point-of-sale clients

2. Customer Data Ownership & Roles

Under enterprise operational standards and relevant data protection laws, the Customer organization is the Data Controller of all business records entered into Novus ERP. Dataicraft acts strictly as the Data Processor.

You retain 100% legal ownership of your general ledger entries, customer accounts, vendor invoices, tax records, employee biometric attendance logs, payroll calculations, and warehouse inventory data. We do not inspect, monetize, or disclose your production records except as strictly required to deliver support, maintain system uptime, or comply with statutory requirements under Pakistani law.

3. Information We Collect

3.1. Website & Demo Inquiries

When you request an enterprise demonstration, submit a contact form, or subscribe to release notes, we collect your name, business email address, company name, phone number, and estimated company size. This information is used solely to evaluate your business requirements and facilitate sales correspondence.

3.2. Authentication & System Audit Data

Within Novus ERP application instances, the system logs user authentication events, IP addresses, browser user-agents, role-based permission changes, and transaction timestamps. This audit trail is retained inside your dedicated tenant database to guarantee internal controls and regulatory non-repudiation.

3.3. Financial & Tax Compliance Data

To enable the FBR Digital Invoicing module, Novus ERP formats sales tax invoices and transmits mandatory parameters (NTN, CNIC, buyer registration status, item HS codes, invoice amounts, and sales tax values) to the Federal Board of Revenue's official API endpoints. This transmission occurs strictly at the instruction and configuration of your authorized accounting officers.

4. AI Governance & Machine Learning Confidentiality

Novus ERP features native AI report intelligence and natural language financial inquiry. Our AI architectural principles guarantee that:

No Public Model Training: Your private financial journals, inventory valuations, and strategic operational metrics are never used to train, tune, or improve public third-party foundation models.
Isolated Query Contexts: AI inquiries operate through localized semantic catalogues. Prompts, schemas, and analytical responses are transient and bounded within your organization's authenticated session.
Zero Autonomous Posting: The AI engine has read-only analytical access. It cannot post, modify, or delete journal entries or invoices without affirmative human sign-off.

5. Multi-Tenant Isolation & Technical Security

Dataicraft enforces defense-in-depth security across every layer of the Novus ERP platform:

Data Isolation: Managed cloud instances implement strict schema separation and role-based row-level security (RLS) ensuring that tenant data cannot intersect.
Encryption: All data in transit is encrypted using modern TLS 1.3 cryptographic suites. Data at rest is encrypted using AES-256 standards across database partitions, object storage, and automated backups.
Access Controls: Administrative access to production hosting infrastructure is restricted to authorized Dataicraft engineers via hardware security keys, multi-factor authentication (MFA), and short-lived bastion credentials.
Continuous Backups: Database transactions are archived using Write-Ahead Logging (WAL) and encrypted redundant storage snapshots, enabling point-in-time recovery for disaster resiliency.

6. Third-Party Integrations & Courier Logistics

Novus ERP connects natively with verified external services including Shopify and logistics partners (such as PostEx, Leopards, and Trax). When these connectors are enabled:

Shipping addresses, recipient telephone numbers, and Cash-on-Delivery (COD) values are securely passed to courier APIs solely to generate consignment tracking air waybills.
OAuth tokens and API credentials are encrypted with tenant-specific keys in our secret vaults.

7. Data Retention and Deletion

We retain customer operational data for the duration of the active enterprise service agreement. Upon contract termination or formal deletion request:

A full cryptographic archive of your SQL database and associated media assets is made available for secure export.
Upon verified export confirmation, all live and replica databases are securely purged from primary storage within thirty (30) business days, followed by automated lifecycle expiration across secondary tape/cold backups.

8. Contact & Privacy Officer

If you have questions regarding this Privacy Policy, enterprise data handling, or wish to exercise your data subject rights, please contact our security and compliance team: