Novi Innovations Ltd (Company Number: 16865816), registered at 16 Allandale Avenue, London, N3 3PJ ("Novi", "we", "us"), provides a focus mode management solution for UK secondary schools. Novi is registered with the Information Commissioner's Office (registration ZC169773) and has an appointed Data Protection Officer, Louis Domenic Harris (privacy@getnovi.co.uk).
2. Controller & Processor Roles
The school is the Data Controller: it determines the purposes and means of processing student data. Novi is the Data Processor: we process personal data only on behalf of the school, under a signed Data Processing Agreement (Article 28 UK GDPR).
3. What Data We Process
Data Type
Purpose
Retention
Student name
Identification by teachers
Duration of enrolment
Student email
Authentication
Duration of enrolment
School ID
School association
Duration of enrolment
Focus mode & presence status
Core functionality
Current value only, overwritten on each change
Last seen timestamp
Shows whether the device is active
Current value only, overwritten on each activity
Focus session history (start/end times, duration, and how each session ended: normal tap-out, school-day end, emergency exit, device restart, or attempted bypass, with battery level where relevant)
Keeps focus mode enforceable on students' own devices
Duration of enrolment; deleted on account removal
Emergency exit records (school-set allowance: exits per day and minutes per exit; timestamps and count used today)
Safety and accountability: using an exit notifies staff immediately; focus mode resumes when the granted time ends
Duration of enrolment; deleted on account removal
Timetable & class data (from the school's MIS via Wonde, where enabled)
Teachers see the class in front of them
Refreshed on each sync; deleted on account removal
Student photograph (from the school's MIS via Wonde, where enabled)
Brief on-screen identification by authorised staff
Never stored: streamed on demand, held in memory only
What we never collect: location data, browsing history, which apps a student uses, the content of messages or notifications, contacts, advertising identifiers, or any special category data. The student app contains no analytics, advertising, or crash-reporting software. The MIS-linked items above (timetable, class and photograph data) apply only where the school enables the integration; where it is not enabled, none of that data is processed at all. The Data Processing Agreement signed with each school states exactly which applies. A complete, source-code-verified inventory is available in our Student Data Collection Schedule; request it at privacy@getnovi.co.uk.
4. Age & the Children's Code
Novi for Schools has no age restriction: it is available to all students as directed by the school. As the app processes data of children, Novi is designed in accordance with the ICO's Age Appropriate Design Code (Children's Code). We do not use nudge techniques, profiling, or behavioural tracking. A full compliance statement mapping all fifteen standards of the Code is available on request. A plain-English version of this notice for students and parents is available under the Students & Parents tab above.
5. Lawful Basis
Schools may rely on Legitimate Interests (Article 6(1)(f)) or Public Task (Article 6(1)(e)) to process student data. Novi does not rely on student consent as the lawful basis. Schools are responsible for informing parents/students about data processing.
6. Data Sharing & Sub-processors
Sub-processor
Purpose
Location
Google Cloud Platform
Infrastructure
London, UK
Firebase Firestore
Database
europe-west2, UK
Firebase Cloud Functions
Server-side processing
europe-west2, UK
Firebase Authentication
User authentication (email, user ID)
Google multi-region (UK IDTA/SCC safeguards)
Firebase Cloud Messaging
Push notifications to teacher dashboards
Google multi-region (UK IDTA/SCC safeguards)
Google Workspace / Gmail
Invitation, verification and password reset emails
Google multi-region (UK IDTA/SCC safeguards)
Wonde
Timetable, class and photograph sync from the school's MIS (only where the school enables this integration)
UK
We do not sell data or share it with advertisers. Core application data is stored in UK data centres; the Google-operated identity, messaging and email services above may process limited identity data (email address, user ID, message tokens) outside the UK under UK-approved transfer safeguards.
7. Data Security
All data encrypted at rest (AES-256) and in transit (TLS 1.2 or higher; TLS 1.3 where supported)
Hosted in UK data centres (europe-west2, London)
Firebase security rules enforce school-level isolation: teachers can only see their own school's students
Two-factor authentication on teacher dashboard sign-in (emailed one-time codes)
Passwords never stored in plain text
Student photographs are never written to storage
Deletion and data-export operations are audit-logged (90-day retention)
Data breaches notified to the school within 24 hours
8. Data Subject Rights (UK GDPR)
Students and parents have the right to: Access, Rectify, Erase, Restrict processing, Data portability, and Object to processing. Rights requests should be directed to the school, who will instruct Novi as needed.
9. Data Deletion
School administrators can remove any student at any time; deletion removes the account and all associated history (sessions, integrity events, emergency exit records). All personal data is deleted or returned within 30 days of contract termination, with written certification available on request.
Novi Innovations Ltd (Company Number: 16865816), registered at 16 Allandale Avenue, London, N3 3PJ ("Novi", "we", "us"), provides a digital wellbeing application that helps users manage screen time through NFC-powered focus sessions.
Novi is the Data Controller of personal data collected via the consumer app.
2. What Data We Collect
Data Type
Purpose
Legal Basis
Name
Account identification
Legitimate interests
Email address
Account identification, verification, communication
Legitimate interests
Password (hashed)
Account security
Legitimate interests
Focus session records (start/end times, duration, the focus mode used, your device platform, and which Novi terminal you tapped, where you used one)
Your session history and stats
Legitimate interests
Focus goal preferences and focus mode names you create
Daily/weekly targets and your named modes
Legitimate interests
Emergency unlock counters (how many used this month)
Operate the monthly free-unlock allowance
Legitimate interests
Paired laptop details (computer name, hostname, platform, app version), only if you use laptop blocking
Link your laptops so focus sessions block them too
Legitimate interests
If you sign in via Google or Apple, your name and email are obtained from that provider.
We do NOT collect:
Location data (no GPS or location tracking of any kind)
Browsing history or which apps you use
Biometric data
Health data
Photos, videos, or messages
Contacts
Advertising identifiers
Social media account information
3. Age
Novi has no age restriction. The app is available to all users. We do not use nudge techniques, profiling, or behavioural tracking.
4. Legal Basis for Processing
We process personal data under Article 6(1)(f) of UK GDPR (legitimate interests). Our legitimate interest is to provide the focus management service that users have voluntarily opted in to. Users may withdraw at any time by deleting their account.
5. How We Use Your Data
Provide and operate the focus session functionality
Send account verification and password reset emails
Track focus session history and progress towards goals you set
Occasionally send you a recap of your own focus stats (such as "Novi Wrapped"); email privacy@getnovi.co.uk if you'd rather not receive these
Generate anonymised, aggregated usage statistics
We do not sell your data, share it with advertisers, profile you, or make automated decisions about you.
6. Data Sharing
Third Party
Purpose
Google Cloud / Firebase
Data storage and processing (UK, europe-west2)
Google OAuth (if selected)
Authentication only
Apple Sign-In (if selected)
Authentication only
Gmail SMTP
Verification and password reset emails
Participating venues (only where you tap in at that venue's Novi terminal)
The venue's dashboard shows session records for its own terminals: an account identifier, start/end times, duration and which terminal. Never your name or email.
If you post on our public feedback board, the display name and content you enter are visible to everyone; a shortened, hashed form of your IP address is used briefly for spam prevention.
We do not sell your data, share with advertisers, use data for marketing to third parties, or transfer data outside the UK/EEA (except Firebase Authentication, a global Google service; all other data is stored in UK data centres).
7. Data Security
All data encrypted at rest (AES-256) and in transit (TLS 1.3)
Hosted in UK data centres (europe-west2, London)
Firebase security rules restrict each user to their own data
Passwords never stored in plain text (handled by Firebase Authentication)
Focus session data stored against pseudonymised user IDs, not names or emails
8. Data Retention
Active accounts: Data is retained while your account exists.
Account deletion: Delete your account at any time via Settings → Delete Account, or by emailing privacy@getnovi.co.uk. Your account and all associated data (session history, paired devices, preferences) are permanently removed; session records held for participating venues are anonymised.
9. Your Rights (UK GDPR)
You have the right to:
Access your data
Rectify incorrect data
Erase your data ("right to be forgotten")
Restrict processing
Data portability (receive your data in a portable format)
Object to processing
Contact privacy@getnovi.co.uk to exercise any right. We will respond within 30 days.
10. NFC Tags
Novi NFC tags are passive devices containing no power source, battery, or personal data. They simply trigger the app to start or stop a focus session. No data is written to or stored on the tags.
11. Cookies and Analytics
The Novi app does not use cookies, advertising identifiers, or any third-party analytics. Some Novi emails (such as your "Novi Wrapped" recap) include a small image that tells us whether the email was opened, so we know if these are worth sending; nothing else is tracked, and you can opt out of recap emails at privacy@getnovi.co.uk.
What Novi is. Novi helps you focus at school. During the school day it pauses apps on your phone: you tap in on the app, or it starts automatically at the beginning of the school day if that's how your school runs it. At the end of the school day you tap out in the app and everything comes back.
What we know about you
Your name and school email, so your account works and your teacher knows who's who.
Whether focus mode is on or off, and when you tapped in and out.
How each focus session ended: a normal tap-out, the emergency exit, your phone restarting, or the blocking being switched off.
Only if your school turns this feature on: your class and timetable (from your school's system), so your teacher's screen shows their own class.
Only if your school turns this feature on: your school photo can appear on your teacher's screen so they can see who's who; we never keep a copy. If your school doesn't use this, we never see your photo at all.
What we can NEVER see
Where you are. There's no location tracking; Novi only knows when focus mode starts and ends, never where you are.
Your messages, photos, browsing, or anything you do on your phone.
Which apps you use. If a blocked app opens during focus mode, your phone shows a blocking screen; that stays on your phone.
Things you should know
Emergency exits. Your school decides how many emergency exits you get and how long they last. If you use one, your teacher is told, and focus mode comes back on when the time runs out. If you have run out and really need your phone, speak to a member of staff.
Only teachers at your school can see your information. We never sell it or use it for adverts: no ads, no tracking, nothing.
When you leave the school, your school can delete your account and everything that goes with it.
Who we are. Novi Innovations Ltd ("Novi") provides the Novi for Schools focus service to your child's school. The school decides to use Novi and remains the data controller for your child's information; Novi processes it only on the school's instructions, under a signed Data Processing Agreement. Novi is registered with the ICO (registration ZC169773) and has an appointed Data Protection Officer, Louis Domenic Harris (privacy@getnovi.co.uk).
What the service does. During the school day your child's phone goes into "focus mode", which blocks apps. Your child taps in on the app, or focus mode starts automatically at the beginning of the school day, depending on how the school runs it; tapping out is always done in the app. Teachers see a live dashboard showing which students are in focus mode. The school sets each student's emergency exit allowance (how many per day and how long each lasts); using one notifies a teacher immediately, and focus mode resumes when the granted time ends.
What data is processed
Name and school email address (provided by the school).
Focus mode and presence status, and a "last seen" timestamp.
Focus session history: when sessions started and ended, and how they ended (normal tap-out, end of school day, emergency exit, device restart, or an attempt to switch the blocking off), including battery level where relevant to explain an interruption.
Records of events that would defeat the blocking (e.g. the blocking VPN being disabled or the device clock being changed); these keep the system fair and working on students' own devices.
Where the school enables MIS integration (via Wonde): class and timetable information from the school's management system, so teachers see their own class.
Where the school enables MIS integration: the school photograph, displayed briefly to teachers for identification, streamed on demand and never stored by Novi. Where the integration is not enabled, no timetable, class or photograph data is processed at all.
What is NOT collected (verified against the app's source code): location or any form of tracking; browsing history; which apps your child uses; the content of messages or notifications; contacts; advertising identifiers. The app contains no analytics, advertising, or tracking software of any kind.
Where data is kept. In the United Kingdom (Google Cloud, London region). A small amount of account identity data (email address, account ID) is handled by Google's global authentication and messaging services under UK-approved international transfer safeguards.
How long it is kept. For the duration of your child's enrolment. The school can delete your child's account at any time, which removes all associated history. When the school stops using Novi, all data is deleted or returned within 30 days.
Your rights. Because the school is the data controller, requests to access, correct or delete your child's data should go to the school in the first instance; Novi supports the school in meeting them within statutory timescales. You can also contact Novi's DPO directly at privacy@getnovi.co.uk, or raise a concern with the ICO (ico.org.uk, 0303 123 1113).
Children's Code. The service is designed to conform to the ICO's Age Appropriate Design Code: data collection is minimised, there is no profiling, no nudge techniques, no advertising, and a full compliance statement is available from the school or from Novi on request.
Last updated: July 2026 · Novi Innovations Ltd, 16 Allandale Avenue, London N3 3PJ
