Documentation
Your data: what is stored and how to export it
What the personal-data export contains and excludes, how a privacy request is handled, and how long each kind of record is kept.
Last reviewed against the product on .
The privacy centre is where you take a copy of your data or ask for something to be done with it. This page describes what the product does: what the export contains, what it leaves out, and what submitting a request does and does not set in motion. The privacy notice remains the authoritative document for who the operator is, the grounds it relies on, who receives data, and how to complain.
Identity is your session
There is no separate verification step and no form asking who you are. The page is reached only with an active session, and every query on it is filtered to the account that session belongs to. A signed-out visitor is redirected to sign-in and never sees the page.
The export
One link on the privacy centre returns the whole thing as a JSON file. It is served as a download
named novus-personal-data.json, with cache headers marking it private and forbidding storage, so
no shared cache keeps a copy of a file that is by definition about one person.
| Section | What it holds | Which organizations |
|---|---|---|
| profile | Name, email address and verification state, role, country, region, city, timezone, locale, currency, measurement system, terms and privacy-notice acceptance, created and updated times | Not organization-scoped |
| memberships | Every organization you belong to, with your role, whether it is your default, and whether it is active | All of them |
| imports | Import runs you uploaded: file name, status, parsed, inserted and rejected row counts, rights confirmation | Current only |
| actions | Action items you created, with status, priority and due date | Current only |
| supplierAssessments | Supplier assessments you created | Current only |
| planningScenarios | Planning scenarios you created | Current only |
| privacyRequests | Every request you have submitted, with its status, target date and any response notes | Current only |
| accessTokenMetadata | Token name, prefix, scope, last use, expiry, revocation and creation times | Current only |
Measured from the eight queries in app/api/privacy/export/route.ts.
- Exports allowed
- 6 per hour
- per user, counted in the database rather than in memory
- Burst brake
- 60 per minute
- per address, applied before the session is looked up
- Format version
- 1
- stamped in the file beside the time it was produced
Measured from app/api/privacy/export/route.ts and DURABLE_POLICIES.personalDataExport in src/lib/security/api-rate-limit.ts.
That is the tightest read quota on the site, and it is deliberate: this single response is the highest-value one the site can produce, so a session used to drain an account in a loop should not get far. A person exercising a data right does it once and keeps the file, and six covers a retry, a second device, and a mistake.
Requests
The same page submits access, correction, deletion, restriction and objection requests. A request is free text describing what you want, recorded against your account and the organization you are in.
| Rule | What happens |
|---|---|
| Types accepted | access, correction, deletion, restriction, objection |
| Detail length | Between 10 and 2,000 characters |
| Open requests per type | One. A second of the same type, while one is open or in progress, is refused. |
| Target date | 30 days from submission, shown on the request itself |
| Cancelling | Available while the request is still submitted. Once it moves to in progress, the control is gone. |
Measured from submitPrivacyRequest in app/app/privacy/actions.ts and the form in app/app/privacy/page.tsx.
The target date is a target. The form states the qualification in the same breath and it is worth repeating here: a response is subject to identity verification, lawful extensions, and applicable exceptions.
How long things are kept
- Raw market observations
- Up to 24 months
- for the daily, dekadal and fortnightly series
- Longer series and aggregates
- Kept
- monthly and annual series and compact aggregates, for historical comparability and provenance
- Account and tenant records
- Until removed
- by deletion, an organization instruction, or while a documented legal or security hold applies
Measured from the retention section of the privacy notice at /privacy.
Deleting an organization cascades its saved report snapshots and supplier-match decisions with it. Sessions and access tokens can be revoked at any time, passwords are stored hashed, and tenant records are separated server-side rather than by what a page chooses to show, which is the subject of how organizations work.
Measurement and advertising are a separate decision
Nothing on this page governs analytics or advertising. Those are consent decisions, made in cookie settings and described in the cookie policy, and no analytics request is made before analytics consent is granted. A browser sending Global Privacy Control is neither measured nor shown personalised advertising, whatever the regional default would be. Advertising and consent covers the rest, including why an account does not remove advertising.
What to read when this page is not enough
The privacy notice carries what a product page should not paraphrase: the operator and its jurisdiction, the purposes and grounds relied on, the providers that receive data, the contact address for questions, and the supervisory authority to approach if an answer does not satisfy you. Where this page and that notice differ, the notice is correct and this page is the defect.