Privacy Policy.

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Aggregated Data means data that has been de-identified, anonymized, or aggregated so that it does not identify You, Your organisation, or any individual, and from which Your identity cannot reasonably be re-established.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Navaris Technology Ltd, Company Number 16946648, registered in England and Wales at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to the United Kingdom (where the Company is incorporated) and Australia, the jurisdictions in which the Service is currently offered.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website and the Navaris business intelligence platform, including the workspaces created within it.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to the Navaris website, accessible from https://www.getnavaris.com/
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Company name and company size
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service. Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data. We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
• Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser. You can learn more about cookies here: HTTP cookie - Wikipedia. We use both Session and Persistent Cookies for the purposes set out below:

• Necessary / Essential Cookies
  • Type: Session Cookies
  • Administered by: Us
  • Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.
• Cookies Policy / Notice Acceptance Cookies
  • Type: Persistent Cookies
  • Administered by: Us
  • Purpose: These Cookies identify if users have accepted the use of cookies on the Website.
• Functionality Cookies
  • Type: Persistent Cookies
  • Administered by: Us
  • Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

For more information about the cookies we use and your choices regarding cookies, please visit our Cookies Policy or the Cookies section of our Privacy Policy.

Website analytics and performance monitoring

Our Website uses the following third-party analytics and performance monitoring tools. These tools may collect information such as Your IP address, browser type, pages visited, time spent on pages, and device or connection type.

• Vercel Analytics (Vercel Inc., United States) — collects anonymised page-view and visitor-flow data to help us understand how visitors use the Website. Vercel acts as a data processor and handles this data in accordance with its Privacy Policy.
• Vercel Speed Insights (Vercel Inc., United States) — collects Core Web Vitals and page-load performance metrics (such as connection type and device category) to help us monitor and improve Website performance.
• Google Tag Manager (Google LLC, United States) — a tag management platform used to deploy and manage scripts on our Website. Google Tag Manager itself does not set cookies or collect personal data independently, but may load third-party tags that do. You can manage Google's use of data via Google's Ads Settings.

Data accessed from Google services

If You connect Your Google Drive or Gmail account, Navaris will access:

• Google Drive (drive.readonly scope) - read-only access to file metadata (names, folder structure, modified dates) for files You select to ingest. Navaris downloads the contents of selected files to extract text, index it for search, and render the documents within Your workspace. We do not list, read, or process any Drive file You have not explicitly added.
• Gmail (gmail.readonly scope) - read-only access to messages and attachments matching the search query You configure. Navaris extracts message content and attachments solely for inclusion in Your workspace.

Files and emails ingested through Google APIs are stored on Navaris's infrastructure for the lifetime of Your workspace. You can delete individual items at any time, disconnect Your Google account from the Service, or request deletion of Your entire account by emailing legal@getnavaris.com. In either case, the corresponding Google-sourced content is removed from our systems within 30 days.

Data accessed from Microsoft services

If You connect Your Microsoft OneDrive or SharePoint account, Navaris will access:

• OneDrive / SharePoint (Files.Read.All scope) - read-only access to file metadata and contents for items You select to ingest into Your workspace.
• User.Read scope - read-only access to Your Microsoft account profile (name and email address) to identify the connected account.

If You connect Your Microsoft Outlook account, Navaris will access:

• Outlook (Mail.Read scope) - read-only access to messages and attachments matching the search query You configure for inclusion in Your workspace.
• User.Read scope - read-only access to Your Microsoft account profile to identify the connected account.

Files and emails ingested through Microsoft APIs are stored on Navaris's infrastructure for the lifetime of Your workspace. You can delete individual items, disconnect Your Microsoft account, or request deletion of Your entire account by emailing legal@getnavaris.com. The corresponding Microsoft-sourced content is removed from our systems within 30 days.

Navaris will not use data received from Microsoft APIs to serve advertisements, allow unauthorised third-party access, or train generalised AI or machine learning models.

Data accessed from other connected services

Navaris supports connections to additional business tools from which You may choose to ingest documents and data into Your workspace. These currently include:

• HubSpot - read-only access to CRM objects (deals, companies, contacts, and line items) You authorise, used to populate Your workspace.
• Xero - read-only access to accounting data (invoices, contacts, profit-and-loss reports, balance sheets, and attached files) You authorise.
• Box - read-only access to files and folders You select to ingest.
• Dropbox - read-only access to files and folders You select to ingest.
• DocuSign - read-only access to signed envelopes (documents) in folders You select, including envelope metadata and combined PDF documents.
• Stripe - read-only access to subscription, invoice, and customer records from Your connected Stripe account, using a restricted API key You configure. Navaris uses this data solely to populate financial information in Your workspace.
• Joiin - read-only access to consolidated financial reports (trial balance, profit & loss, balance sheet, and cashflow) from Your Joiin organisation, using an API key You configure. Navaris uses this data solely to populate financial information in Your workspace.
• Companies House - read-only access to publicly registered information about the UK company You configure as a source, including the company profile, officer appointments (active and resigned), persons with significant control (PSC), registered charges, and insolvency records. Navaris uses this data solely to populate corporate governance information in Your workspace. This data is sourced from the UK's public companies register via a platform API key; it includes personal data about named officers and PSC individuals (names and appointment details).
• Website indexing — if You configure a website source, Navaris crawls and indexes the text of publicly accessible pages at the URL You specify (up to the depth and page count You set). No login or credentials are required; Navaris does not crawl any URL You have not explicitly added as a source.

Data ingested from these services is stored on Navaris's infrastructure for the lifetime of Your account and is subject to the same retention, deletion, and security commitments described in this Privacy Policy. You can disconnect any integration or request deletion of Your account by emailing legal@getnavaris.com.

Personal data about individuals who are not Navaris customers

Some connected sources produce personal data about individuals who have no direct relationship with Navaris — they did not sign up for the Service and did not provide their data to us directly. Two categories arise today:

• Company officers and persons with significant control (PSC) — when a customer connects a Companies House source, Navaris reads the UK public register and derives structured records for each named director, secretary, and PSC individual. The fields stored are: full name, nationality, country of residence, and occupation. This data is drawn from the public companies register; the individuals concerned are required by law to have their details published there. Our lawful basis for processing this data is legitimate interests (UK GDPR Art. 6(1)(f)): the customer has a legitimate need to maintain an accurate, always-current record of their company's governance, and the same information is already publicly accessible. We rely on the exemption at UK GDPR Art. 14(5)(b) — providing individual notices to each officer or PSC would involve disproportionate effort relative to the benefit, given the public-register nature of the data. Individuals may nonetheless contact us at legal@getnavaris.com to request access, rectification, or erasure of the record we hold about them; we will respond within one month.
• CRM contacts — when a customer connects a HubSpot source, Navaris reads CRM contact records and derives structured person records for each contact. The fields stored are: first name, last name, and email address. Our lawful basis for processing this data is legitimate interests (UK GDPR Art. 6(1)(f) / Privacy Act 1988 APP 3.4): the customer has a legitimate interest in having their commercial relationships reflected in their business intelligence record, and CRM contacts have a reasonable expectation that their details are managed by the companies they deal with using business software. We do not use CRM contact data to contact those individuals or for any purpose other than building and presenting the customer's business record. Individuals may contact us at legal@getnavaris.com to request access, rectification, or deletion of any record we hold about them.

For Australian users: personal information in both categories may be held on servers located outside Australia (see "Transfer of Your Personal Data" below). We take reasonable steps to ensure overseas recipients handle it consistently with the Australian Privacy Principles (APP 8.1).

Board pack and investor update analysis

Navaris offers an invite-only tool that analyses a board pack or investor update You submit and produces a summary of performance, suggested questions for investors and recommended improvements to the report. When You use it, We collect and store:

• The document You submit, either an uploaded PDF or pasted text. Board packs and investor updates can contain personal data about other people, such as the names of employees, customers or investors. Only submit a document You are entitled to share with Us for this purpose.
• Request details, being the invite link used, the IP address the request came from and the date and time of the request.
• The analysis, together with the full exchange with the AI model that produced it, including the instructions sent, a summary of the model's reasoning and its output.

The document is sent to Anthropic (Anthropic, PBC, United States) for analysis. Anthropic acts as a data processor under contractual terms that prohibit it from using Your data to train or improve its general AI models. Documents, analyses and request details are stored on Navaris's infrastructure.

Members of the Navaris team are notified of each submission by email, through our email service provider, with a link to its analysis. The team can view submitted documents, analyses and AI exchanges to monitor the quality of the tool, support the people using it and improve the Service.

Each analysis is available at a private link. Anyone who has that link can view the results, so share it only with people You want to see them.

Our lawful basis for this processing is legitimate interests (UK GDPR Art. 6(1)(f)), namely providing the analysis You requested and improving the tool. We keep submitted documents, analyses and request details until You ask Us to delete them, so that the results link continues to work. To request deletion, email legal@getnavaris.com and We will remove them within 30 days.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.
• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
• To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide You with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
• To manage Your requests: To attend and manage Your requests to Us.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

Navaris will not use information received from Google APIs (including Google Drive content and Gmail messages) to send marketing communications, to analyse the effectiveness of promotional campaigns, or for any purpose other than providing the user-facing features of the Service.

We do not sell Your personal information. We may share Your personal information in the following limited situations:

• With Service Providers: We may share Your personal information with Service Providers who help us operate, deliver, secure, and support the Service (for example, infrastructure hosting, error monitoring, and customer support).
• Within the Navaris group: We may share Your information with affiliates, subsidiaries, and regional deployment entities under common control with Navaris Technology Ltd, in each case bound by this Privacy Policy.
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Navaris will not share, transfer, or sell data received from Google APIs with advertisers, data brokers, or any third party for purposes unrelated to providing the user-facing features of the Service.

Aggregated and Anonymized Data

We may create Aggregated Data from Your Personal Data, Usage Data, and other information processed through the Service. We may use and retain Aggregated Data for any lawful business purpose, including to analyse, benchmark, secure, and improve the Service, develop new features, and produce statistics and research. Because Aggregated Data does not identify You, it is not Personal Data and is not subject to the restrictions of this Privacy Policy. We will not attempt to re-identify Aggregated Data and will use reasonable measures to keep it de-identified. Navaris will not use data received from Google APIs - including Google Drive content and Gmail messages - to develop, improve, or train generalised AI or machine learning models. Any AI or machine learning processing of Google API data is solely to provide user-facing features visible in the Service (for example, search, retrieval, and content extraction for documents You have explicitly added to Your workspace).

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

The knowledge record built from Your connected sources is maintained as a versioned, append-only graph. When a source file or document is deleted, the underlying file content and text index are removed within 30 days. However, derived analytical facts (structured records, relationships, and entities extracted from that content and stored in the knowledge graph) are not automatically deleted when a source file is removed — they persist as part of the company record and are removed in full only when the entire account is terminated. If You wish to have specific derived facts removed before account termination, contact us at legal@getnavaris.com.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to - and maintained on - computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction. Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

For users located in Australia, We take reasonable steps to ensure that any overseas recipients of Your Personal Information handle it consistently with the Australian Privacy Principles (APP 8.1). By using the Service and accepting this Privacy Policy, You also consent to the transfer of Your Personal Information to overseas recipients where necessary to provide the Service (APP 8.1(c)).

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Your Rights Over Your Personal Data

You have rights over the Personal Data We hold about You. The specific rights available to You depend on where You are located. To exercise any of these rights, email legal@getnavaris.com. We may need to verify Your identity before acting on a request.

United Kingdom (UK GDPR and Data Protection Act 2018)

If You are in the United Kingdom, You have the following rights under the UK GDPR:

• Access: request a copy of the Personal Data We hold about You.
• Rectification: ask Us to correct Personal Data that is inaccurate or incomplete.
• Erasure: ask Us to delete Your Personal Data, subject to legal retention obligations.
• Restriction: ask Us to restrict the processing of Your Personal Data in certain circumstances.
• Portability: ask Us to provide Your Personal Data in a structured, commonly used, machine-readable format, or to transmit it to another controller where technically feasible.
• Objection: object to processing of Your Personal Data based on Our legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on Your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to a valid request within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if You believe We have not handled Your Personal Data in accordance with the law.

Australia (Privacy Act 1988 and the Australian Privacy Principles)

If You are in Australia, You have the following rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):

• Access (APP 12): request access to the Personal Information We hold about You.
• Correction (APP 13): ask Us to correct Personal Information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Anonymity and pseudonymity (APP 2): where lawful and practicable, interact with Us anonymously or under a pseudonym.
• Opt out of direct marketing (APP 7): request that We stop using or disclosing Your Personal Information for direct marketing.
• Raise a privacy concern: notify Us of any concern about how We have handled Your Personal Information.

We will acknowledge Your request promptly and aim to respond within 30 days. If You are not satisfied with Our response, You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers. If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Google API Services User Data Policy

Navaris's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Navaris commits that we will not:

• Use Google user data to serve advertisements;
• Allow humans to read the data, except (a) with Your affirmative consent for specific messages, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations, and only where the data has been aggregated and anonymised;
• Transfer or sell Google user data to third parties for advertising or data brokerage; or
• Use Google user data for any purposes other than providing or improving user-facing features that are prominent in the Service's user interface.

AI-powered features and third-party LLM providers

Navaris uses a large language model (LLM) API in the following features. In each case, document text or knowledge-graph context derived from Your connected sources is sent to a third-party LLM provider. Depending on how a deployment is configured, this provider is either OpenAI (OpenAI, L.L.C., United States) or Anthropic (Anthropic, PBC, United States). Both providers act as data processors under contractual terms that prohibit them from using Your data to train or improve their general AI models.

• Document search and Q&A — when You ask a question, relevant text excerpts retrieved from Your indexed documents are sent to the LLM to generate an answer.
• Document fact extraction — when a document type is configured for automatic fact extraction (for example, a pitch deck), the document's text is sent to the LLM to derive structured facts for the knowledge record. This runs in the background when a document is processed.
• Document review — when You request an AI review of a linked document, the document text and a relevant slice of the knowledge record are sent to the LLM to generate a structured critique.
• Agent assistants — Navaris's in-platform agent chat feature sends document excerpts and knowledge-record context retrieved during a conversation turn to the LLM to generate responses.
• Board pack and investor update analysis — the full document You submit to the analysis tool is sent to Anthropic to produce the analysis, as described in "Board pack and investor update analysis" above.
• Field answer suggestions — when You ask Navaris to suggest answers to a workspace question, a short excerpt of Your knowledge record relevant to that question is sent to the LLM to propose options. Nothing is written to Your record until You accept a suggestion.

Document text embeddings used for search are generated locally within Navaris's infrastructure using an on-device model; only the text excerpts retrieved for each specific query or processing action described above leave the deployment.

Content received from Google APIs (Google Drive and Gmail) may be included in these LLM requests solely to provide the user-facing features described above, consistent with Navaris's Google API Limited Use commitments.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page. We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us at legal@getnavaris.com