This policy explains what personal data NAVORINA LLC, a Wyoming limited liability company ("Navorina", "we", "us"), collects through navorina.ai, the Navorina apps, the Telegram bot and Magic Inbox (the "Service"), why, who we share it with, and the choices you have. For your workspace data, we act as the controller. When a business uses Navorina to handle data about its own clients, that business is the controller and we process that data for it under our Data Processing Addendum.
We do not sell your personal data and we do not use it for advertising.
1. Data we collect
Account. Your email address, an optional name, your password (stored only as a hash by our sign-in provider) or your Google sign-in profile (name, email, picture), your plan and settings.
Workspace. What you add or import: invoices, quotes, clients and their contact details, transactions, accounts, budgets, categories, notes, files and your profile photo.
Magic Inbox. Emails you forward to your private Magic Inbox address: sender, recipients, subject, body and attachments such as receipts and invoices. We read them to pull out the merchant, amount, date and currency and to match them to your transactions. Emails from senders you have not approved are held for your review. Before we store a receipt photo, we remove its hidden metadata, such as location (GPS), camera model and capture time.
Telegram. If you connect the bot: your Telegram user and chat ID, username, and the messages and files you send to the bot.
Connected accounts.
- Wise: the personal API token you give us (stored encrypted), and the balances, rates and activity it can read.
- Xero: the OAuth tokens for your Xero organisation (stored encrypted) and the accounting data you choose to sync.
- Crypto: the public address of your own wallet and the signed message that proves you control it. We never ask for or store private keys or seed phrases.
- Transak and Stripe: order or subscription status and IDs. Card numbers are entered only on Stripe or Transak and never reach us.
Your clients' interactions. When a client opens a web invoice, we record that it was viewed and keep any comment they leave, so you can see the status. Invoice and reminder emails go to the addresses you enter.
AI features. The questions you ask and the parts of your workspace needed to answer them are sent to our AI provider to produce the answer. We keep redacted technical records of AI requests (model, timing, token counts, never the content) for 30 days, and monthly usage totals for 13 months.
Our own analytics. We do not use third-party analytics or advertising trackers. We count page visits by page, by the source label in the link (for example "twitter") and by country, and sign-up, onboarding and first-invoice steps. For signed-in users we also note, once a week, that the account was active, so we can see how many people come back. The country is the two-letter code our hosting provider derives from the connection; we do not store the IP address. Product steps and weekly activity are stored under a one-way hash of the account ID, never with an email or name. Error reports contain the page, the error type, a short scrubbed message and the script line.
Website statistics. Cloudflare Web Analytics counts page views, referrers, countries, browsers and page speed on navorina.ai. It sets no cookies and does not identify or follow visitors.
Technical data. Our hosting provider processes IP addresses and request logs to deliver and protect the Service. We use these only for security and reliability.
2. Why we use it
- to provide the Service you asked for: your account, workspace, invoices, Magic Inbox, the bot and integrations (performance of a contract);
- to keep the Service secure, prevent abuse and fix errors (legitimate interests);
- to send service emails: sign-in links, security alerts, invoice reminders you set up, weekly briefs you turned on (contract and legitimate interests);
- to understand and improve the product through our own aggregate reports, without cookies (legitimate interests);
- to bill paid plans and meet tax, accounting and legal obligations (legal obligation).
We do not use your workspace data or Magic Inbox emails to train AI models, and our AI provider does not use them for training under its API terms.
3. Who we share it with
We share data only with service providers who process it for us under contract, with the providers you connect yourself, or when the law requires it.
| Provider | What it does for Navorina | Data involved |
|---|---|---|
| Cloudflare | Hosting, database, file storage, email receiving for Magic Inbox, security, bot protection on sign-up, sign-in and waitlist forms (Turnstile), cookieless website statistics | All Service data, IP addresses; for Turnstile, browser and device signals during the check, without cookies for advertising |
| Supabase | Sign-in and user accounts | Email, password hash, Google profile, session data |
| Resend | Sending emails | Recipient address, email content |
| Telegram | The Navorina bot | Telegram IDs, messages to and from the bot |
| Stripe | Subscription billing | Email, plan, payment status; card details are entered with Stripe |
| OpenAI | AI answers | Your question and the workspace context needed for it |
| Wise | Your own Wise account, if you connect it | Token, balances, activity |
| Xero | Your own accounting, if you connect it | Accounting data you sync |
| Transak | Buying crypto, if you use it | You give your details to Transak directly; we receive order status |
| Request Network | Crypto invoice payments, when enabled | Invoice amount, your public wallet address |
| Company logos | Our server sends only the company's domain; your browser does not contact Google |
Fonts, scripts and photos on navorina.ai, including Unsplash images, are hosted by us as static files: your browser does not contact Google Fonts, public code CDNs or Unsplash. Exchange rates on our pages and tools are fetched by our server from official central bank sources (the European Central Bank via Frankfurter, and the NBG) and Kraken; your browser talks only to navorina.ai.
Public blockchains, such as Base, are public by design: a payment to your wallet address can be seen by anyone.
We may also disclose data to comply with law or a valid legal request, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
4. Where data is processed
NAVORINA LLC is a US company, and our providers process data in the United States and other countries. When we transfer personal data from the EU, UK or Switzerland, we rely on the providers' Standard Contractual Clauses or an equivalent safeguard.
5. How long we keep it
- Account and workspace data: while your account is open. After you close it, we delete it within 30 days, and it leaves our backups within a further 30 days.
- Magic Inbox emails and attachments, including those held for review: until you delete them or close your account.
- Connected-account tokens: until you disconnect the service or close your account.
- AI technical records: 30 days. Monthly usage totals: 13 months.
- Funnel counts, country counts, weekly activity marks and error reports: up to 13 months, without names, emails or IP addresses.
- Billing records: as long as tax and accounting law requires, usually up to 7 years.
6. Cookies and local storage
Navorina uses no analytics or advertising cookies and no third-party trackers, so there is no cookie banner. Your browser's local storage is used only for things the Service needs: keeping you signed in, your theme, a pending pilot invite and the source label of the link you came from (kept 30 days).
If we ever add analytics that sets cookies or identifies visitors, we will ask for your consent first where the law requires it and update this policy.
7. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it;
- export it in a common format;
- stop using it for our aggregate reports.
EU, UK and EEA (GDPR). You also have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time, and to complain to your local data protection authority.
California (CCPA/CPRA) and other US states. You have the right to know, delete, correct and port your personal information, and to opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information and do not share it for that kind of advertising. We will not treat you differently for using your rights.
To use any of these rights, write to [email protected] from the email on your account. We answer within 30 days (45 days where California law allows). We may need to confirm it is you. If a business manages your data in Navorina, we will pass your request to that business.
8. Security
We encrypt data in transit and encrypt integration tokens at rest, keep each workspace separate from others, limit staff access, and keep backups. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
9. Children
The Service is not for anyone under 18, and we do not knowingly collect their data.
10. Business customers: Data Processing Addendum
If you use Navorina for a company and process personal data of your clients or staff in it, our Data Processing Addendum applies and forms part of the Terms. Write to [email protected] for a copy to sign.
11. Changes
We will post any change here with a new effective date. If a change is material, we will tell you by email or in the app before it takes effect.
12. Contact
NAVORINA LLC, Wyoming, USA. Privacy questions and requests: [email protected].