Navoy Privacy Policy

Navoy Technologies Inc. ("Navoy," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you access or use our website, mobile application, and related services (collectively, the "Services").

By using the Services, you agree to the practices described in this Privacy Policy.

We may collect information you provide directly to us, including your name, email address, account credentials, travel preferences, itinerary details, booking information, payment-related information necessary to process transactions, and communications with our support team.

We may also automatically collect certain technical information when you use the Services, including device type, operating system, browser type, IP address, pages viewed, referring URLs, usage patterns, and other analytics data.

When you create an account or sign in, we store your IP address and an approximate location (country and city) derived from it using a locally hosted geolocation database; both are refreshed each time you sign in. No third party receives your IP address for this purpose.

We use the information we collect to:

• Provide, maintain, and improve the Services;
• Create and personalize travel recommendations, itineraries, and experiences;
• Process account registration, authentication, and bookings;
• Communicate with you regarding updates, support, security notices, and marketing communications where permitted by law;
• Analyze usage, performance, and trends;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our agreements.

Navoy uses artificial intelligence, including large language models, machine learning systems, and generative AI technologies, to provide travel planning, recommendations, itinerary generation, personalization, and related features.

Your trip brief (destination, travel dates, who is traveling, budget, and any preferences or notes you write) is sent to third-party large-language-model providers and to n8n Cloud, our workflow-automation tooling, to generate your itinerary. We take reasonable measures to limit the personal information included in AI processing to what is necessary to provide the Services.

AI-generated recommendations and itineraries are provided for informational and planning purposes only and may contain inaccuracies, omissions, or outdated information. Users are responsible for independently verifying travel requirements, including visa requirements, passport validity, health advisories, entry restrictions, local laws, transportation schedules, pricing, and booking details before making travel decisions.

Navoy does not provide legal, immigration, medical, financial, or professional advice through its AI-powered features.

We share information with service providers and vendors who perform services on our behalf. The providers we currently use in the Navoy app and dashboard are:

• Analytics and monitoring: Mixpanel (product analytics), Google Analytics (usage measurement), and Sentry (error and performance monitoring, which may include your IP address and request details such as cookies).
• Sign-in: Google and Apple, when you choose to sign in with them.
• Maps and calendar: Google Maps Platform (place search, geocoding, and time zones) and Mapbox (trip maps); Google Calendar, only if you choose to add an itinerary to your calendar.
• Payments: Stripe (subscriptions and payment methods; we do not store card numbers).
• Travel booking: LiteAPI by Nuitee (hotels and flights) and Viator (activities; when you book an activity, your payment details are entered directly into Viator's secure form).
• AI and itinerary generation: third-party large-language-model providers and n8n Cloud, which receive your trip brief (including any free-text preferences) to generate itineraries.
• Email and messaging: Brevo and SmartPush (account emails, product updates, and marketing where permitted by law), and an email delivery service for verification, password reset, and booking confirmation emails.
• Images and feedback: Pexels and Unsplash (destination imagery loaded from their servers), and Google Forms if you use the in-app feedback form.
• Hosting and infrastructure: Microsoft Azure, Amazon Web Services, and MongoDB Atlas, in the United States.

Our marketing website additionally uses Mixpanel, Google Analytics, and Sentry, and Brevo for the waitlist and enterprise contact forms. We update this list when our providers change.

When you choose to make reservations, bookings, or travel-related purchases through the Services, relevant information may be shared with airlines, hotels, transportation providers, activity providers, online travel agencies, payment processors, and other travel partners necessary to complete the transaction.

We may also disclose information:

• To comply with legal obligations or lawful requests;
• To protect the rights, safety, and security of Navoy Technologies Inc., our users, or others;
• In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction.

Navoy Technologies Inc. does not sell personal information.

We and our partners use cookies, local storage, pixels, and similar technologies to remember preferences, keep you signed in, understand how the Services are used, and measure the effectiveness of marketing campaigns.

In the Navoy app and dashboard we use Mixpanel and Google Analytics to understand product usage, and Sentry to diagnose errors and performance problems. Analytics events are associated with your account; they are not sold. Mixpanel Session Replay is turned off in the Navoy mobile app; its sampling rate is set to 0%. On the web dashboard, a small sample of sessions may be replayed with all text and inputs masked. Sentry Session Replay is also turned off in the Navoy mobile app. On the web dashboard, Sentry may record a masked sample of sessions, and sessions in which an error occurs, to help us diagnose problems.

On our marketing website we may record sessions to understand how the site is used.

You can control cookies through your browser settings, although disabling certain cookies may affect the functionality of the Services. Mixpanel honors your browser's "Do Not Track" setting; other providers may not.

We retain personal information for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods may vary depending on the type of information and applicable legal requirements.

When you delete your account, the systems we operate keep only:

• Records that no longer identify you, for example trips with the link to your account removed. Content you wrote yourself, such as trip preferences, is retained in this de-identified form;
• Billing records we keep for accounting and legal obligations, such as invoices and the usage they cover; and
• A minimal record that the account was deleted, and limited security and audit logs.

Service providers that already received your information may keep it under their own retention policies, except where the steps listed under Deleting your account below remove it. For example, Mixpanel and Google Analytics may keep usage events recorded while you were signed in, and Sentry may keep error reports and session replays, which can include your IP address. Deleting your account resets the analytics identity on the device you delete it from, so later activity on that device is not linked to your account.

We implement administrative, technical, and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, loss, or destruction.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to:

• Access personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Request a copy of your personal information in a portable format;
• Object to or restrict certain processing activities;
• Withdraw consent where processing is based on consent; and
• Opt out of certain uses of personal information where applicable.

Deleting your account. You can delete your account yourself from inside the Navoy app and dashboard: open Profile, choose Delete account, and confirm. No email or support contact is needed. When you do:

• Your account is closed. Your name, email address, sign-in identifiers, and profile information are erased or replaced with anonymous placeholders;
• Your trips, itineraries, and bookings are detached from you;
• Your subscription is canceled and we ask Stripe to delete your customer record;
• Your contact is deleted from Brevo and overwritten with anonymous placeholders in SmartPush;
• We ask Mixpanel to delete your analytics profile, which holds your name and email address;
• Where we hold the necessary token, your Sign in with Apple authorization is revoked. You can also remove Navoy under Settings › Apple ID › Sign in with Apple.

You can also ask us to delete your account by emailing info@navoy.io.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including rights to know, access, correct, and delete certain personal information, and the right not to be discriminated against for exercising privacy rights.

To exercise any other applicable privacy rights, contact us at info@navoy.io. We will respond to verified requests within the timeframes required by applicable law.

Where required by applicable law, we process personal information based on one or more of the following legal grounds:

• Performance of a contract with you;
• Compliance with legal obligations;
• Legitimate business interests, including improving, securing, and operating the Services; and
• Your consent, where required.

The Services are not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13.

If you are under the age of 18, you may use the Services only with the involvement, supervision, or consent of a parent or legal guardian where required by applicable law.

If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete such information promptly.

If you believe we have collected information from a child under 13, please contact us at info@navoy.io.

Navoy Technologies Inc. is based in the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where Navoy Technologies Inc. or its service providers operate.

Where required by applicable law, we implement appropriate safeguards for international data transfers.

The Services may contain links to third-party websites, booking platforms, travel providers, or other services that are not operated by Navoy Technologies Inc.

When you interact with or book through third-party providers, your information may also be subject to those providers' privacy policies and terms.

We are not responsible for the privacy practices of third parties and encourage you to review their policies before providing personal information.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on our website and update the "Last Updated" date above.

Continued use of the Services following the effective date of an updated Privacy Policy constitutes acceptance of the revised Privacy Policy to the extent permitted by applicable law.

Your use of the Services is also governed by Navoy Technologies Inc.'s Terms of Use, which are incorporated by reference into this Privacy Policy.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Navoy Technologies Inc.
Email: info@navoy.io