Navaa uses the providers below to deliver the service. Each is bound by contract to appropriate security and confidentiality obligations. We do not sell personal data, and we do not share it for advertising.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All account and workspace data | Tokyo, Japan |
| Railway | Hosting for the web application, API and admin console | All application traffic, IP addresses, server logs | United States |
| Meta Platforms Ireland Ltd | WhatsApp Business Platform message delivery | Phone numbers, message content in both directions, verification codes | Ireland and United States |
| OpenAI, L.L.C. | Interpreting bot messages and powering task search | Bot message text, recent conversation, workspace member names, date and timezone, task titles and descriptions | United States |
| Resend | Transactional and service email | Recipient email addresses, email content | United States |
| ImageKit | Private storage for support screenshots | Screenshot images | United States |
| Razorpay Software Private Limited | Payment processing, once paid plans begin. Not active during the free beta | Payment details entered at checkout, billing contact details, order amounts | India |
| Google LLC | Sign in with Google | Google account email, name, profile picture link, Google user ID | Mumbai, India |
Independent controllers
Razorpay and Google act as independent controllers for the data they collect directly from you, under their own privacy policies, rather than as our processors. We list them here so you have a complete picture of who handles your data.
OpenAI
Data sent through OpenAI's API is not used to train or improve its models. We have not opted in to any training programme. OpenAI retains API data for up to 30 days for service operation and abuse detection, unless legally required to retain it longer. Details of exactly what is and is not sent are in section 3 of the Privacy Policy.
Notice of changes
We will notify subscribers by email at least 30 days before adding or replacing a sub-processor.