Legal
Privacy Policy
How Navbatly handles personal data: what we collect, whose data it is, who else processes it, how long we keep it and the rights you have.
Last updated 29 October 2026.
Who we are
Navbatly is made and run by Karve Digital, a web studio at Building A2, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. You can reach us at [email protected]. In this policy, "we" and "us" mean Karve Digital.
It covers Navbatly: this website, the app, the request links teams share with their clients, the emails the app sends and its MCP server for AI assistants. Karve Digital's own website has its own terms.
Whose data it is
Agencies and freelancers use Navbatly as a team. The team decides what it records about its clients and their people: contacts, tickets, messages, files, hours and reports. For that data the team is the controller and Karve Digital is its processor: we hold and process it on the team's behalf, only to run the service for the team.
For the accounts of people who sign up, for this website and for our own records of how the service runs, Karve Digital is the controller.
If you are a client of a team that uses Navbatly, ask that team first about your data. We will help it answer.
What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Accounts | Name, email address, password (stored only as a one-way hash), two-factor authentication secret and recovery codes if you turn it on, passkeys (the public key and its details, never your device's private key), and the teams you belong to with your role. | You, when you sign up and in your settings. |
| Team data | Clients and their contacts (names, email addresses, roles), contracts and plans, projects, tickets with their descriptions, replies, internal notes and attachments, labels, time entries, client actions and monthly reports. | The team's members. |
| From a team's clients | What someone sends through a client's request link: their name, email address, message and files, and approvals or requests for changes. When a team has tickets by email on, what a client emails to the app's addresses (a ticket's reply address or the team's ticket inbox): the sender's name and email address, which is kept on the reply or ticket, the subject, the message without the quoted history, and its files. | The team's clients. |
| Emails | Emails the app sends: to a team's clients (replies, requests for client actions, reminders, reports, pause notices) and to its members (invitations, notices and an optional daily summary), kept with the ticket or record they belong to, and whether a reply could be sent. | The app. |
| Logs | The server's records of requests (IP address, the address requested, browser), of errors, and of emails to the app's addresses it dropped (who sent them, and to which address). | Your browser and the server. |
| AI assistants | When you connect one: its OAuth client record and the access tokens it was given. | You, when you connect it. |
| Website use | See cookies and Google Analytics. | Your browser. |
How we use it
To run the service: show each team its data, keep every team's data apart from every other team's, and send the emails its members and clients ask for.
To keep it secure and working: sign-in, two-factor authentication and passkeys, limits on repeated sign-in attempts and on request-link submissions, and error logs.
To support you, and to tell you about changes to the service, this policy or our terms.
We do not sell personal data, use team data for advertising, or use it to train AI models.
For people in the UK or the EU, we rely on our contract with you (accounts and the service), on our legitimate interest in running a secure and reliable service (logs, security and administering accounts), and on the team's instructions for its clients' data.
What we see of teams
To run the service, keep it secure, support you and spot abuse, the people at Karve Digital who run it can see a list of the teams that use it: each team's name, when it was created, its owner's name and email address, how many members, clients and tickets it has, and the date of its latest ticket or reply. They can also see how many people sign up each month. We rely on our legitimate interest in running the service for this. The list shows no ticket text, replies, files, client names or contacts. Each time someone opens it we record who, when, from which IP address and what they searched for, and keep that record for a year.
We do not read a team's tickets, replies, files or its clients' details. We look at them only when the team asks us to help with something, when the law requires it, or to investigate a security problem or a breach of our terms, and then only as much as that needs.
Google Analytics
This website's public pages use Google Analytics to count visits and see which pages help people. The app, clients' request links and the Markdown versions of the pages never load it.
It records the pages you view, the page you came from, your device, browser and screen, an approximate location worked out from your IP address, and a random ID kept in the _ga cookies. Google describes its own use in its privacy policy.
There is no consent choice on this website yet; we are adding one. Until then you can block cookies for this site in your browser, use a content blocker, or install Google's opt-out add-on.
Who else processes it
These providers process personal data only to provide their part of the service.
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | The server that runs the app, its database and the files you upload. | Frankfurt, Germany |
| Ploi | Manages that server and runs deployments, with access to it. | The Netherlands (company), Europe (hosting) |
| Cloudflare | DNS and the network that carries traffic to this website. | Cloudflare's global network |
| Mailgun | Sends the app's emails, and receives the emails sent to the app's addresses and passes them to the app. | United States |
| Google Analytics on this website's public pages. | Google's global infrastructure | |
| Bunny Fonts | The font on the page where you approve an AI assistant. Bunny says it keeps no logs and sets no cookies. | Europe |
An AI assistant you connect is your choice, and its provider handles what it reads under its own terms (see below).
AI assistants
You can connect an AI assistant, such as Claude, to Navbatly through its MCP server. You sign in and approve it with OAuth; it then acts with your access, in the teams you belong to and with your role's permissions, so it can read and change what you can.
What it reads is sent to the assistant's provider and handled under that provider's terms. You choose which assistant to connect and are responsible for it. You can disconnect it at any time.
How long we keep it
Your account: until you delete it in your profile settings.
Team data: for as long as the team keeps it. A ticket or a team that is deleted stays in a recoverable state; ask us at [email protected] and we will erase it for good. Uploads never attached to anything are removed after a day, files no longer used in any text are removed daily, and expired invitations are deleted.
Sessions end after two hours without activity. Error logs, and the record of dropped emails, are kept for 14 days. Records of who opened Karve Digital's list of teams are kept for a year. Server request logs are kept for a short time.
Security
Every page is served over HTTPS. Passwords are stored only as one-way hashes, two-factor authentication and passkeys are available, request links and invitations use long random codes, repeated sign-in attempts are limited, and every query in a team's pages is limited to that team. The list of teams Karve Digital sees is described above.
No system is perfectly secure. If you find a problem, tell us at [email protected].
International transfers
Karve Digital is in the United Arab Emirates, the server is in Germany, Mailgun sends and receives email in the United States, and Cloudflare and Google run worldwide. Where data protection law requires it, we rely on the safeguards those providers offer for transfers, such as standard contractual clauses.
Your rights
You can ask to see the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. The UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives these rights, and so do the UK GDPR and the EU GDPR for people in the UK and the EU.
Email us at [email protected] and we will reply within a month. If your data belongs to a team (you are one of its clients or their contacts), we will pass your request to that team and help it answer.
You can also complain to a data protection authority: the Information Commissioner's Office in the UK, or the authority where you live in the EU.
Children
Navbatly is a tool for businesses and is not meant for children.
Changes to this policy
We will post any change here and update the date at the top. If a change matters to you, we will tell account holders by email before it applies.
Contact
Karve Digital, Building A2, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email [email protected]. Our Terms and Conditions say how you may use Navbatly.