# Privacy Policy

> How Navbatly and Karve Digital handle personal data: what is collected, whose data it is, cookies and analytics, who else processes it, how long it is kept and your rights.

- Canonical page: https://navbatly.com/privacy
- Language: en-GB
- Last reviewed: 29 October 2026
- Maintained by: Karve Digital (hello@karvedigital.com)

How Navbatly handles personal data: what we collect, whose data it is, who else processes it, how long we keep it and the rights you have. Last updated 29 October 2026.

## Who we are

Navbatly is made and run by Karve Digital, a web studio at Building A2, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. You can reach us at [hello@karvedigital.com](mailto:hello@karvedigital.com). In this policy, "we" and "us" mean Karve Digital.

It covers Navbatly: this website, the app, the request links teams share with their clients, the emails the app sends and its MCP server for AI assistants. Karve Digital's own website has [its own terms](https://karvedigital.com/en/terms-and-conditions).

## Whose data it is

Agencies and freelancers use Navbatly as a team. The team decides what it records about its clients and their people: contacts, tickets, messages, files, hours and reports. For that data the team is the controller and Karve Digital is its processor: we hold and process it on the team's behalf, only to run the service for the team.

For the accounts of people who sign up, for this website and for our own records of how the service runs, Karve Digital is the controller.

If you are a client of a team that uses Navbatly, ask that team first about your data. We will help it answer.

## What we collect

| Data | What it includes | Where it comes from |
| --- | --- | --- |
| Accounts | Name, email address, password (stored only as a one-way hash), two-factor authentication secret and recovery codes if you turn it on, passkeys (the public key and its details, never your device's private key), and the teams you belong to with your role. | You, when you sign up and in your settings. |
| Team data | Clients and their contacts (names, email addresses, roles), contracts and plans, projects, tickets with their descriptions, replies, internal notes and attachments, labels, time entries, client actions and monthly reports. | The team's members. |
| From a team's clients | What someone sends through a client's request link: their name, email address, message and files, and approvals or requests for changes. When a team has tickets by email on, what a client emails to the app's addresses (a ticket's reply address or the team's ticket inbox): the sender's name and email address, which is kept on the reply or ticket, the subject, the message without the quoted history, and its files. | The team's clients. |
| Emails | Emails the app sends: to a team's clients (replies, requests for client actions, reminders, reports, pause notices) and to its members (invitations, notices and an optional daily summary), kept with the ticket or record they belong to, and whether a reply could be sent. | The app. |
| Logs | The server's records of requests (IP address, the address requested, browser), of errors, and of emails to the app's addresses it dropped (who sent them, and to which address). | Your browser and the server. |
| AI assistants | When you connect one: its OAuth client record and the access tokens it was given. | You, when you connect it. |
| Website use | See [cookies](#cookies) and [Google Analytics](#google-analytics). | Your browser. |

## How we use it

To run the service: show each team its data, keep every team's data apart from every other team's, and send the emails its members and clients ask for.

To keep it secure and working: sign-in, two-factor authentication and passkeys, limits on repeated sign-in attempts and on request-link submissions, and error logs.

To support you, and to tell you about changes to the service, this policy or our terms.

We do not sell personal data, use team data for advertising, or use it to train AI models.

For people in the UK or the EU, we rely on our contract with you (accounts and the service), on our legitimate interest in running a secure and reliable service (logs, security and administering accounts), and on the team's instructions for its clients' data.

## What we see of teams

To run the service, keep it secure, support you and spot abuse, the people at Karve Digital who run it can see a list of the teams that use it: each team's name, when it was created, its owner's name and email address, how many members, clients and tickets it has, and the date of its latest ticket or reply. They can also see how many people sign up each month. We rely on our legitimate interest in running the service for this. The list shows no ticket text, replies, files, client names or contacts. Each time someone opens it we record who, when, from which IP address and what they searched for, and keep that record for a year.

We do not read a team's tickets, replies, files or its clients' details. We look at them only when the team asks us to help with something, when the law requires it, or to investigate a security problem or a breach of our terms, and then only as much as that needs.

## Cookies and similar storage

The app and clients' request links set only the essential and preference cookies below. No advertising cookies.

| Name | Why | How long |
| --- | --- | --- |
| `olfii-session` | Essential. Keeps you signed in and ties your requests together. | Two hours without activity, or until you sign out. |
| `XSRF-TOKEN` | Essential. Protects forms from cross-site request forgery. | Two hours. |
| `remember_web_…` | Essential, only if you tick "Remember me" when you sign in. Keeps you signed in on that device. | Until you sign out. |
| `appearance` | Preference. Light, dark or system theme. Also kept in your browser's local storage. | One year. |
| `sidebar_state` | Preference. Whether the app's sidebar is open. | Seven days. |
| `_ga`, `_ga_…` | Analytics, on this website's public pages only. Set by Google Analytics. | Up to two years. |

## Google Analytics

This website's public pages use Google Analytics to count visits and see which pages help people. The app, clients' request links and the Markdown versions of the pages never load it.

It records the pages you view, the page you came from, your device, browser and screen, an approximate location worked out from your IP address, and a random ID kept in the `_ga` cookies. Google describes its own use in [its privacy policy](https://policies.google.com/privacy).

There is no consent choice on this website yet; we are adding one. Until then you can block cookies for this site in your browser, use a content blocker, or install [Google's opt-out add-on](https://tools.google.com/dlpage/gaoptout).

## Who else processes it

These providers process personal data only to provide their part of the service.

| Provider | What for | Where |
| --- | --- | --- |
| DigitalOcean | The server that runs the app, its database and the files you upload. | Frankfurt, Germany |
| Ploi | Manages that server and runs deployments, with access to it. | The Netherlands (company), Europe (hosting) |
| Cloudflare | DNS and the network that carries traffic to this website. | Cloudflare's global network |
| Mailgun | Sends the app's emails, and receives the emails sent to the app's addresses and passes them to the app. | United States |
| Google | Google Analytics on this website's public pages. | Google's global infrastructure |
| Bunny Fonts | The font on the page where you approve an AI assistant. Bunny says it keeps no logs and sets no cookies. | Europe |

An AI assistant you connect is your choice, and its provider handles what it reads under its own terms (see below).

## AI assistants

You can connect an AI assistant, such as Claude, to Navbatly through its MCP server. You sign in and approve it with OAuth; it then acts with your access, in the teams you belong to and with your role's permissions, so it can read and change what you can.

What it reads is sent to the assistant's provider and handled under that provider's terms. You choose which assistant to connect and are responsible for it. You can disconnect it at any time.

## How long we keep it

Your account: until you delete it in your profile settings.

Team data: for as long as the team keeps it. A ticket or a team that is deleted stays in a recoverable state; ask us at [hello@karvedigital.com](mailto:hello@karvedigital.com) and we will erase it for good. Uploads never attached to anything are removed after a day, files no longer used in any text are removed daily, and expired invitations are deleted.

Sessions end after two hours without activity. Error logs, and the record of dropped emails, are kept for 14 days. Records of who opened Karve Digital's list of teams are kept for a year. Server request logs are kept for a short time.

## Security

Every page is served over HTTPS. Passwords are stored only as one-way hashes, two-factor authentication and passkeys are available, request links and invitations use long random codes, repeated sign-in attempts are limited, and every query in a team's pages is limited to that team. The list of teams Karve Digital sees is described [above](#what-we-see).

No system is perfectly secure. If you find a problem, tell us at [hello@karvedigital.com](mailto:hello@karvedigital.com).

## International transfers

Karve Digital is in the United Arab Emirates, the server is in Germany, Mailgun sends and receives email in the United States, and Cloudflare and Google run worldwide. Where data protection law requires it, we rely on the safeguards those providers offer for transfers, such as standard contractual clauses.

## Your rights

You can ask to see the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. The UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives these rights, and so do the UK GDPR and the EU GDPR for people in the UK and the EU.

Email us at [hello@karvedigital.com](mailto:hello@karvedigital.com) and we will reply within a month. If your data belongs to a team (you are one of its clients or their contacts), we will pass your request to that team and help it answer.

You can also complain to a data protection authority: the Information Commissioner's Office in the UK, or the authority where you live in the EU.

## Children

Navbatly is a tool for businesses and is not meant for children.

## Changes to this policy

We will post any change here and update the date at the top. If a change matters to you, we will tell account holders by email before it applies.

## Contact

Karve Digital, Building A2, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email [hello@karvedigital.com](mailto:hello@karvedigital.com). Our [Terms and Conditions](https://navbatly.com/terms) say how you may use Navbatly.