Privacy policy
What data this service processes, why, for how long, and what you can do about it.
Updated on Aug 26, 2026
Data controller
- Controller: Ivan Rodrigo
- Contact: irodrigob@gmail.com
The two roles of this service
Worth separating, because they change who decides what:
- For your account data (who you are, how you sign in, which organization you belong to) we are the controller. This policy covers it.
- For the content you upload to your knowledge bases your organization is the controller: it decides which documents get indexed and who may query them. We act as a processor, handling that content only to provide the service and following its instructions.
What data we process
Account data
Name, email address, password (always stored hashed, never in clear text), preferred language for emails, the organizations you belong to and your role in each. If you enable two-factor authentication, the TOTP secret and your backup codes.
Organization content
The documents you upload, the text extracted from them, the chunks and their vector representations (embeddings), and the related metadata: file name, size, processing status and who uploaded it. Also the AI provider and storage credentials your organization configures, stored encrypted and never shown again by the service.
Usage and security data
IP address and technical request data, access timestamps, error logs and sign-in attempt counters. They keep the service running and let us detect and stop abuse: rate limiting and temporary account lockout after repeated failed attempts.
What we do NOT keep
- Conversations in the Ask section are not stored. The history lives in your browser for the duration of the conversation and travels with each request; close it and it is gone.
- No analytics, no advertising, no profiling, no automated decision-making about people.
- We do not sell or share data with third parties for commercial purposes.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you and keeping your session | Performance of a contract |
| Providing the service: indexing documents, searching them and answering questions | Performance of a contract |
| Sending operational email: verification, password reset, invitations | Performance of a contract |
| Protecting accounts: rate limiting, temporary lockout, security logs | Legitimate interest in the security of the service |
| Meeting legal and accounting obligations | Legal obligation |
Cookies and browser storage
This site uses no analytics, advertising or third-party cookies, and loads no external resources: fonts are served from our own domain. That is why you will not see a consent banner: every cookie here is either strictly necessary to provide the service or stores a preference you chose yourself, and those are exempt from consent.
| Name | What it does | Lifetime |
|---|---|---|
better-auth.session_token | Keeps you signed in. It is an identifier; the data lives on the server | Until you sign out or it expires |
better-auth.two_factor | Links your password to your second-factor code during sign-in | 10 minutes |
navidev_language | Remembers the language you picked | 1 year |
sidebar_state | Remembers whether you left the side menu open or collapsed | 7 days |
Two more preferences are kept in your browser's local storage and never sent to any server:
the light or dark theme (navidev-theme) and the last setup of the Ask screen
(navidev_chat_config).
You can clear all of it from your browser at any time. Clearing the session cookie signs you out; clearing the rest only forgets your preferences.
Who we share it with
Only the providers needed to run the service, each under a processor agreement:
- Hosting and infrastructure: OVH Cloud, with servers in data centres located in the European Union.
- AI providers: when your organization configures its own credential (OpenAI, for example), the text of your documents and questions is sent to that provider, chosen by your organization, under its own account and terms.
- Object storage: if your organization configures its own bucket, documents are stored there, under its control.
How long we keep it
Account data and content, for as long as the account is active. Deleting a document, a knowledge base or the organization also deletes its chunks and vectors. Technical security logs are kept for 90 days. After that, everything is deleted or anonymized, except what we must keep by law.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw any consent you have given. Write to irodrigob@gmail.com.
Much of it needs no email at all: account data can be edited from My account, and documents are deleted from their knowledge base.
If you believe your request was not handled properly, you can lodge a complaint with your national data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).
Security
All traffic is encrypted (HTTPS). Passwords are hashed and can never be recovered. Provider credentials are encrypted and never shown again. Each organization is isolated from the others: a request only ever reaches its own data. You can enable two-factor authentication in Security and review which applications have access in Connections.
Changes to this policy
If something relevant changes, this page and the date in its header are updated. When the change affects how your data is processed, we will also let you know by email.