Privacy Policy

2.1 Information you provide directly

• Full name and email address (account creation)
• Child profile information: name, age, grade, challenges, behaviour observations (provided by parent only)
• AI coach conversation content
• Behaviour log entries and mood tracking
• Payment information (processed by Stripe — we never store card numbers or banking details)
• Support messages and communications

2.2 Information collected automatically

• Device type, browser, operating system
• IP address and approximate location (city level)
• Pages visited and features used
• Session duration and interaction patterns
• Google Analytics data (anonymized)

2.3 Information we do not collect

• We never collect information directly from children — Navio is for parents only
• We do not collect Social Insurance Numbers, government IDs, or sensitive financial data
• We do not collect biometric data

We use your information exclusively to:

• Create and manage your Navio account
• Power the AI parenting coach with personalized context from your child’s profile
• Generate your personalized parenting journey and track recommendations
• Send transactional emails (account confirmation, password reset, billing receipts)
• Send weekly parenting tips and product updates (you can opt out at any time)
• Process subscription payments through Stripe
• Provide customer support
• Improve the platform based on usage patterns
• Comply with legal obligations

We do not use your information for:

• Selling to third parties
• Advertising or marketing to third parties
• Profiling children
• Any purpose not listed above

We share your information only with:

4.1 Service providers (data processors)

• Supabase (Supabase Inc., USA) — database and authentication infrastructure
• Anthropic (Anthropic PBC, USA) — AI language model powering the parenting coach
• Voyage AI (USA) — content matching and retrieval system
• Stripe (Stripe Inc., USA) — payment processing
• Resend (USA) — transactional email delivery
• Cloudflare (Cloudflare Inc., USA) — hosting and content delivery
• Google Analytics (Google LLC, USA) — anonymized usage analytics

All service providers are contractually bound to process your data only as instructed and to maintain appropriate security measures.

4.2 Legal requirements

We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.

4.3 Business transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We never sell your personal information.

5.1 Where your data is stored

Your data is stored on Supabase infrastructure, primarily in the United States. By using Navio, you consent to this transfer and storage.

5.2 Security measures

• All data is encrypted in transit using TLS/SSL
• Databases are encrypted at rest
• Access to production data is restricted to authorized personnel only
• Regular security assessments are conducted
• Payment data is handled exclusively by Stripe and never touches our servers

5.3 Data retention

• Account data: retained while your account is active and for 90 days after deletion
• Conversation history: retained for 12 months or until you request deletion
• Payment records: retained for 7 years as required by Canadian tax law
• Analytics data: retained for 26 months (Google Analytics default)

6.1 Under Quebec’s Law 25 (Bill 64) and PIPEDA, you have the right to:

• Access: Request a copy of all personal information we hold about you
• Rectification: Correct inaccurate or incomplete information
• Erasure: Request deletion of your personal information (“right to be forgotten”)
• Portability: Receive your data in a structured, machine-readable format
• Withdraw consent: Opt out of non-essential data processing at any time
• Object: Object to certain types of processing
• Lodge a complaint: File a complaint with the Commission d’accès à l’information (CAI) of Quebec

6.2 How to exercise your rights

6.3 Data portability

You can request an export of all your Navio data (profile, child profiles, conversation history) at any time from Settings → Privacy & Security → Export your data.

Navio is designed exclusively for parents and adults (18+). We do not knowingly collect personal information directly from children.

Child profile information (name, age, challenges) is provided by parents and is used solely to personalize the coaching experience for that parent. Children do not have accounts on Navio and cannot access the platform.

If you believe we have inadvertently collected information from a child, please contact us immediately at [email protected].

8.1 Cookies we use

• Authentication cookies: Required to keep you logged in (session management)
• Preference cookies: Remember your language and display preferences
• Analytics cookies: Google Analytics (anonymized, can be opted out)

8.2 How to control cookies

You can disable cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in to Navio.

8.3 Do Not Track

Google Analytics 4 does not respond to browser Do Not Track signals. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout

Navio may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any information.

We may update this Privacy Policy from time to time. When we make significant changes:

• We will notify you by email at least 30 days before the changes take effect
• We will display a prominent notice on the platform
• The updated date at the top of this page will be revised

Your continued use of Navio after changes take effect constitutes acceptance of the updated policy.

Data Controller

For privacy complaints