Privacy Notice
Operator
Navolith
Account and workspace data
Navolith stores the account information needed to authenticate users and provide cloud-saved workspace data. Project addresses, company profile information, protected quotes, inspection-readiness state, and—when Compliance is used—workforce, subcontractor, credential, renewal, verification-source, audit, and private compliance-document records may be associated with an account.
Guest use and temporary resolver cache
Guest workspace projects and company defaults are stored in the browser unless you create or sign in to an account. Address-resolution responses may also be cached on the Navolith server for up to 24 hours to reduce repeated third-party lookups, improve performance, and limit abuse. Clearing browser storage removes browser-only guest workspace data.
Private compliance documents
Compliance document uploads are stored outside the detected public web root when the Compliance Vault safety check passes. Downloads require an authenticated entitled account, an ownership check, and a request nonce. Navolith refuses new Compliance Vault uploads when private storage cannot be verified as outside the public document root.
Payment data
Navolith sends paid checkout and subscription-management activity to Stripe rather than collecting or storing raw card numbers. Navolith stores limited Stripe customer, checkout, subscription, price, and status identifiers needed to provision and reconcile access.
AI concierge
When Ask Navolith conversational assistance is enabled, text you submit to the concierge may be sent to OpenAI through a server-side API to generate a response. Navolith requests non-persistent API processing for concierge responses (store=false). Do not enter passwords, payment-card data, Social Security numbers, private compliance documents, or other sensitive information into the concierge. Project-specific permit and compliance determinations stay in source-backed Navolith workflows rather than generated chat answers.
Prospect outreach attribution
If a business recipient follows a Navolith prospect-outreach link, Navolith records the click against the internal prospect record and may set a first-party, HTTP-only attribution cookie for up to 30 days. The cookie contains an opaque signed campaign reference, not an email address or contact name, and is used to connect a later Navolith account signup or paid subscription to the outreach campaign. For attributed visitors, Navolith may also record whether a Permit Check was completed or the Guard workflow was opened so campaign drop-off can be measured. Navolith does not use email-open tracking pixels, keystroke capture, or session-replay recording in prospect outreach.
Contact and operational data
Contact requests are stored privately so the Navolith team can respond. Server logs and short-lived security controls may process IP addresses, request metadata, error information, and rate-limit counters to protect the service. Navolith does not retain the unnecessary signup/contact IP hashes used in earlier release candidates.
Retention and deletion
Temporary resolver cache entries expire automatically. Account, workspace, compliance, support, audit, and billing-reference records are retained while needed to provide the service, maintain security/audit history, satisfy business or legal obligations, or respond to support requests. You may request access, correction, export, or deletion review using the privacy contact below. Stripe and infrastructure providers may retain records under their own legal and security obligations.
Service providers
Navolith uses service providers for hosting/infrastructure, email delivery, Stripe payment/subscription processing, and—when enabled—OpenAI conversational assistance. These providers receive only the information needed for the applicable service.
Contact
Privacy requests: info@navolith.com
