Privacy Notice

1. What information do we collect?

In short: we collect personal information that you provide to us.

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect depends on the context of your interactions with us, the choices you make, and the products and features you use, and may include:

• Email addresses
• Contact or authentication data

Sensitive information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such information.

2. How do we process your information?

In short: we process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law, like with your consent, to comply with laws, to provide you services, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK

The GDPR and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. These include:

• Consent. You can withdraw your consent at any time (see “Withdrawing your consent” below).
• Performance of a contract, including providing our Services or at your request prior to entering into a contract with you.
• Legal obligations, such as cooperating with a law enforcement body or regulatory agency, or exercising or defending our legal rights.
• Vital interests, where necessary to protect your vital interests or those of a third party.

If you are located in Canada

We may process your information with your express or implied consent, which you may withdraw at any time. In some limited, legally permitted cases we may process information without consent — for example, for investigations and fraud prevention, certain business transactions, or where required by a subpoena, warrant, or court order.

4. When and with whom do we share your personal information?

In short: we may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. Do we offer artificial intelligence-based products?

In short: we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, “AI Products”). These tools are designed to enhance your experience and provide innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

Use of AI technologies

We provide the AI Products through a third-party service provider (“AI Service Provider”), including Anthropic. Your input, output, and personal information will be shared with and processed by this AI Service Provider to enable your use of our AI Products for the purposes outlined in this Privacy Notice. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI products

Our AI Products are designed for the following functions:

• AI automation
• AI deployment
• AI document generation
• AI research
• AI insights

How we process your data using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties, to safeguard your personal information throughout the process.

6. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if that isn’t possible, securely store it and isolate it from further processing until deletion is possible.

7. How do we keep your information safe?

In short: we aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized parties will never defeat our security. You should only access the Services within a secure environment.

8. Do we collect information from minors?

In short: we do not knowingly collect data from or market to children under 18 years of age.

By using the Services, you represent that you are at least 18, or the equivalent age of majority in your jurisdiction, or that you are the parent or guardian of such a minor and consent to that minor’s use of the Services. If we learn that we have collected personal information from a user under 18, we will deactivate the account and take reasonable measures to promptly delete that data. If you become aware of any such data, please contact us at agraham@gonavigato.com.

9. What are your privacy rights?

In short: depending on your state of residence in the US or region, you may have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (the EEA, UK, Switzerland, and Canada) you have certain rights under applicable data protection laws, which may include the right to: request access to and a copy of your personal information; request rectification or erasure; restrict processing; data portability; and object to certain processing, including not being subject to solely automated decision-making that produces legal or similarly significant effects without a path to human review. You can exercise these by contacting us (see “How can you contact us about this notice?” below).

If you are in the UK and unhappy with how we’ve handled your information, you can complain to us directly, or to the Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are in the EEA or UK, you may also complain to your Member State data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: where we rely on your consent to process your information, you have the right to withdraw it at any time by contacting us. This won’t affect the lawfulness of processing before the withdrawal, nor processing carried out on other lawful grounds.

10. Controls for do-not-track features

Most web browsers include a Do-Not-Track (“DNT”) feature you can activate to signal your preference not to have your online activity monitored. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to them. California law requires that we disclose this. If a legal standard for DNT is adopted, we will update this notice accordingly.

11. Do United States residents have specific privacy rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we maintain about you, correct inaccuracies, obtain a copy of, or delete it, and withdraw consent to our processing. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve months.

We use and retain Category A information for as long as you have an account with us. We have not disclosed, sold, or shared personal information to third parties for a business or commercial purpose in the preceding twelve months, and we do not sell or share personal information belonging to website visitors, users, or other consumers.

Your rights

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of processing used for targeted advertising, the sale of personal data, or certain profiling

Depending on your state, you may also have the right to access categories of personal data processed, obtain a list of categories or specific third parties we’ve disclosed data to, limit use of sensitive personal data, and review or correct automated profiling.

How to exercise your rights

To exercise these rights, contact us at agraham@gonavigato.com or by submitting a data subject access request. You may designate an authorized agent to act on your behalf, subject to proof of authorization. Upon receiving your request, we will need to verify your identity before processing it.

Appeals

If we decline to act on your request, you may appeal by emailing us at agraham@gonavigato.com. We will explain our decision in writing. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine the Light” law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. Submit such requests in writing using the contact details below.

12. Do other regions have specific privacy rights?

In short: you may have additional rights based on the country you reside in.

Australia and New Zealand

We collect and process your personal information under Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020. You may request access to or correction of your personal information at any time by contacting us. If you believe we are unlawfully processing your information, you may complain to the Office of the Australian Information Commissioner or the Office of New Zealand Privacy Commissioner.

Republic of South Africa

You may request access to or correction of your personal information by contacting us. If unsatisfied with our response, you may contact the Information Regulator (South Africa) at enquiries@inforegulator.org.za for general enquiries, or PAIAComplaints@inforegulator.org.za / POPIAComplaints@inforegulator.org.za for complaints.

13. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice or sending a direct notification. We encourage you to review this notice periodically.

14. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at agraham@gonavigato.com or contact us by post at:

15. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we’ve processed it, correction of inaccuracies, or deletion. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please submit a data subject access request.