Privacy Policy

NAVI Business OS is provided by [To be confirmed: legal entity name, enterprise registration number, address] (“NAVI”). This policy applies to the NAVI website, the NAVI web application and our support channels.

Under the concepts of Vietnamese law on personal data protection, NAVI has two different roles:

• The party that determines the purposes of processing for account data, website usage data, payments and support inquiries.
• The party that processes data on the instructions of the customer business for the operational data that the business enters into its workspace (customers, employees, finances…). For this data, the customer business is the party that determines the purposes and means of processing.

Data processing agreement (DPA) between NAVI and the customer business: [To be confirmed: DPA template].

Data you provide

• Account: full name, email, phone number (if any), job title, department. Passwords are stored only in one-way encrypted (hashed) form.
• Workspace: company name, industry, department structure, configuration, time zone, currency.
• Operational data: customers, leads, deals, quotes, campaigns, income and expense transactions, receivables and payables, employee records, leave requests, projects, tasks, tickets, attachments, comments.
• Support contacts: the content of emails and the information you send us.

Data generated when you use the Service

• Technical logs: access times, IP address, device and browser type, system errors.
• Audit logs: who performed which action, when, and on which record; sensitive information is filtered out before being logged.
• Usage metrics: modules used, number of active users, storage used — for billing and product improvement.

Payment data

Plan, invoices, payment status. Card or bank account details are processed by the payment gateway; NAVI does not store full card numbers.

Sensitive data

Data such as salaries, performance reviews or financial information is protected by separate permissions, and only people who have been granted access can view it. Businesses should enter only the sensitive data that is genuinely needed for their work.

• To provide, operate and maintain the Service according to the plan the Customer uses.
• To authenticate and secure accounts, prevent password guessing and detect unusual access.
• To send necessary notifications: assigned tasks, approval requests, invitations, changes to the terms, payment information.
• To support you when you contact us.
• To charge fees, issue invoices and reconcile payments.
• To improve the product based on usage metrics in aggregated form.
• To comply with our legal obligations.

We do not sell personal data and do not use your operational data for advertising.

• Performance of the service contract between NAVI and the Customer.
• Your consent, for example when enabling AI features or non-essential cookies. You may withdraw your consent at any time.
• Legal obligations, for example retaining payment records as required by regulations.
• For operational data: the instructions of the customer business. The business is responsible for having a lawful basis (notice, consent) with respect to its own employees and customers.

• Each business has its own workspace. Every record is tied to a business ID taken from the login session; IDs sent by the browser are not trusted. One business cannot view, edit, search or export another business’s data — including through file links or background jobs.
• Within a workspace, access is granted by role and scope (own records, team, department, entire company); access is denied by default.
• NAVI administrators manage plans, payments and incidents, and do not automatically access your business data. When support is needed, access takes place only with your permission, is limited in scope and time, and is logged.

• AI features only operate when the business enables them for each department and gives consent.
• AI only reads data within the permissions of the user making the request, within that same workspace; data is not used across businesses.
• Each AI run is recorded (who requested it, what it did, its cost) so that it can be reviewed when needed.
• Use of data to train models, and AI model providers: [To be confirmed: training policy and providers].

We share data only with parties that help operate the Service, to the extent necessary and subject to confidentiality commitments:

• Cloud infrastructure: storage and backup of data and files.
• Email delivery services: invitations, notifications, password resets.
• Payment gateway: collection of recurring fees.
• AI model providers: only when the business enables AI.
• Error and performance monitoring tools: no personal data or secret keys are sent to them.

List of sub-processors (name, country, purpose): [To be confirmed: the list will be published before the Service is officially offered and updated whenever it changes]. We provide data to government authorities only upon a lawful request.

Data storage location: [To be confirmed: country/region of storage]. If data is transferred outside Vietnam, NAVI will carry out the procedures and protective measures required under Vietnamese law.

• Account data and operational data: retained for as long as the workspace is active.
• After the account is closed: the Customer has [To be confirmed: number of days] to export its data, after which the data is deleted from the primary systems; backups are deleted on a rotation cycle of [To be confirmed: backup cycle].
• Audit logs and security logs: [To be confirmed: retention period].
• Payment records and invoices: for the periods required by accounting and tax laws.

• Encryption of data in transit and at rest.
• Two-factor authentication for administrators, limits on failed login attempts, login session management.
• Least-privilege permissions for both users and the NAVI team.
• Regular backups and data recovery drills.
• System logs do not record passwords, secret keys or unnecessary personal data.

If an incident affecting personal data occurs, we will notify the affected businesses and the competent authorities within the time limits prescribed by law.

Under the law on personal data protection, you have the right to:

• Be informed of what data is processed and why.
• Give or withdraw consent.
• Access and correct your data.
• Request deletion or restriction of processing, or object to processing.
• Receive a copy of your data (data export).
• Lodge complaints and denunciations, and claim compensation, in accordance with regulations.

For operational data managed by your company (for example, employee records), please send your request to your company — the party that decides how that data is processed. NAVI will assist the company in fulfilling the request. For account data, contact NAVI directly as set out in Section 14. We respond within the time limits prescribed by law.

NAVI uses necessary cookies to keep you signed in and for security. If we use analytics or marketing cookies, we will ask you first, and you can decline them and still use the Service normally.

The Service is intended for businesses, not for children. If a business enters data relating to children (for example, an educational institution), the business is responsible for having the consent of a parent or guardian as required by regulations.

When we change this policy, we update the date at the top of this page and notify workspace Owners before any significant change takes effect. See also the Terms of Use.

Questions or requests about personal data: [email protected]. Personal data protection point of contact: [To be confirmed: responsible person or department].