Legal

Privacy Policy

Effective date: October 23, 2026 · Last updated: October 23, 2026

This Privacy Policy explains how Navi collects, uses, shares and protects personal data when you visit naviproperty.com, use the Navi Sales workspace, sign in with Google or Apple, connect Google Calendar, or interact with a property viewer powered by Navi.

1. Who we are

Navi is operated by DUŠAN STEVIĆ PR STUDIO ZA GRAFIČKI DIZAJN DARK ROOM STUDIO NIŠ, a sole proprietorship (preduzetnik) registered with the Serbian Business Registers Agency under registration number 64267485, tax ID (PIB) 109563027, with its registered address at Božidarčeva 20/4, 18000 Niš, Serbia (“Navi”, “we”, “us”).

Contact for privacy matters: [email protected].

2. Our two roles

Navi is a software tool that property developers use to present and sell their projects. We are not a real-estate broker or seller, and we do not decide how developers use the information their buyers share with them. That gives us two different roles:

  • We are the controller for personal data about our own customers and their team members (“Users”), visitors to naviproperty.com, and people who contact us. Most of this policy is about that data.
  • We are a processor for personal data that developers collect from home buyers and other visitors (“Buyers”) through a Navi-powered property viewer, the AI assistant, and the Navi CRM. For that data, the developer is the controller and we process it only on their instructions, under a Data Processing Addendum. If you are a Buyer, please contact the developer whose project you viewed to exercise your rights; we will help them respond. Section 7 describes what we process on their behalf.

3. Data we collect as controller

Account data. Name, business email, phone number, company name, role, password hash (if you do not use Google or Apple sign-in), and your workspace settings.

Sign in with Google. If you choose it, Google shares with us your name, email address, profile picture and a Google account identifier. We request only the openid, email and profile scopes for sign-in.

Sign in with Apple. If you choose it, Apple shares with us an Apple user identifier, your email address — or, if you choose to hide it, a private relay address ending in @privaterelay.appleid.com — and your name the first time you sign in. We store your name at that moment because Apple does not send it again.

Google Calendar data. If you connect Google Calendar, see section 5.

Billing data. Self-service subscriptions are sold by our reseller Paddle (Paddle.com Market Limited), which acts as merchant of record and collects your payment details directly; we receive your billing name, company, country, tax ID, plan and payment status, but never your full card number. For invoiced plans we hold the billing contact and company details you give us.

Communications. Messages you send us, walkthrough requests submitted through our website form, and support tickets.

Usage and device data. IP address, browser and device type, pages and features used, error logs, and timestamps, collected when you use naviproperty.com or the Sales workspace.

Website analytics. See our Cookie Policy.

  • Create and secure your account, sign you in. Data used: Account, Google or Apple sign-in data. Legal basis: Contract.
  • Provide the Sales workspace, inventory, CRM, calendar and reporting. Data used: Account, usage, Calendar data. Legal basis: Contract.
  • Bill you and keep accounting records. Data used: Billing data. Legal basis: Contract; legal obligation.
  • Provide support and answer requests. Data used: Communications. Legal basis: Contract; legitimate interest.
  • Keep the service secure, prevent abuse, fix errors. Data used: Usage and device data. Legal basis: Legitimate interest.
  • Understand how our website is used. Data used: Analytics, only as described in the Cookie Policy. Legal basis: Consent.
  • Send product and service announcements to customers. Data used: Account data. Legal basis: Legitimate interest; you can opt out at any time.
  • Comply with law and respond to lawful requests. Data used: Any relevant data. Legal basis: Legal obligation.

We do not sell personal data, do not use it for third-party advertising, and do not use it to make decisions that have legal or similarly significant effects on you.

5. Google user data

This section applies when you sign in with Google or connect Google Calendar.

What we access. For sign-in: your name, email address, profile picture and Google account identifier. For Calendar sync: we create, update and delete only the events Navi manages — viewings, calls and tasks assigned to you — in a dedicated “Navi” calendar that we create in your Google account. We do not read your other calendars or events.

How we use it. Only to sign you in and to provide the calendar sync feature you turned on. We do not use Google user data for advertising, we do not sell it, and we do not use it to determine creditworthiness.

AI and model training. We do not use Google user data to develop, train or improve any artificial-intelligence or machine-learning model, and we do not send Google user data to our AI provider.

Who can see it. Google user data is visible to you and to members of your workspace with whom you share the related viewing or task. Navi staff do not read it unless you ask us to for support, it is necessary to investigate a security incident or abuse, or the law requires it.

Sharing. We transfer Google user data only to the service providers that host and operate Navi (section 9), only to provide the feature, under contracts that bind them to the same restrictions; to comply with law; or as part of a merger or acquisition after asking for your consent.

Storage and security. Google user data and OAuth tokens are encrypted in transit and at rest and stored on servers operated by Hetzner in Helsinki, Finland (EU).

Retention and deletion. We keep calendar event data while sync is on. You can disconnect Google Calendar at any time in your Navi settings or at myaccount.google.com/permissions; we then revoke our token and delete stored tokens and calendar data within 30 days. Events already written to your Google Calendar stay there until you delete them. When you delete your Navi account we revoke all Google tokens and delete your Google user data as described in section 11.

Limited Use. Navi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Sign in with Apple

If you chose to hide your email, we only ever see your private relay address, and our emails reach you through Apple’s relay. We do not try to discover your real address. You can stop using Sign in with Apple for Navi at any time in your Apple ID settings under “Sign in with Apple”. Doing so does not delete your Navi account; to delete it, see section 11. When you delete your Navi account we also revoke our Apple tokens.

7. Data we process for developers (Buyer data)

When a Buyer uses a Navi-powered viewer, the developer may collect, and we process on their behalf:

  • contact details the Buyer submits (name, email, phone) and their stated budget, requirements and messages;
  • conversations with the AI assistant;
  • saved units and shared links;
  • interactions in the viewer, such as units opened and filters used — recorded only as allowed by the Buyer’s cookie choice, see the Cookie Policy.

The developer decides why this data is collected and how long it is kept, and must give Buyers their own privacy notice. We use Buyer data only to provide the service to that developer, never for our own marketing, and we do not combine Buyer data across developers.

8. AI features

Navi AI answers questions from Users and Buyers using the project information and inventory that the developer has entered. Each message is sent to our AI provider, Anthropic, to generate the answer. Under Anthropic’s commercial terms, the content we send is not used to train its models, and we do not use Customer Data or Buyer data to train any model. The AI assistant identifies itself as an automated assistant.

9. Who we share data with

We share personal data only with service providers that help us run Navi, under written contracts that limit their use to providing services to us; with authorities when the law requires it; and with a buyer or successor of our business, subject to this policy.

  • Hetzner Online GmbH — Application hosting and database — Helsinki, Finland (EU)
  • Cloudflare, Inc. — Network delivery, security, performance measurement — Global
  • Framer B.V. — Website hosting, contact forms, cookieless website analytics — Netherlands (EU)
  • BunnyWay d.o.o. (bunny.net) — Delivery of images, video and 3D media — Global, EU-based company
  • Google LLC — Google Sign-In, Google Calendar sync, website analytics (Google Analytics) — United States
  • Apple Inc. — Sign in with Apple, private email relay — United States
  • Paddle.com Market Limited — Reseller and merchant of record for self-service subscriptions — United Kingdom
  • Anthropic, PBC — Generating AI assistant answers — United States
  • Resend, Inc. — Transactional and service emails — United States

We will update this list before adding a new provider that processes personal data, and notify customers under the Data Processing Addendum.

10. International transfers

Navi’s application and database are hosted in Helsinki, Finland, within the European Union. Some of our providers are in the United States, the United Kingdom and elsewhere. Where personal data from the European Economic Area, the United Kingdom or Serbia is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and their UK and Serbian equivalents) or the provider’s certification under the EU–US Data Privacy Framework.

11. How long we keep data

  • Account and workspace data: While your account is active, then 30 days to let you export, then deleted
  • Backups: Overwritten within 30 days
  • Google Calendar tokens and synced event data: Until you disconnect or delete your account, then within 30 days
  • Invoices and accounting records: As required by Serbian accounting law (currently up to 10 years)
  • Support communications: 3 years after the ticket is closed
  • Security logs: 12 months
  • Website analytics: 14 months
  • Buyer data: As instructed by the developer; deleted or returned when their subscription ends, under the Data Processing Addendum

Deleting your account. Workspace owners can delete their account in workspace settings or by emailing [email protected]. We then revoke Google and Apple tokens, keep data available for export for 30 days, and delete it afterwards, except what we must keep by law.

12. Security

We encrypt data in transit and at rest, limit staff access to what their role requires, log administrative access, and test backups. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as the law requires.

13. Your rights

Depending on where you live, you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its processing, or send it to you or another provider in a portable format, and you may withdraw consent at any time. Write to [email protected]; we will answer within 30 days.

Serbia and the EU/UK. You can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or to the data protection authority where you live or work.

United States. Residents of states with consumer privacy laws, such as California, can exercise the rights those laws provide using the address above. We do not sell or share personal information for cross-context behavioral advertising, and we honor Global Privacy Control signals. We will not discriminate against you for exercising your rights.

14. Children

Navi is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.

15. Changes

If we make material changes, we will notify Users by email or in the workspace at least 30 days before they take effect. If a change affects how we use Google user data, we will ask for your consent before applying it.

16. Contact

DUŠAN STEVIĆ PR STUDIO ZA GRAFIČKI DIZAJN DARK ROOM STUDIO NIŠ
Božidarčeva 20/4, 18000 Niš, Serbia
[email protected]