Legal
Privacy Policy
Last updated: 29 July 2026
1. Who we are
Navionra Ltd("Navionra", "we", "us") is the data controller for personal data collected through the Navionra website (navionra.com) and the Navionra legal practice management platform. We are a company registered in England and Wales (company number 17186376), with registered office at 124 City Road, London EC1V 2NX, United Kingdom. We are registered with the Information Commissioner's Office under registration ZC195256.
We are not required to appoint a statutory Data Protection Officer. Privacy enquiries and data-rights requests are handled by our privacy contact at privacy@navionra.com.
2. What data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email, role, password hash | Authentication and service delivery |
| Organisation data | Firm name, subdomain, subscription plan | Billing and multi-tenancy |
| Usage data | Page views, API calls, feature usage | Service improvement and analytics |
| Document content | Legal documents uploaded by your firm | AI analysis and storage (see §5) |
| Payment data | Billing address, payment method token | Stripe processes card data directly — we never store raw card numbers |
| Support communications | Emails and support tickets | Customer support |
3. Legal basis for processing (UK GDPR)
- Contract performance — providing the Navionra service you have subscribed to.
- Legitimate interests — fraud prevention, security monitoring, product analytics (we balance these against your interests).
- Legal obligation — complying with applicable laws (e.g. retaining billing records).
- Consent — marketing emails (you may opt out at any time).
4. How long we keep your data
- Active accounts: for the duration of your subscription.
- After cancellation: account data retained for 90 days to allow re-activation, then deleted.
- Billing records: 7 years (legal obligation).
- Audit logs: 2 years.
- You may request earlier deletion — see §7.
5. AI processing and your documents
Navionra uses large language models (currently Anthropic Claude) to process documents you upload — for tasks such as summarisation, Q&A, and compliance review.
- We never use your documents to train AI models. Data sent to the Anthropic API is subject to Anthropic's zero-data-retention policy for API customers.
- Document content is encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Your documents are stored in the EU by default (Azure UK South or EU West). Enterprise customers may specify UK-only storage.
6. Who we share data with
- Anthropic — AI processing (zero-retention policy applies).
- Stripe — payment processing (PCI-DSS Level 1 certified).
- Microsoft Azure — document storage and infrastructure.
- Onfido / ComplyAdvantage — identity and sanctions screening (Professional plan KYC add-on only, with your explicit configuration).
- Microsoft 365 / Azure Communication Services — business and transactional email.
- Cloudflare — DNS and email routing for our domain.
- Sentry — application error monitoring (configured not to transmit personal data).
- Plausible Analytics — cookieless website analytics, EU-processed (see §8).
We never sell personal data. All sub-processors are bound by GDPR-compliant data processing agreements. A full list of sub-processors is available on request.
7. Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — request deletion ("right to be forgotten").
- Portability — receive your data in a machine-readable format.
- Restriction / objection — limit or object to certain processing.
- Withdrawal of consent — for consent-based processing (e.g. marketing).
Submit requests to privacy@navionra.com. We respond within one month, as required by UK GDPR. You also have the right to lodge a complaint with the ICO (ico.org.uk).
8. Cookies and website analytics
We use only essential cookies required for authentication (session tokens) and security (CSRF tokens). We do not use advertising or tracking cookies, and we do not track you across other websites.
To understand how our website is used, we use Plausible Analytics, a privacy-focused analytics service that is cookieless and does not collect or store personal data. Plausible processes data within the EU. It records only aggregate information:
- Page visited, plus the number of visits and unique visitors (counted without cookies or persistent identifiers).
- Referral source — for example a search engine, a link from another site, or a UTM campaign tag.
- Country, derived from your IP address.
- Device type, browser, and operating system.
Your IP address is used only transiently to derive the country and a daily, salted, non-reversible visitor count; it is never stored by Plausible and is not retained by us. Because no personal data is stored and no cookies or similar device storage are used, UK PECR does not require a consent banner for this analytics, and there is no individual profile to access or delete. Our lawful basis for this limited processing is legitimate interests (understanding and improving our website).
9. Changes to this policy
We will notify you by email at least 14 days before making material changes. Continued use of the service after that date constitutes acceptance.
10. Contact
For privacy enquiries: privacy@navionra.com
Navionra Ltd (company number 17186376), 124 City Road, London EC1V 2NX, United Kingdom
ICO registration: ZC195256