Privacy notice

1. Who is responsible for your information

NaviraHub (see the notice above) is the controller of the personal information described here, unless this notice says otherwise. No data protection officer or EU representative has been named yet; if the law requires one, their details will be published here. To use your rights or ask a question, use Talk to a person.

2. What we collect, and why

Enquiry forms

The forms on /leads/, the "Start here" pages, the request forms on other pages, and the assistant's "Agree and send" step.

What is recorded

Your name, your email address, the subject you choose (for example buy, rent or list a property), how soon you need it if you say, the page you sent it from, any campaign tags in the link you arrived by (utm_source, utm_medium, utm_campaign), and a record of your consent: when, from which page, and which version of the wording you agreed to.

What is not recorded

The service does not currently store the text of the optional message box. If there is something we need to know, a person will ask when they reply.

Why

To reply to you, to match your request against verified supply as it joins, and, only if you agree, to introduce you to people who can help.

Lawful basis

Your consent, given with the tick box on the form. You can withdraw it at any time through Talk to a person; that does not affect what was done before.

Required?

Your name and email address are needed for us to reply. Everything else is optional.

The assistant ("Ask NaviraHub")

What happens

Your question goes to our server. It answers either from a fixed set of checked answers, or, when the AI mode is switched on, by sending your question and the conversation so far to an AI model provider (Anthropic) to write the reply. Each reply says which. In checked-answer mode nothing is sent to an AI provider.

What is recorded

Only metadata about each reply: the kind of event, the model and prompt version used, the tokens, cost and time taken, and any refusal code. We do not record your question, the reply or your IP address itself. Each record carries a label made from your IP address with a secret key that exists only in our server's memory and is replaced every day, so replies from one connection on one day can be grouped to detect misuse, but the label cannot be turned back into your IP address or linked to another day. That label is still treated as personal information.

Why

To answer the question you asked, to keep the assistant within its daily spending limit, and to detect misuse.

Lawful basis

Our legitimate interests in answering visitors' questions and keeping the service secure. Please do not type personal details into the assistant. To be contacted, use its "Talk to a person" step, which sends your details only to the enquiry form, never to the assistant or an AI provider.

Keeping the service running and secure

What happens

When you load a page or send a form, your IP address and browser's request details reach our hosting and network providers (below), who use them to deliver the page and protect it from attack. Our own server uses your IP address in memory to limit how many forms and assistant questions one connection can send in ten minutes; it does not store it.

Lawful basis

Our legitimate interests in running a secure, available website.

Your theme choice

If you switch between light and dark mode, the choice is kept in your own browser, not sent to us. See cookies and storage.

Network members, when accounts open

Member accounts and subscriptions are not open yet. When they open, this notice will be updated before anyone can sign up. What is planned:

• Account details (name, business, registration and VAT numbers, seats): to provide the service you signed up for (performance of a contract).
• Verification checks against official registers and the documents you provide: to show what has been checked (legitimate interests, and legal obligations where they apply).
• Terms acceptance: which version of the terms of use you accepted, for which organisation, and when, kept as a record that cannot be edited: to show what was agreed (performance of a contract).
• Billing details: taken and processed by Stripe; kept by us as invoices and records the law requires us to keep (contract and legal obligation).
• Rosters a member imports: the member who imports a list of their own providers decides what it is for and is the controller of it; NaviraHub processes it on their instructions and keeps it private to them. If you are on a member's roster and have questions, we will tell you which member holds your details so you can contact them.

3. Who processes it for us

We do not sell personal information, and we do not share it for advertising. These service providers handle it on our behalf:

• Render: hosts this website, our server and our database.
• Cloudflare: runs our domain's DNS and sits in front of the website to deliver it quickly and securely.
• Anthropic: writes assistant replies, only when the assistant's AI mode is switched on, and receives only the question and conversation.
• Stripe: will take and process subscription payments once subscriptions open. Not in use yet.
• Resend: planned for sending email from our domain. Not in use yet.

We also share an enquiry with people you have agreed to be introduced to, and we disclose information where the law requires it.

4. International transfers

Some of these providers are based in, or process information in, countries outside the UK and the European Economic Area, including the United States. Where that happens, the transfer must be covered by a safeguard the law recognises, such as an adequacy decision or standard contractual clauses. We will list the safeguard for each provider here before paid subscriptions open.

5. How long we keep it

• Enquiries and consent records: a fixed retention period has not been set yet; it will be published here. You can ask us to delete an enquiry at any time.
• Assistant records: hold no question, reply or address (see above). Their retention period will be published here.
• IP addresses used for rate limits: held in memory only, for the ten-minute window.
• Member data: planned periods (profiles until withdrawn plus 12 months, the audit log for 7 years, credential records until expiry plus 6 years, export for 90 days after cancellation) will be confirmed here before member accounts open.

6. Your rights

Under UK and EU data protection law you can ask us to: give you a copy of your information; correct it; delete it; restrict or object to how we use it; give it to you in a portable format; and stop using it where you gave consent. Use Talk to a person and say which right you want to use; we will reply within one month, and tell you if we need longer and why. You do not need an account to use these rights.

No decision with legal or similarly significant effects on you is made by software alone. Software may draft a match; a person approves any introduction that shares your details.

7. Complaints to a regulator

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk/make-a-complaint), or, in the European Union, to the data protection authority where you live or work (list of EU authorities).

8. Other things you should know

• Security. The website is served only over HTTPS with a strict content security policy, forms never put personal details in a web address, and our database separates each organisation's records at the database level.
• Children. NaviraHub is for adults and businesses. It is not directed at children.
• Changes. We will publish any change to this notice here with a new date, and tell members directly once member accounts exist.