Privacy policy
Version of 25 October 2026.
Who we are
NAVAGE is a service published by SIDRA SOLUTIONS, 54 rue Tensift, apartment 1, Agdal, Rabat, Morocco. For any question about your data: contact@navage.ai.
Two situations
- You have a NAVAGE account: we are the controller of your data. This policy applies to you in full.
- You use the assistant on another company’s site: that company decides how your data is used. We process it on its behalf. Its own privacy policy applies; the “Visitors” section below describes what we process for it.
Customers: what we collect, why, for how long
| Data | Why | Duration |
|---|---|---|
| E-mail, password stored as a hash, name (optional), language | Open and manage your account | Life of the account |
| Version of the terms and of the privacy policy accepted, date of acceptance | Prove your agreement | Life of the account |
| Sites, settings, Console reports | Provide the Service | Life of the account |
| Content of your sites read during preparation: structure and displayed text of the pages — headings, labels, links, forms, tables. Not the values typed in; no screenshots. Pages behind sign-in: with a test account you provide, or through your own browsing from a Console link (capture, valid for one hour) | Build the assistant for your sites | As long as the site exists in your account |
| Subscription: plan, status, renewal and end dates, subscription references at Paddle | Manage your subscription and payment reminders | Life of the account |
| Console security log: sign-up, activation, sign-in, password reset, account actions — date, action, IP address | Account security, abuse prevention | 180 days at most |
| Technical access logs: IP address, browser, date, requested address | Security and proper operation of the Service | 31 days at most, then encrypted archive; deleted at the latest 213 days (about 7 months) after creation |
| Password reset code | Recover access | 10 minutes |
| Service e-mails: account access (activation, password), contractual notices (failed payment, standby, changes to the terms), weekly summary. Other events are notifications in the Console | Inform you about your account | Life of the account |
Legal bases: performance of the contract; our legitimate interest in securing the Service; our legal obligations, in particular accounting.
Payment. Your payment data (card, billing address) is entered directly with Paddle.com, our online reseller and the Merchant of Record for all our orders, which acts in its own name; its privacy policy applies to payment data. Paddle collects your payment data itself; NAVAGE does not receive it and stores no card data. We send Paddle your e-mail and your account identifier, to prepare the payment.
Move to Discovery. If your account moves to the Discovery Plan, after a payment failure, a withdrawal or at the end of a subscription that is not renewed, usage history beyond 7 days is erased.
Visitors: what we process on the site’s behalf
| Data | Why | Duration |
|---|---|---|
| Random session identifier, not linked to your identity | Follow the conversation from one page to the next | 6 hours on our servers |
| Page viewed, language, chosen assistance level and mode | Guide and answer | 6 hours on our servers, then in the statistics below |
| Address parameters the site declared useful for navigation | Take you to the right page | 6 hours on our servers |
| What you type to the assistant | Answer; help the site improve its content | Kept after automatic masking of e-mails, phone numbers, bank numbers and long strings of digits: 30 days at most. The site can choose to keep only the requests left unanswered, or nothing |
| Request to the site’s support, if the site has activated it and you confirm it: site, screen, flow and step, your last question to the assistant (masked), your e-mail if you give it | Send your request to the site’s team, in its support tool | Sent to the site’s tool; NAVAGE does not keep your e-mail, only whether the request was created |
| Usage statistics tied to the session, not to a person | Measure how well flows work | According to the site’s plan — 7 days, 3 months or 12 months — or its contract. The site can shorten it |
Our servers receive neither the values of the site’s fields nor what is displayed on your screen; no screenshot is taken. We receive no audio recording. Our application does not keep your IP address. Our technical access logs contain it: they are kept 31 days at most, then archived in encrypted form and deleted at the latest 213 days (about 7 months) after creation.
Flow mode. If you choose Flow mode, the assistant presents the task step by step in a NAVAGE screen, over the site. This screen shows the fields of the site’s form, with what is already entered in them. The information you enter there stays in your browser and is copied into the site’s form: the site receives it when you click the send button, after a summary. NAVAGE sends it neither to its servers nor to its artificial intelligence provider; our servers receive the landmarks of the steps and of the page elements. How this information is used is governed by the site’s privacy policy.
Storage in your browser. The assistant keeps a session identifier in your browser, to resume the conversation from one page to the next; it expires 6 hours after its last use. It also keeps the assistance level and the mode you chose, classic or Flow, until you change or erase them. For the current tab, it keeps the conversation for 30 minutes, along with the state of the Flow screen and the help messages already shown, so they come back after a page change. When a guided flow has you click a send button, it also keeps that click in the tab (the element clicked, the session identifier and the time, without any value typed in), so the step is not lost if the page reloads; it only uses it within 30 seconds and erases it as soon as the step is taken into account, the next time the assistant loads, or when the tab is closed. These items are needed for the service you request; they stay in your browser and you can erase them at any time.
Voice. Read-aloud is provided by your browser.
Visitors of navage.ai
- Browsing: no cookie, no tracker, no audience measurement. The opening sequence stores in your browser that it has been seen, and your currency choice is kept there for the visit; this information does not leave your browser.
- Demo form: name, e-mail, application address (optional), message, page language and the campaign code of the link you arrived from, if there is one. Sending requires your explicit agreement, given by ticking a box. The information is sent to NAVAGE by e-mail and not kept on this site. A hashed fingerprint of your IP address is kept to limit abuse; it is erased at the first submission of this form made at least one hour after yours.
- Waiting list, when offered: e-mail, chosen plan, page language and the campaign code of the link you arrived from, if there is one, sent with your explicit agreement to be notified when the plan opens. Sent to NAVAGE by e-mail, not kept on this site. A hashed fingerprint of your IP address is kept to limit abuse; it is erased at the first submission of this form made at least one hour after yours.
- NAVAGE Audit, when offered: the address of the site to audit and your e-mail, sent with your explicit agreement and your statement that you are responsible for this site or authorised to have it audited. We then read the public pages of that site: their structure and displayed text, never screenshots. The report is sent to you by e-mail. The site address, the e-mail and the report are kept for 30 days, then deleted. To limit abuse, your IP address is kept in memory for 15 minutes; like any visit, it also appears in our technical access logs. Commercial information following the report is sent to you only if you tick the box provided for it.
- Commercial information: only if you tick the optional box provided for it, separate from the agreement to send. This consent can be withdrawn at any time by writing to contact@navage.ai.
- Demo requests and exchanges received at contact@navage.ai: kept 3 years from the last exchange.
- The assistant on this site is NAVAGE itself; here NAVAGE is the controller, and your requests are processed as described in the “Visitors” section.
- Example pages (/exemple/): their fictitious forms send no data.
- Legal bases: answering your request (pre-contractual steps), preventing abuse (legitimate interest), commercial information (consent).
Who receives this data
- Our host, OVHcloud: the Service is hosted in France. OVHcloud also delivers our e-mails.
- Our artificial intelligence model provider: it receives the text of the requests the assistant does not handle on its own, and the extracts of the site needed for the answer, solely for the needs of the Service. See “Transfers outside the European Union”.
- A site may use its own artificial intelligence provider: its terms then apply for that site.
- The site’s support tool (for example Zendesk, Freshdesk or HubSpot), if the site has activated the handover to support and you confirm a request: it receives that request; the site’s privacy policy applies.
- Paddle.com, online reseller and Merchant of Record for our orders, for online payment: it acts in its own name; its privacy policy applies to payment data.
We neither sell nor rent any data.
Transfers outside the European Union
The Publisher is established in Morocco. Its teams may access the data from Morocco and the United Arab Emirates, solely for the needs of the Service. The artificial intelligence model provider may process requests outside Morocco and the European Union. Contact details and numbers typed by visitors are masked before anything is sent.
Security
Encrypted exchanges, passwords stored as hashes, encrypted secrets and backups, restricted server access, logged Console actions, backups kept 7 days.
Your rights
You can ask for access to your data, its rectification, erasure or portability, restriction of its processing, or object to it: write to contact@navage.ai. We answer within one month at most. If you have an account, you can also delete it yourself from the Console, when no subscription is running.
Visitors: contact the site you were using first; we will help it answer you.
You can also refer the matter to the competent data protection authority.
Inactive account
If your Discovery account stays inactive for 45 consecutive days — no assisted session on your sites and no Console sign-in — it is put on standby: the assistant is no longer displayed and your data is kept. We notify you by e-mail when it goes on standby, then every two months, and a last time 15 days before the end of the 6-month period. Signing in is enough to reactivate your account. After 6 months on standby with no renewed activity, your account and its data may be deleted; if so, backups are erased at the latest 7 days later.
Deleting your account
You can delete your account from the Console, after confirming your password, when no subscription is running. Deletion is immediate and irreversible: your account, its users, its sites and their data are erased. Backups are erased at the latest 7 days later. You can also delete a single site.
Changes
Any significant change to this policy is announced on navage.ai and, for customers, by e-mail. The version in force is dated at the top of this page; a new version is submitted to your acceptance at your next sign-in to the Console.