Privacy policy

1Who is responsible for your data

The controller of the personal data described on this page is Reign OÜ, a private limited company registered in Estonia under registry code 17475902. Our registered address is held on the public record at the Estonian Business Register, searchable by that registry code. Navaraq is a product of Reign OÜ.

For anything on this page — including a request to see, correct or delete your data — write to contact@navaraq.com. We are not required to appoint a Data Protection Officer and have not appointed one; that mailbox reaches the people who can act on your request.

2What we collect

There is one place on this site where you can give us personal data: the early-access form. It asks for four things.

Name

Required. So we can address you by name.

Company

Optional. It tells us whether you are an individual host or an operator, which shapes what we build first.

Email address

Required. It is how we reach you about early access, and it is the unique key of your record.

Number of properties managed

Required, as a range rather than an exact figure. It tells us the scale you operate at.

We do not ask for, and have no way to receive, payment details, guest data, booking data, cleaner details or anything from your property management system. There is no account to create and no product to log into.

Separately, our hosting provider records standard server logs when any page is requested — IP address, browser user-agent, the URL requested and a timestamp. These are generated automatically by the infrastructure, not by anything we built, and we use them only to keep the site running and to investigate abuse.

Vercel also counts visits to the site for us, using its Web Analytics service. For each page you view it records the page address, the site that referred you, your approximate location (country, region and city) and your browser, operating system and device type. It uses no cookies and stores nothing in your browser. To tell one visitor from another, Vercel computes a hash from your request and discards it after 24 hours; the page-view records it keeps carry no IP address or identifier, and we only ever see aggregated statistics.

Our Google advertising tag also discloses some data to Google. If you accept cookies, that includes advertising identifiers. If you decline it does not, but the tag still sends Google a cookieless ping carrying your IP address, user-agent and the page URL. Both cases are set out in full in the cookie policy.

3Why we may use it, and on what legal basis

Running the early-access list

To email you about Navaraq early access, and to decide the order in which we onboard people. Legal basis: your consent, given when you submit the form (GDPR Art. 6(1)(a)). You can withdraw it at any time, and withdrawal does not affect anything done before it.

Understanding who is interested

Reading the list in aggregate — how many operators, at what scale — to decide what to build. Legal basis: legitimate interests in developing our product (Art. 6(1)(f)).

Keeping the site up and safe

Server logs, rate limiting, and investigating abuse. Legal basis: legitimate interests in the security of our service (Art. 6(1)(f)).

Understanding how the site is used

Counting visits, which pages are read and where visitors arrive from, so we can tell whether the site explains Navaraq well. Legal basis: legitimate interests in running and improving our website (Art. 6(1)(f)). It sets no cookie and stores nothing on your device, which is why the cookie banner does not ask about it.

Advertising measurement

Measuring which ads brought people here. Legal basis for anything stored on or read from your device: your consent, given through the cookie banner (Art. 6(1)(a), and the ePrivacy rules on terminal equipment). For the cookieless ping that is sent whatever you choose: legitimate interests in knowing whether our advertising works at all (Art. 6(1)(f)). Declining costs you nothing.

We do not sell personal data, we do not share it with other companies for their own marketing, and we make no automated decisions about you that produce legal or similarly significant effects.

4Who else handles it

Three companies process personal data on our behalf, each under a data processing agreement, and each only for the purpose named here.

Supabase

Stores the waitlist table, in London, United Kingdom (AWS eu-west-2).

Vercel

Hosts and serves this website, generates the server logs described above, and runs the cookieless visitor statistics (Vercel Web Analytics).

Google

Google Ads conversion measurement, only if you accept cookies. Google acts as an independent controller for some of this data under its own terms.

Beyond these, we disclose personal data only where the law requires it — for example a binding order from a competent authority.

5Transfers outside the EEA

Your waitlist entry is stored in London, United Kingdom (AWS eu-west-2). The United Kingdom is outside the European Economic Area, so this counts as an international transfer under the GDPR. It is covered by the European Commission's adequacy decision for the United Kingdom, which recognises UK data protection law as offering protection essentially equivalent to the GDPR's. No further safeguards are required while that decision stands.

Our other processors may also store or access data outside the EEA — Vercel and Google are both US companies. Those transfers are covered by the European Commission's Standard Contractual Clauses, or by an adequacy decision where one applies. You can ask us for details of the safeguards in place for any specific transfer using the contact address above.

6How long we keep it

Waitlist entries are kept until Navaraq launches and you have either become a customer or declined, and in any case no longer than 24 months from the date you signed up. After that the record is deleted. If you ask us to delete it sooner, we do so promptly and keep nothing but the fact that a deletion request was fulfilled.

Server logs are retained by our hosting provider on its own schedule, which is a matter of days rather than months. The hash Vercel uses to count unique visitors is discarded after 24 hours, and the page-view records left behind carry no IP address or identifier. Cookie lifetimes are listed in the cookie policy.

7Your rights

Under the GDPR you have the right to: get a copy of the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to how we use it; receive it in a portable, machine-readable format; and withdraw consent at any time.

Exercise any of these by writing to contact@navaraq.com. We will respond within one month. There is no charge, and we will not ask you to justify the request. Because our records are keyed on email address, a request sent from the address you signed up with is usually all the identification we need.

Every email we send about early access will also carry a one-click unsubscribe, which withdraws your consent and removes you from the list.

8Complaints

If you think we have handled your data badly, please tell us first — most things are a misunderstanding we can fix quickly. You also have the right to complain to a supervisory authority at any time, without going through us. Ours is:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
info@aki.ee · https://www.aki.ee/en

If you live elsewhere in the EEA, you may instead complain to the supervisory authority where you live or work.

9Children

This site is aimed at people running a rental business. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has signed up, write to us and we will delete the record.

10Changes to this policy

Navaraq is being built, so this policy will change as the product gains the ability to do more. The date at the top of this page always reflects the current version. If a change materially affects how we use data you have already given us, we will email everyone on the list before it takes effect rather than relying on you to re-read this page.

This policy covers this website only. When Navaraq launches, the product will have its own agreement covering the operational data it handles on your behalf.