Privacy Policy

Last updated: September 2026

This policy is being finalized alongside legal review. Details that depend on the operating entity, its jurisdiction, or specific retention periods are marked as pending and will be completed before the policy is treated as final.

1. About this policy

NaviCentra (“we”, “our”, “us”) provides a maritime fleet compliance platform — certificate tracking, surveys, document vault, and AI-assisted document processing — at navicentra.com. This policy explains what personal data we process, why, and the choices you have. Questions can be sent to support@navicentra.com.

2. Information we collect

Account information. When you register we collect your name, email address, and company name. Passwords are stored only as salted hashes.
Workspace content. The data you add to your workspace — vessels, certificates, documents, surveys, tasks, messages, and support requests — including scanned files you upload.
Technical data. When you use the service, our servers record standard technical information such as IP address, browser and device type, pages requested, and error logs. This is used for security and reliability.
Preferences.Display preferences such as theme and accent color are stored in your browser's local storage.
Communications. If you contact us (via the public contact form or in-app support), we keep the conversation so we can help and improve.

3. How we use information

To provide and operate the platform, including document storage and AI-assisted extraction you choose to run.
To respond to support requests and communicate about your account.
To keep the service secure — authentication, access control, audit logging, and abuse prevention.
To comply with legal obligations.

We do not sell personal data, and we do not use advertising networks on the platform.

4. AI-assisted features

Some features use AI to propose structured data from documents or to answer questions about your own workspace. When used, the relevant document content is processed by AI models operated by Google (Vertex AI / Gemini) on our behalf. AI output is not used to make compliance decisions without human review. See our AI Transparency notes for details.

5. Legal bases (where EU/UK law applies)

Where the GDPR or UK GDPR applies, we process personal data on the following bases: performance of the contract with your organization (to provide the service); our legitimate interests (security, fraud prevention, and service improvement); legal obligation; and consent where we ask for it (for example, for anything non-essential).

6. Who we share data with

Google Cloud Platform hosts the application, database, object storage, and AI processing (Vertex AI). Google acts as a processor on our behalf.
Sub-processors. We keep a category-level list of infrastructure sub-processors (currently: Google Cloud Platform services used for hosting, storage, and AI). [Sub-processor list — pending finalization]

We do not share personal data with third parties for their own marketing purposes. Where personal data is transferred across borders, we rely on the safeguards provided by our processors, including Google's data-protection terms. [Transfer mechanism details — pending legal review]

7. Retention

We keep your workspace content for as long as your account is active, so your compliance records remain available to your team. You can delete documents and other content at any time. Some data — such as audit logs and records needed to meet legal obligations — is retained for a limited, defined period. [Specific retention schedules — pending finalization]

8. Security

We apply technical and organizational measures to protect data — encryption in transit, role-based access, scoped permissions, and audit logging. Details are on our Security page.

9. Your rights

Depending on where you are, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email support@navicentra.com — we will verify your identity and respond within applicable timeframes. You may also lodge a complaint with your local data protection authority.

[Grievance officer / data-protection contact details — pending finalization]

10. Children

The service is intended for organizations and individuals aged 18 and over. We do not knowingly collect personal data from children.

11. Cookies

We run no third-party advertising or analytics trackers. When you sign in, the application uses an authentication cookie that is necessary for the service to work. See our Cookie Policy.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on the site and, where appropriate, by email. The “last updated” date above reflects the current version.