This Privacy Policy describes how Navipaw LLC (“NaviPaw,” “we,” “us,” or “our”) handles personal information through navipaw.com, the NaviPaw web application, and the NaviPaw applications for iOS and Android (together, the “Services”). A separate section at the end of this policy describes the NaviBlaster browser extension for Chrome.

Pet-service businesses use NaviPaw as separate tenants. For information a business enters or collects about its clients, staff, pets, and operations, the business generally determines why and how that information is used, and NaviPaw processes it on the business’s behalf. If you are a client or staff member of a pet-service business that uses NaviPaw, that business’s own privacy practices govern much of your information, and requests about it should generally be directed to that business first. NaviPaw separately determines how it uses information needed to administer accounts, provide support, secure the Services, bill business customers, and operate its websites and applications.

Information We Collect

Account and profile information. Name, email address, phone number, role within a business, authentication information, and profile details you or your business provide.

Business and client records. Information tenant businesses enter or collect through the Services, which may include client names and contact details, household addresses, property-access instructions or codes, Wi-Fi information, emergency contacts, pet profiles including medical and care information, schedules, forms, signatures, service notes, and report cards.

Precise geolocation. With your permission, the mobile apps collect precise location, accuracy, and timestamps to geo-stamp visit check-ins and check-outs and to provide live-walk tracking. During an active tracked walk, location points are collected at frequent intervals (approximately every 10 seconds). Location collection occurs only while the app is in active use and stops when the walk or visit ends.

Photos and media. Images you capture with the camera or select from your photo library for report cards and related features. Only the images you select are uploaded; the apps do not access or upload the rest of your photo library.

Device and notification information. If you enable notifications, we collect a push notification token and device platform, and we send notification content through Expo and the notification services operated by Apple or Google.

On-device storage. The mobile apps store authentication sessions, notification preferences, cached schedules and records, and pending offline operations (which may include location data, report-card content, and local photo references) on your device so the app can remain signed in and operate with limited connectivity. This information remains on the device until synchronized, removed through the app, cleared during account or device cleanup, or removed by uninstalling the app.

Usage, log, and security information. Standard technical information such as IP address, browser or device type, pages or screens viewed, and security and audit logs, including audit records of AI/MCP client access described below.

Support communications. Information you provide when you contact us for support.

Sources of Information

We collect information directly from users; from the tenant business you belong to or do business with; automatically from your devices and use of the Services; and from service providers such as our hosting, notification, and payment providers.

How We Use Information

We use information to provide and operate the Services; to schedule and document pet-care services, including geo-stamped check-ins and live-walk tracking; to send notifications and communications; to process payments and billing; to provide support; to maintain safety and security, prevent fraud and abuse, and enforce our terms; to comply with legal obligations; and to improve the Services.

How Information Is Shared

Within your tenant business.Authorized owners and administrators of a pet-service business — and, where applicable, assigned staff and the relevant client — may access records associated with that business, including live-walk tracks and visit locations. Live-walk tracks are visible to the relevant client and to authorized personnel of the business.

Service providers. We share information with providers that host and operate the Services on our behalf, including Supabase (database, authentication, and storage), Vercel (web hosting), Expo and Apple/Google notification services (push notifications), our email delivery provider, caching and rate-limiting infrastructure, and Stripe (payments, when activated). These providers process information under contracts and their applicable terms.

AI and MCP clients you authorize. If you connect an external AI assistant or MCP-compatible client to your NaviPaw account, information you authorize will be shared with that client under your direction. We maintain audit records of this access.

Legal, safety, and business transfers. We may disclose information to comply with law or legal process; to protect the rights, safety, or property of NaviPaw, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets, in which case this policy will continue to apply to previously collected information unless you are notified otherwise.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Cookies and Local Storage

The web application uses cookies and browser storage for authentication, session management, security, and preferences. We do not use third-party advertising cookies. The mobile apps use local device storage as described above.

Data Retention

We retain information as follows:

• Account and tenant business records: retained while the account or business relationship is active, and deleted or de-identified within a reasonable period after account deletion, subject to legal obligations.
• Push notification tokens: deleted when notifications are disabled, when you sign out on a device, or when the account is deleted.
• Logs and security records, including MCP audit records: retained for a limited period appropriate to security and troubleshooting purposes, typically no longer than 12 months.
• Backups: retained on a rolling basis and overwritten in the ordinary course, typically within 35 days.
• Mobile caches and offline operations: stored on your device and removed as described above.
• Support communications: retained as long as needed to resolve the matter and for a reasonable period thereafter.

Security

We use technical and organizational safeguards designed to restrict information to authorized users and tenants, including row-level access controls, encryption in transit, and audit logging. No system can guarantee absolute security.

Your Choices and Rights

Device permissions. You can disable location, camera, photo, and notification permissions at any time through iOS Settings or Android Settings for the NaviPaw app. Disabling permissions may limit features such as live-walk tracking or report-card photos.

Access, correction, and deletion. You may request access to, correction of, or deletion of your personal information by contacting us at privacy@navipaw.com. If your information is held within a tenant business’s records, we may direct your request to that business or coordinate with it, since the business controls those records. When an account is deleted, we delete or de-identify associated personal information within a reasonable period, subject to legal retention obligations and backup cycles.

Notifications and marketing. You can opt out of non-essential communications through in-app settings or the unsubscribe mechanism in the message.

Children’s Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at privacy@navipaw.com and we will delete it.

California Residents

NaviPaw does not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Services.

Do Not Track.Some browsers transmit “Do Not Track” signals. Because there is no common standard for interpreting these signals, the Services do not currently respond to them.

California residents may exercise the access, correction, and deletion choices described above by contacting privacy@navipaw.com. We will not discriminate against you for exercising privacy rights.

Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify users by email or by a prominent notice in the Services before the changes take effect, and we will update the effective date above.

Contact Us

Navipaw LLC
privacy@navipaw.com

NaviBlaster Browser Extension

This section describes the NaviBlaster extension for Google Chrome, which lets users capture feedback reports — including screenshots, page content, form inputs, page URLs, console logs, network request summaries, and your GitHub identity — and file them as issues in a GitHub repository you configure.

What NaviBlaster collects and where it goes.Before a capture begins, the extension identifies the categories of information it will capture. At your direction, NaviBlaster transmits the report and your GitHub authentication request to GitHub and to the repository you configure. NaviPaw does not receive a copy of the report on its own servers. Depending on the visibility of the repository you choose, the resulting issue may be viewable by the repository’s owners and collaborators, by GitHub, and — for public repositories — by anyone.

Storage.Your GitHub token and extension settings are stored locally in your browser using Chrome’s extension storage. You can remove them at any time by disconnecting your GitHub account in the extension or uninstalling the extension.

No other transfers. NaviBlaster does not use analytics services and does not transmit captured information to any destination other than GitHub as described above.

Limited Use.NaviBlaster’s use and transfer of information received through Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.