Privacy Policy

Navio LLC · naviopro.ai · Last updated: 2 November 2026 · Effective: 2 November 2026 · Version privacy-2026-11-02

1. About this Policy

This Privacy Policy explains how Navio LLC (“Navio”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you use the Navio website at naviopro.ai, the Navio web and mobile applications, the Navio AI career guidance tools (including AI Chat Mentor, CV Review & Builder, AI Interview Prep, Job and Scholarship Search, AI Prompting Tutor, Coaching Center and job simulations), the Navio advisor and administrator tools, and any related services (together, the “Services”).

Navio LLC is a limited liability company organised under the laws of the State of Wyoming, USA, with its registered address at 30 N Gould St, Ste R, Sheridan, WY 82801, USA.

This Policy is written to meet the requirements of the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 (“UK GDPR”), the Swiss Federal Act on Data Protection, US federal and state privacy and student-privacy laws (including FERPA, COPPA, the California Consumer Privacy Act as amended by the CPRA (“CCPA”) and SOPIPA), the Republic of Kazakhstan Law No. 94-V “On Personal Data and their Protection”, and other laws listed in Section 17. Where a local law gives you stronger rights than this Policy, the local law applies.

Please also read our Terms of Service. If you do not agree with this Policy, please do not use the Services.

2. Our Role: Controller or Processor

Navio is offered in two ways. Our role under data protection law differs between them:

Even in Institutional use, Navio is an independent controller for a narrow set of activities: keeping the Services secure and preventing abuse; maintaining billing and contract records with the Institution; complying with our own legal obligations; and creating aggregated, de-identified statistics that cannot identify you or your Institution (Section 6.4). If you use Navio through an Institution, please send requests about your data to your Institution first; if you contact us, we will forward the request to the Institution and assist it.

If you have both a personal account and an Institutional account, they are kept separate. Data from your Institutional account is never moved into your personal account (or the reverse) unless you export it yourself or your Institution permits it.

3. Personal Data We Collect

3.1 Data you give us

3.2 Data we collect automatically

3.3 Data we receive from others

• Your Institution (Institutional use): roster and enrolment data such as name, student ID, institutional email, programme, year, cohort and, where the Institution chooses to provide it, academic or career-service records, plus advisor notes and assignments.

• Single sign-on providers (for example, your Institution’s identity provider, Google or Microsoft): your name, email and a unique identifier, if you choose to sign in this way.

• Integrations you or your Institution connect (for example, a learning-management or careers platform): only the data the integration is configured to share.

• Public and licensed labour-market sources: job postings, skill requirements, salary ranges and aggregated, de-identified career-pathway statistics. These datasets are used to build recommendations and do not identify you.

• Payment provider: confirmation of payment, refunds and fraud-risk signals.

3.4 Special category and sensitive data

Navio does not need, and asks you not to provide, information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, criminal convictions, government ID numbers (such as passport, National Insurance, Social Security or IIN numbers) or financial account details (“Sensitive Data”).

Our systems are designed to detect and redact common direct identifiers and government ID numbers in CVs and Prompts before they are sent to AI providers (Section 5). If you choose to include Sensitive Data — for example, to ask for advice on requesting a disability-related workplace adjustment — we will process it only to answer your request, only with your explicit consent (which you give by choosing to include it after being shown a clear notice in the product), and never for profiling, analytics or any other purpose. You can withdraw consent by deleting the content. In Institutional use, the Institution determines whether and how Sensitive Data may be processed.

We do not use voice or video data to identify you biometrically, and Navio does not perform emotion recognition or infer emotions or protected characteristics from your voice, face, writing or behaviour. Your personality, interests and values profile comes only from the assessments you choose to take and the information you give us.

4. How We Use Your Data and Our Legal Bases

For users in the UK, EEA and Switzerland, we must have a legal basis for each use of personal data. The table below applies to Consumer use and to activities for which Navio is controller. In Institutional use, the Institution determines the legal basis (typically public task, legitimate interests or contract) and we act on its instructions.

Where we rely on legitimate interests, we have balanced our interests against your rights; you may ask us for details and you have the right to object (Section 12). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing; withdrawing consent to optional features never prevents you from using the core Services.

You are not required by law to provide personal data. However, the data marked as necessary in the product (such as an email address to create an account) is required to provide the Services.

5. How Navio’s AI Works and How We Protect Your Data in It

5.1 What the AI does

Navio uses large language models (“LLMs”) supplied by third-party AI providers, combined with our own software, rules, prompts and labour-market data, to generate career guidance: explanations, suggested career paths, skills-gap analyses, CV feedback, interview feedback, ranked lists of jobs or scholarships and learning plans. Every recommendation is accompanied by the reasons behind it, and you can change or ignore any step.

You are always told when you are interacting with an AI system, and AI-generated content is labelled as such, in line with Article 50 of the EU AI Act.

5.2 Safeguards before data reaches an AI provider

• Minimisation and redaction. A server-side filter removes or replaces direct identifiers — names, email addresses, phone numbers, street addresses, government ID numbers and similar — with placeholders before your CV or Prompt is sent to an AI provider, wherever the task does not require them.

• Business API only. We use AI providers only through their enterprise/developer APIs under a data processing agreement — never consumer chat apps.

• No training. Our contracts and account settings prohibit AI providers from using Navio data to train or improve their models.

• Limited retention by providers. AI providers may keep API inputs and outputs only for the period stated in their agreements, and in any case no longer than 30 days, solely to provide the service and detect abuse; where zero-data-retention is available to us, we use it.

• Location. We use EU or other regional processing endpoints where the provider offers them. Where processing takes place outside the UK/EEA, the transfer is protected as described in Section 10.

• Tenant isolation. Each Institution’s data is logically separated from every other Institution’s and from Consumer data, with access controls preventing data from one environment appearing in another.

5.3 No training on your content

We do not use your CVs, cover letters, Prompts, Outputs, uploaded files, advisor notes or Institutional records to train, fine-tune or otherwise build AI models, whether ours or a third party’s. When an advisor or user overrides a recommendation in Institutional use, that signal is used only to improve recommendations within that Institution’s own environment, unless it has first been aggregated and de-identified as described in Section 6.4. If we ever wish to change this, we will ask for your separate, opt-in consent first (and, for Institutional data, the Institution’s written instruction); refusing will not affect your use of Navio.

5.4 Automated decision-making and profiling

Navio analyses your profile to personalise guidance — this is profiling. However, Navio does not make decisions based solely on automated processing that produce legal or similarly significant effects on you (within Article 22 of the EU GDPR or the UK GDPR as amended). In particular, Navio does not decide admissions, grades, scholarship awards, disciplinary matters, eligibility for services, hiring or rejection. Recommendations are suggestions for you, your advisor or your Institution to consider.

In Institutional use, advisors may see indicators such as “may need support” based on engagement and progress. These indicators are designed to prompt human outreach, are reviewed by a person before any action, and are never used by Navio to deny a student a service or opportunity. Our Institutional terms prohibit Institutions from using Navio to make solely automated significant decisions about individuals.

You may ask how a recommendation was produced, request human review of any AI output by contacting your advisor (Institutional use) or us (Consumer use), and express your point of view or contest an outcome.

5.5 Accuracy, fairness and limits

AI output can be incomplete, outdated or wrong. Navio guidance is informational and is not a guarantee of admission, employment, salary or any outcome, and it is not legal, financial, immigration, medical or psychological advice. Please check important information (for example, application deadlines or visa rules) with the original source.

We test our AI features before release and periodically afterwards for accuracy and for unjustified differences in outputs across groups (for example, by gender, age or ethnicity, using synthetic test profiles rather than real users’ protected characteristics), keep a record of these reviews, and correct issues we find. Where required, we carry out and maintain Data Protection Impact Assessments for our AI processing.

6. How We Share Personal Data

We share personal data only as described below. We do not sell personal data for money. Our website uses advertising cookies and pixels (Section 14), which under some US state laws may count as “selling” or “sharing” personal data for cross-context behavioural advertising; you can opt out at any time (Section 16.4) (as those terms are defined in US state privacy laws).

6.1 Service providers (sub-processors)

We use carefully selected providers who process data on our behalf under written contracts that require confidentiality, security and use only on our instructions. Our current key providers are:

The up-to-date list of sub-processors is published at naviopro.ai/subprocessors. Institutions receive advance notice of new sub-processors and may object as set out in their agreement. Payment providers may act as independent controllers for some payment and fraud data under their own privacy notices.

Advertising partners (website only, with your consent where required, or until you opt out in the US): Meta Platforms, TikTok and Google receive cookie and pixel data such as page visits, sign-ups and purchases, to measure and show our ads. They never receive your CVs, chats, test answers, results or education information.

6.2 Your Institution

In Institutional use, authorised staff of your Institution (for example, career advisors and administrators) can see your profile, activity, outputs and progress to the extent the Institution has configured, so they can support you. Role-based permissions limit advisors to their assigned students. Navio staff hold no standing access to Institutional records; support access requires the Institution’s request or approval, is time-limited and is logged.

6.3 People and organisations you choose

If you choose to share content — for example, send your CV to an employer, connect an integration, or opt in to a “Talent visibility” programme — we share the data you select with the recipient you select. Recipients handle it under their own privacy policies. You can withdraw from such programmes at any time; this stops future sharing.

6.4 Aggregated and de-identified information

We may create statistics that cannot reasonably be used to identify any individual or Institution (for example, “the share of users who completed interview practice before applying”) and use or publish them to improve the Services, benchmark outcomes and report on our impact. We take reasonable measures to ensure such data cannot be re-identified, we publicly commit not to attempt re-identification, and we contractually require any recipients to do the same. Institutional data is included only in a form that cannot identify the Institution, unless the Institution agrees otherwise.

6.5 Legal, safety and corporate reasons

• To comply with law, a court order or a lawful request by public authorities; we will challenge requests we believe are overbroad and, where lawful, notify the affected Institution or user.

• To protect the rights, safety or property of users, Navio or others, including to prevent fraud or address an imminent risk of harm.

• To professional advisers (lawyers, accountants, auditors) under confidentiality obligations.

• In connection with a merger, acquisition, financing or sale of assets, subject to confidentiality and to this Policy continuing to protect your data; Institutional data will be handled as required by the Institution’s agreement. We will notify you before your data becomes subject to a different privacy policy.

7. Student Records and Education-Sector Laws (US)

When a US school, college or university uses Navio, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), under the direct control of the Institution with respect to education records. We use education records only to provide the Services to the Institution, do not re-disclose them except as the Institution directs or the law requires, and return or delete them at the end of the contract.

For K–12 schools, we comply with the Children’s Online Privacy Protection Act (COPPA), California’s Student Online Personal Information Protection Act (SOPIPA) and similar state student-privacy laws. In particular, we do not use student data for targeted advertising, do not build profiles of students for non-educational purposes, do not sell student data, and do not disclose it except as these laws allow. We are willing to sign state-specific student data privacy agreements (for example, the Student Data Privacy Consortium’s National Data Privacy Agreement) and New York Education Law §2-d riders.

8. Institution Staff, Advisors and Business Contacts

If you are an advisor or administrator using Navio on behalf of an Institution, we process your account, usage and activity data to provide the Services to your Institution and to keep them secure. If you are a prospective customer or partner, we process your business contact data to respond to you, send relevant information and manage our relationship. You can unsubscribe from marketing at any time using the link in each email or by contacting us.

9. Children and Teenagers

Where users under 18 use Navio through an Institution, we apply high-privacy defaults consistent with the UK Age Appropriate Design Code: profile visibility and any “Talent visibility” features are off and cannot be enabled by the minor alone; marketing is off; we do not use nudge techniques to encourage minors to share more data or weaken privacy settings; and safety guardrails in our AI tools are tuned for younger users. If you believe a child has provided us with personal data without proper consent, contact us at [email protected] and we will delete it.

10. Where We Store Data and International Transfers

Our primary hosting is in the European Union (AWS, Frankfurt, Germany), including databases, file storage and backups. We do not replicate production data to regions outside the EU unless an Institution or applicable law requires a specific location. Where local law requires data about its residents to be stored in-country (for example, the Republic of Kazakhstan), the primary copy of that data is stored on servers in that country (for Kazakhstan, with PS Internet Company LLP).

Navio LLC is a US company, and some providers (for example, AI providers) may process data in the United States or other countries. When personal data from the UK, EEA or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss addendum, and/or the recipient’s certification under the EU–US Data Privacy Framework and its UK and Swiss extensions, together with supplementary measures such as encryption and redaction. You can request a copy of the relevant safeguards by contacting us.

11. How Long We Keep Data

12. Your Rights

12.1 Rights in the UK, EEA and Switzerland

Subject to conditions and exceptions in the law, you have the right to: access your personal data and receive a copy; rectify inaccurate data; erase your data; restrict processing; data portability (receive data you provided in a structured, machine-readable format, or have it sent to another provider); object to processing based on legitimate interests, and at any time to direct marketing; withdraw consent at any time; and not be subject to solely automated decisions with legal or similarly significant effects, and to obtain human intervention, express your view and contest such a decision.

Many of these rights can be exercised directly in your account settings (download, edit, clear memory, delete account). Otherwise, contact us at [email protected]. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you why). We may need to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country of residence, work or the alleged infringement; in Switzerland, the FDPIC. We would appreciate the chance to address your concern first.

12.2 Institutional users

If you use Navio through an Institution, please make your request to the Institution, which decides how to respond. We will help the Institution respond promptly, including by providing tools for it to export, correct and permanently delete your data.

13. Security

We maintain a written information security programme appropriate to the sensitivity of the data, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256); logical isolation of each Institution’s data; role-based access with least privilege and multi-factor authentication for staff; no standing staff access to Institutional records; logging and monitoring of access; masking of personal content in technical logs; secure software development and code review; vulnerability management and regular penetration testing; vendor security reviews; backup and disaster-recovery procedures; staff confidentiality obligations and training; and a documented incident-response plan. We have completed the EDUCAUSE Higher Education Community Vendor Assessment Toolkit (HECVAT), available to Institutions for review.

No system is perfectly secure. If we become aware of a personal data breach, we will notify the competent supervisory authority within 72 hours where required, affected Institutions without undue delay (and within the period set out in their agreement), and affected individuals where the law requires.

14. Cookies and Similar Technologies

We use strictly necessary cookies and local storage to log you in, keep the Services secure, remember your preferences and balance load; these do not require consent. With your consent where required (in the UK and EEA, through our cookie banner, where “Reject” is as easy as “Accept”), we also use analytics cookies to understand how the Services are used. We also use advertising cookies and pixels from Meta, TikTok and Google on our website to measure and show our own ads. They record events such as page visits, sign-ups and purchases, never your CVs, chats, test answers or results. In the UK and EEA they load only with your consent; in the US they load unless you opt out through “Do Not Sell or Share My Personal Information” in the website footer or with a Global Privacy Control signal. We do not use advertising cookies or pixels for Institutional users or anyone we know to be under 18. You can change your choices at any time through “Cookie settings” in the website footer. We honour Global Privacy Control (GPC) signals as a valid opt-out where required by law.

15. Marketing Communications

We send Consumers marketing emails only where permitted by law (with consent, or about similar Navio services you have used, with an easy opt-out). Every marketing message contains an unsubscribe link. We never send marketing to users we know to be under 18, and never send marketing to students using Navio through an Institution. Service messages (such as security notices and renewal reminders) are not marketing and will still be sent.

16. Notice to US Residents (including California)

This Section supplements the rest of this Policy for residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia and others (“US State Privacy Laws”). Some of these laws apply only to businesses that meet certain thresholds; we apply the protections below to all US residents as a matter of policy. In Institutional use, Navio acts as a service provider/processor to the Institution, and requests should be directed to the Institution.

16.1 Categories of personal information (previous 12 months)

We collect these categories for the purposes in Section 4 and retain them as described in Section 11. We do not sell personal information for money. Through advertising cookies and pixels on our website, we make identifiers (such as cookie IDs and IP address) and internet activity (such as pages visited, sign-ups and purchases) available to advertising partners (Meta, TikTok and Google), which may be a “sale” or “sharing” under US State Privacy Laws. We never do this with your CVs, chats, test answers, results, education information or sensitive personal information. We do not knowingly sell or share personal information of consumers under 16. We use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, §7027(m) (such as providing the Services you request and security), so the right to limit does not apply; we do not infer characteristics from it.

16.2 Your US privacy rights

Depending on your state, you may have the right to: know and access the personal information we hold about you (including specific pieces and categories); correct inaccurate information; delete your information; obtain a portable copy; opt out of sale, “sharing”, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects (you can opt out of sale, sharing and targeted advertising as described in Section 16.4; we do not engage in such profiling); limit use of sensitive personal information; and not be discriminated against for exercising your rights. Residents of some states may appeal our decision on a request by replying to our response; if the appeal is denied, you may contact your state Attorney General.

To make a request, email [email protected] (subject “Privacy request”) or use the data tools in your account settings. We will confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days where permitted). We will verify your identity by matching information you provide with our records; for sensitive requests, we may ask for additional confirmation. You may use an authorised agent with written permission; we may ask you to verify your identity directly. Parents or guardians may make requests on behalf of minors.

16.3 Other US disclosures

• Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

• Do Not Track / GPC: we treat a Global Privacy Control signal as a request to opt out of sale, sharing and targeted advertising for that browser. We do not respond to “Do Not Track” signals, as there is no common standard for them.

• 16.4 How to opt out of sale, sharing and targeted advertising: click “Do Not Sell or Share My Personal Information” in the website footer, change “Cookie settings”, turn on Global Privacy Control in your browser, or email [email protected] with the subject “Do Not Sell or Share”. Opting out turns off advertising cookies and pixels for that browser and never affects your access to Navio.

• Minors in California: registered users under 18 may request removal of content they posted by contacting us.

• Washington, Nevada and other consumer-health laws: we do not seek to collect consumer health data; any such data you choose to include is used only to respond to your request and never sold.

17. Other Countries

Navio is designed to meet the GDPR standard globally. Where you are located in another jurisdiction, the following also applies:

Before we offer the Services in a new country, we review local requirements (including any data-localisation, registration or representative obligations) and will update this Policy if additional terms apply.

18. Changes to this Policy

We may update this Policy to reflect changes in our Services or the law. We will post the new version with a new “Last updated” date and, for material changes, notify you by email or in the product at least 30 days before the change takes effect (or sooner where required by law or for security reasons). Where a change requires your consent — for example, any use of your content for AI training — we will ask for it and will not apply the change without it.

19. Contact Us