We aim to collect only what is reasonably necessary to provide and secure MyNavyo. We do not sell or rent personal information, and we do not use customer financial data for behavioural advertising.
1. Scope and who we are
This Privacy Policy applies to mynavyo.com, the MyNavyo financial workspace, related account, support, billing and communication services, and any page that links to this policy (collectively, the “Service”). “MyNavyo,” “we,” “us” and “our” refer to the operator of the Service and, where a checkout receipt, invoice or written order identifies a contracting entity, that entity.
MyNavyo is designed primarily for Canadian businesses and accounting firms. This policy is intended to reflect applicable Canadian private-sector privacy requirements, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Québec privacy legislation where applicable. Other provincial laws may apply depending on the people, organization and activity involved.
2. Accountability and business-customer roles
MyNavyo is accountable for personal information under its control. The MyNavyo Privacy Officer oversees privacy questions, access and correction requests, complaints and incident response.
A business or accounting firm may upload or connect information about its customers, employees, vendors, contractors or clients. For that information, the business customer determines why the information is handled and must have the authority, notices and consents required by law. MyNavyo handles it to provide the Service and according to the customer’s lawful instructions, these terms and applicable law.
3. Information we collect
Depending on the features used, we may handle the following categories:
Name, email address, password hash, preferred language, role, organization, verification status and account settings.
Company profile, customers, vendors, invoices, bills, payments, receivables, tax-planning fields, accounting records, reports, decisions, notes and uploaded documents.
Institution and account metadata, balances and transaction information retrieved through an authorized bank connection. MyNavyo does not ask you to provide online-banking credentials directly to us.
Plan, subscription status, transaction identifiers, billing contact and limited payment metadata. Full card details are collected and stored by the payment processor, not MyNavyo.
Support requests, consultation inquiries, email preferences, survey or estimator answers and messages you send to us.
IP address, browser or device information, session identifiers, timestamps, pages or actions used, authentication events, audit history and error or diagnostic information.
Where information comes from
We receive information directly from you and authorized users; from the business or accounting firm that provides access; from connected services such as a financial institution, payment provider or document-extraction provider; and automatically through use of the Service. Please do not provide information that is not needed for a legitimate business purpose.
4. Why we use information
- Create, authenticate, administer and secure accounts and workspaces.
- Provide financial organization, invoicing, receivables, payables, reports, cash visibility, tax-planning and decision-support features.
- Connect and synchronize sources that an authorized user chooses to enable.
- Extract receipt and invoice details, match records and identify items requiring review.
- Process subscriptions, trials, renewals, cancellations and account notices.
- Respond to support requests, prevent fraud, investigate abuse, troubleshoot and improve reliability.
- Comply with law, enforce agreements and establish or defend legal claims.
Consent and communications
We seek consent where required and may otherwise handle information as permitted or required by law. Transactional messages—such as verification, security, billing, service and account notices—are part of operating the Service. We send promotional electronic messages only with consent or another lawful basis and include an unsubscribe method where required. Unsubscribing from marketing does not stop essential service messages.
6. AI and automated features
When you use an AI feature, MyNavyo may send the prompt, recent conversation context and selected workspace records needed to answer the request to the AI model configured for the Service. Depending on configuration, processing may occur through a locally hosted model or an external AI provider such as OpenAI. Do not enter personal or confidential information that is unnecessary for the request.
AI outputs are advisory, may be incomplete or incorrect and must be reviewed by an authorized person. The AI features are not permitted to move funds, submit tax filings or approve business decisions on their own. We may keep prompts and outputs in the workspace conversation history so users can review and delete conversations, subject to retention and backup limits.
8. Processing outside your province or Canada
Some service providers may process or store information in another province or country. Information in another jurisdiction may be subject to that jurisdiction’s lawful access rules. Before using providers that receive personal information across borders, MyNavyo seeks to assess the information involved, the purpose, contractual protections and relevant privacy risks. Contact us if you need information about the location of a specific processing activity.
9. Retention and deletion
We retain information while an account is active and afterward only for as long as reasonably necessary for the purposes described in this policy, to provide requested exports, complete deletion workflows, maintain security and audit records, resolve disputes, enforce agreements and comply with legal, tax or accounting obligations. Retention periods vary by record type, sensitivity and legal requirement.
When information is no longer required, it is deleted, destroyed or anonymized in accordance with applicable procedures. Residual copies may remain temporarily in backups or logs until they are overwritten through normal cycles. A business customer may also have independent legal duties to retain accounting and transaction records.
10. Security safeguards and incidents
MyNavyo uses administrative, technical and organizational safeguards appropriate to the nature of the Service. These are designed to include encrypted web connections, password hashing, protected sessions, access controls, tenant-aware data separation, two-factor authentication options, restricted secrets and provider tokens, audit records, backups and monitoring. No system is completely secure, and users must protect credentials and promptly report suspected unauthorized access.
If a privacy or security incident occurs, we investigate, take reasonable containment and remediation steps, document the incident as required and notify affected individuals and regulators when applicable law requires it.
11. Your privacy rights and choices
Subject to applicable law and limited exceptions, you may ask to:
- access personal information we hold about you and learn how it has been used or disclosed;
- correct inaccurate or incomplete information;
- withdraw consent for future handling where processing is based on consent, subject to legal and contractual restrictions;
- request deletion or account closure, subject to required retention;
- request computerized personal information in a structured, commonly used technological format where a portability right applies;
- challenge our compliance or make a privacy complaint.
We may need to verify your identity and authority before acting on a request. If information belongs to a business customer’s workspace, we may direct the request to that customer or coordinate the response with it. We will respond within the period required by applicable law and explain any lawful refusal.
Children
The Service is for business users and is not directed to children under 18. Do not create an account or submit personal information if you are under 18.
12. Questions, requests and complaints
Contact the MyNavyo Privacy Officer with a privacy question, request or complaint. Please describe the request and the account or organization involved, but do not email passwords, complete payment-card numbers or online-banking credentials.
Policy changes
We may update this policy to reflect changes to the Service, providers, practices or law. The updated version will be posted here with a new effective date. If a change materially affects how existing personal information is handled, we will provide additional notice or obtain consent when required.
Read the rules governing use of MyNavyo in our Terms of Service.