Privacy policy

The purpose of this policy is to inform you clearly about how your personal data is collected and processed when you use navimia.

1. Data controller

The navimia service is operated by the company Humanity Science Studio, which can be reached at the following address: contact@kairos-clarity.com

2. Data collected

We collect the following categories of data, which are strictly necessary for the operation of the service:

• Account data: your email address, used for authentication and for communication related to the service.
• Declared profile: the information you choose to provide (professional situation, context, preferences), used to personalise your experience.
• Inferred profile: based on your conversations, navimia builds an evolving understanding of your professional context, without you having written it directly.
• Conversations, journal and syntheses: the full content of your clarification conversations, your personal journal, your module notes and the syntheses generated, retained so that you can revisit your journey.
• Technical data: connection data required for the security and stability of the service.

Some of this data falls within the special category of "health data" within the meaning of Article 9 of the GDPR — see the next section.

3. Health data and specific consent

navimia processes data that qualifies as health data (Article 9 GDPR): your daily check-in (energy, stress/anxiety, sleep quality, mental load), the content of your journal and of your clarification conversations, as well as a classification of your emotional state for each message (for example anxiety, sadness, shame, exhaustion, hypervigilance) and syntheses containing an AI-generated psychological reading.

This processing is based on your explicit and specific consent, separate from your acceptance of the Terms of Use, collected at sign-up through a dedicated checkbox. The date and version of this consent are logged. You can withdraw it at any time from the “Settings” page.

4. Confidentiality and security of your content

Your content (conversations, journal, syntheses, profile) is linked to your account and protected by security rules at the database level (Row Level Security): only your authenticated account can access it, to the exclusion of any other user. This content is neither pseudonymised nor anonymised in the strict sense of the GDPR — it remains linked to your identity so that you can access and manage it.

5. Purposes of processing

Your data is used exclusively to:

• allow you to access your account and retrieve your saved conversations and syntheses;
• generate, through an artificial intelligence model, clarification responses and syntheses;
• ensure the proper functioning, security and continuity of the service;
• respond to your contact requests;
• comply with our legal obligations.

We do not use your content for commercial analysis or advertising targeting. It is not used to train AI models on behalf of our processors (see section 7).

6. Legal basis

Depending on the case, processing is based on:

• the performance of the service you request;
• your explicit consent to the processing of health data (Article 9(2)(a) GDPR, see section 3);
• our legitimate interest in securing and improving the service;
• compliance with legal obligations.

7. Processors and international transfers

Your data is processed by the following providers, strictly to the extent necessary for the operation of the service. No data is sold or shared for commercial purposes.

• Supabase (database and authentication hosting) — European Union.
• OpenAI, Inc. (United States) — processes the text of your conversations and journal to generate the assistant's responses. This transfer outside the European Union is governed by the standard contractual clauses provided by OpenAI for its API customers.
• Vercel Inc. (United States) — hosting of the web application.

8. Managing your account and retention of your writings

All of your personal data is stored securely for as long as your account remains active.

In case of inactivity: if you stop using the application, your data is retained for a maximum of 12 months from your last activity (login, writing or edit).

Alert before deletion: to prevent you from losing your writings by oversight, a reminder email will automatically be sent to you 1 month before the deadline (i.e. after 11 months of inactivity) so that you can extend the retention period if you wish.

Permanent deletion: if you take no action after this 12-month period, all of your data and texts will be permanently and irreversibly deleted from our servers and backups.

Closing your account: you can also request the immediate and permanent deletion of your account and all of your data at any time from the “Settings” page or by contacting us at the following address: contact@kairos-clarity.com.

9. Your rights

In accordance with applicable regulations, you have in particular the rights of access, rectification, erasure, objection, restriction and portability of your data.

You can download all of your data (in JSON or PDF format) directly from the “Settings” page. For any other request, you can write to us at: contact@kairos-clarity.com

You also have the right to lodge a complaint with the French data protection authority (CNIL).

10. Security

We implement reasonable technical and organisational security measures to protect your data against unauthorised access, loss, alteration or disclosure.

11. Contact

For any question about your personal data, you can write to us at: contact@kairos-clarity.com