Skip to content

Privacy Policy

Last updated: October 10, 2026

1. Who We Are

NaviPal is a travel planning service provided by NaviPal Limited, a company registered in New Zealand ("NaviPal", "we", "us"), available as mobile apps for iOS and Android and on the web at navipal.io (together, the "Service"). NaviPal Limited is responsible for your personal information under the New Zealand Privacy Act 2020 and is the controller of it for the purposes of the UK and EU General Data Protection Regulation.

This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have.

2. Information We Collect

We collect information you give us, and some information automatically when you use the Service.

Account information

  • Your email address and name, from sign-up or from the account you sign in with (Google, Apple, Microsoft or email and password)
  • A profile photo, if you add one
  • Preferences such as your home currency, travel buffers and notification settings

Trips and the things in them

  • Trip names, dates and destinations, and the people you invite
  • Bookings and plans: flights (including flight numbers), stays, car rentals, trains, ferries, tours, restaurants and activities, with their times, addresses and booking references
  • Notes and checklists
  • Expenses you log: amounts, currencies, categories, who paid, how they are split, receipt line items, budgets and settle-ups. Payment methods are recorded as labels only (for example "Cash" or "PayPal"); we never collect card or bank details and no money moves through NaviPal
  • Hotel Wi-Fi network names and passwords you save to a trip
  • Cover images

Messages

  • Trip chat messages you send to the people on a trip
  • Nearby chat messages, which travel directly between phones over Bluetooth, end-to-end encrypted, when there is no signal. They are uploaded to the trip chat once a phone is back online
  • Messages you send to the trip assistant

Forwarded emails

  • Booking confirmation emails you forward to trips@navipal.io, including their attachments (for example PDF tickets or boarding passes)

Photos and files

  • Receipt photos and photos of Wi-Fi cards you take or choose, so we can read the details from them
  • Documents and attachments you add to a trip, such as tickets and booking confirmations

Location

  • If you allow it, your device's location while you are using the app, to work out travel times between plans and tell you when to leave. We do not collect location in the background, and we never show your location to other users

Voice

  • If you use voice mode with the AI trip assistant, audio from your microphone is streamed to our AI provider to understand and answer you while the conversation is open. We do not store the recordings

Collected automatically

  • Device information: device model, operating system, language, time zone, a device identifier and push notification tokens
  • Usage and diagnostic logs, such as which screens are used and how long requests take (via Azure Application Insights)
  • Crash reports and error details (via Sentry)

3. How We Use Your Information

We use your information for the following purposes. Where UK or EU data protection law applies to you, the legal basis for each is shown in brackets.

  • To provide the Service: store and sync your trips, import bookings, show weather and maps, send flight and check-in alerts, split expenses and run trip chat (performance of our contract with you)
  • To share trips with the people you invite (contract)
  • To use your location and microphone for the features that need them (your consent, given through your device's permission prompt, which you can withdraw at any time in your device settings)
  • To send push notifications you have turned on (consent)
  • To keep the Service secure, prevent abuse and fix problems, using logs and crash reports (our legitimate interests in running a safe, reliable service)
  • To understand how the Service is used so we can improve it (legitimate interests)
  • To respond to support requests (contract and legitimate interests)
  • To comply with legal obligations (legal obligation)

We do not sell your personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. AI Features

Some features use artificial intelligence, provided by Microsoft Azure OpenAI Service and Azure AI Document Intelligence:

  • Email import: the content of booking emails you forward is analysed to find the booking details and to match each booking to the right trip
  • Receipt and Wi-Fi scanning: photos you take or choose are read to extract amounts, items or network details
  • AI trip assistant: your messages, and the relevant trip details, are sent to the AI model so it can answer and suggest changes. In voice mode your audio is streamed to it
  • Trip touches: AI suggests a cover photo for a trip and names a trip made by merging others

These providers process the data only to return results to us. Under their terms, your data is not used to train their models. AI output can be wrong, so please check imported bookings, amounts and suggestions. The assistant only changes your trip when you approve a change. If you share a trip, the people you share it with can use AI features on it, for example asking the AI trip assistant about your plans.

Booking emails you forward are read by AI unless you turn AI features off. The NaviPal apps and website ask for your permission before you use the other AI features (the AI trip assistant and photo scanning). You can turn AI features off, or back on, at any time in Settings → AI features, in the apps and on the website. With them off, forwarded emails aren't read, and the AI trip assistant and photo scanning are unavailable. If what we use AI for changes, we may ask you again.

If an AI trip assistant response is wrong, offensive or harmful, you can report it from the chat, and we review reports.

5. Information Sharing

We share your information only as follows:

  • People on your trips: anyone you invite to a trip can see that trip's details, expenses, chat and saved Wi-Fi details, according to their access level. Your name and profile photo are shown to them
  • Share links: if you create a share link for a trip, anyone with the link can view that trip's schedule without signing in. You can stop sharing at any time. Calendar feed links work the same way
  • Service providers: the companies listed in section 6, which process data on our behalf under contracts that require them to protect it
  • Legal requirements: if required by law, or to protect the rights, safety or property of our users or others
  • Business transfers: if NaviPal is involved in a merger, acquisition or sale of assets, your data may transfer to the new owner, who must honour this policy

6. Service Providers

We use these service providers to run NaviPal:

  • Microsoft Azure: hosting, database and file storage, sign-in (Azure AD B2C), usage logs (Application Insights), AI (Azure OpenAI Service) and document reading (Azure AI Document Intelligence)
  • Google: maps, places, directions and time zones (Google Maps Platform); push notifications on Android (Firebase Cloud Messaging); sign in with Google
  • Apple: push notifications on iOS; sign in with Apple
  • Microsoft: sign in with a Microsoft account
  • FlightAware: flight status, gate and delay information, using the flight numbers on your trips
  • OpenWeather: weather forecasts, using the places on your trips
  • Sentry: crash and error reporting
  • Our email provider: delivering account emails such as sign-in codes

7. Where Your Data Is Stored

Your data is stored in Microsoft Azure data centres in Australia (Australia East). Some providers process data in other countries, including the United States, the United Kingdom and the European Union; for example, crash reports are processed by Sentry in the EU.

Before we send personal information outside New Zealand, we make sure it will be protected in a way comparable to the New Zealand Privacy Act, through the laws that apply to the recipient or through contracts with our providers. When personal data is transferred out of the UK or the European Economic Area, we rely on adequacy decisions or on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

8. Data Security

We protect your data with:

  • Encryption in transit (TLS) for all connections, and encryption at rest in our databases and storage
  • Sign-in through Azure AD B2C; we never see passwords for Google, Apple or Microsoft accounts
  • End-to-end encryption for nearby chat messages sent over Bluetooth
  • Access controls, managed secrets (Azure Key Vault) and rate limiting

No service can be completely secure. If we become aware of a breach that affects you, we will tell you and the relevant authorities as the law requires.

9. Device Permissions

The app asks for these permissions only when you use a feature that needs them. All are optional, and you can change them at any time in your device settings:

  • Location (while using the app): travel times and "leave by" reminders
  • Microphone: voice mode with the trip assistant
  • Bluetooth: nearby chat without a signal. Bluetooth is not used to find your location
  • Notifications: trip updates, flight and check-in alerts, and chat
  • Photos and camera: choosing photos, or taking one with your phone's camera app, for receipts and Wi-Fi cards

10. Cookies & Analytics

Our website uses essential cookies for sign-in and to keep you signed in. We use Azure Application Insights to understand how the Service performs and is used. We do not use advertising cookies, tracking pixels or the Android advertising ID, and we do not track you across other apps or websites.

11. Data Retention & Deletion

We keep your account and trip data while your account is open. When you delete your account (in the app: Profile → Manage Data → Delete My Account):

  • Your account is locked straight away and the trips you own are hidden from everyone
  • For 30 days you can sign back in and cancel; your account and trips are restored exactly as they were
  • After 30 days your account, trips, bookings, expenses, messages, files, forwarded emails and sign-in are permanently deleted. In trips other people own, your name is removed; amounts you paid or owe stay, so their balances still add up

Usage logs and crash reports are kept for a limited period (normally up to 90 days) and then deleted. Copies in backups are overwritten within a short period after deletion. We may keep information for longer where the law requires it.

You can also delete individual trips, expenses and files at any time, or ask us to delete your account by emailing support@navipal.io.

12. Your Rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you
  • Correct data that is inaccurate
  • Delete your data
  • Export your data: you can export trips (JSON, HTML or calendar format) and your travel history (CSV) in the app
  • Restrict or object to processing based on our legitimate interests
  • Withdraw consent at any time, for example by turning off location or notifications

To use any of these rights, email support@navipal.io. We will respond within 20 working days. If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You can also complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or to the data protection authority where you live (for example the Information Commissioner's Office in the UK, or the Office of the Australian Information Commissioner).

13. Children's Privacy

NaviPal is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, please contact us and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date, and we will tell you about significant changes by email or in the app before they take effect.

15. Contact Us

Questions about this policy or your data? Contact NaviPal Limited at:

support@navipal.io