Privacy

This website

There are no analytics, advertising, tracking pixels or third-party scripts on navishai.com. Fonts, styles and scripts load from this site only.

Server logs

The application logs each request with its time, path, request ID and your IP address. We use these logs to run and secure the site. A fixed log retention period has not been set yet; we will publish one before general availability.

Cookies

A _navishai_session cookie holds a security token that protects forms and ends when you close your browser. A navishai_theme cookie remembers a colour theme for one year, but only after you choose one. Signing in adds a session cookie that keeps you signed in and, once you open a workspace, a cookie that remembers it. None of these are used for tracking or advertising.

Email

If you write to [email protected], we use your message and address to reply.

The evaluation lab

NavishAI is self-hosted. Your operator controls the database, backups, logs and which external endpoints are allowed. Signed-in sessions record the browser user agent and IP address for security.

Local by default

Intake, local analysis, review and deterministic grading stay in your deployment. Workspace-scoped access separates company data.

Explicit external disclosure

Model-assisted source processing, HTTP targets and rubric judges need operator-approved endpoints and human disclosure confirmation. Targets receive visible context and permitted knowledge, not hidden expectations. Judges receive the fixed requirement, relevant evidence and output.

No training on customer data

NavishAI does not train models on your corpus. Any future training would need separate opt-in terms and controls.

Masking has limits

Email masking or authored exact-text rules do not remove all PII. Review retained titles, text and context before approving disclosure. Masking new input does not rewrite earlier snapshots.

Retention and deletion

Source retention limits access. Source deletion also clears local derived scenarios, calibration and run records in that corpus. It cannot recall data already sent to an endpoint; remote retention belongs to that endpoint's operator.

Questions

Write to [email protected].