Legal
Data Processing Agreement
Version 1.2 · Effective 14 October 2026
Between the Customer (the entity that has registered for, or is accessing, the Navige service, acting as Data Controller) and Navige Ltd, a company registered in the United Kingdom (acting as Data Processor).
This Data Processing Agreement (“DPA”) forms part of the agreement governing the Customer’s use of the Navige service. By creating a Navige account or using the Navige API, the Customer agrees to this DPA. Where a separate written contract exists between the parties, this DPA supplements that contract and, in the event of conflict on data protection matters, this DPA prevails.
What changed in version 1.2. Clause 10.2 previously described automatic deletion on a plan-based schedule. No such deletion runs, and the plans it named no longer exist, so the clause now states what actually happens. Article 8 previously said processing took place primarily in the UK and EU; that could not be verified, so it now states the position conservatively. Anthropic has been removed from Schedule 2, because the feature it was listed for does not exist. Framer has been added, because the public website — including the sign-up form — is now hosted there.
Article 1 — Definitions
In this DPA, the following terms have the meanings set out below:
1.1
“Applicable Data Protection Law” means, as relevant to the processing: (a) the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”); (b) Regulation (EU) 2016/679 (“EU GDPR”); and (c) any other data protection, privacy, or equivalent legislation applicable to either party in connection with the Services.
1.2
“Controller” means the Customer, who determines the purposes and means of the processing of Personal Data under this DPA.
1.3
“Data Subject” means any identified or identifiable natural person to whom Personal Data relates.
1.4
“Personal Data” and “Personal Data Breach” have the meanings given to them in Applicable Data Protection Law.
1.5
“Processing” has the meaning given in Applicable Data Protection Law, and “Process” and “Processed” shall be construed accordingly.
1.6
“Processor” means Navige Ltd, which Processes Personal Data on behalf of the Controller in connection with the Services.
1.7
“Services” means the AI agent governance, spend measurement, monitoring and audit logging services provided by Navige to the Customer.
1.8
“Sub-processor” means any third party engaged by Navige Ltd to Process Personal Data in connection with the Services.
1.9
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Article 46(2)(c) of the EU GDPR, as currently in force. “UK IDTA” means the International Data Transfer Agreement issued by the UK Information Commissioner’s Office.
Article 2 — Subject Matter, Duration, and Purpose
2.1
This DPA governs all Processing of Personal Data carried out by Navige Ltd on behalf of the Controller in connection with the Services.
2.2
Navige will Process Personal Data for the duration of the service agreement, or until earlier deletion of the relevant Personal Data in accordance with this DPA.
2.3
The nature and purpose of Processing is: the interception, evaluation, logging, masking, pricing and retention of AI agent tool calls and AI model calls — carried out on behalf of the Controller for the purposes of AI governance, operational visibility, cost measurement, audit, and regulatory evidence.
2.4
Full details of the Processing, including the types of Personal Data and categories of Data Subjects, are set out in Schedule 1.
2.5
Provider billing data (optional). Where the Controller connects a model provider account under the “Provider billing” setting, Navige additionally retrieves daily aggregate cost figures from that provider’s billing interface, for the purpose of reconciling the Controller’s measured savings against the amounts the provider actually charged. This Processing is optional, is enabled only by an account owner, and covers the Controller’s whole provider organisation — including spend not routed through Navige, which is the basis of the coverage figure the Service reports.
2.6
The data retrieved under clause 2.5 consists of monetary amounts, calendar dates, and model or usage-type identifiers as published by the provider. It does not include prompts, completions, tool call arguments, end-user identifiers, or any other content of the Controller’s AI calls. Navige does not retrieve the provider’s usage or token-level reports. The Controller may disconnect at any time; disconnection deletes the stored cost figures as well as the credential.
2.7
Prompt and completion content. Navige does not store the text of prompts or completions passed through the model proxy. What is recorded is usage and metadata: model identifiers, token counts, computed cost, latency, outcome, and the correlation identifiers the Controller supplies. Tool call arguments submitted to the decision API are stored only in redacted form, as described in Schedule 3.
Article 3 — Obligations of the Controller
3.1
The Controller warrants that it has, and will maintain for the duration of this DPA, a valid lawful basis for Processing Personal Data under Applicable Data Protection Law, including for instructing Navige to Process Personal Data as contemplated by this DPA.
3.2
Where required by Applicable Data Protection Law, the Controller is responsible for informing Data Subjects about the monitoring and governance activities carried out through the Services, including through its own privacy notices or internal policies.
3.3
The Controller is responsible for ensuring that the Personal Data provided to Navige is accurate and that its instructions to Navige are lawful. The Controller will not instruct Navige to Process Personal Data in a manner that would cause Navige or the Controller to breach Applicable Data Protection Law.
3.4
The Controller is responsible for configuring the Services — including governance rules, agent scope, and cost controls — in a manner consistent with its obligations under Applicable Data Protection Law.
3.5
Storage limitation. Because the Services do not currently apply automatic time-based deletion (clause 10.2), the Controller is responsible for deciding how long Processing data should be retained and for instructing Navige to delete it when that period ends. Navige will act on such an instruction in accordance with clause 10.3.
Article 4 — Obligations of the Processor
4.1
Processing on instructions. Navige will Process Personal Data only on documented instructions from the Controller, including those set out in this DPA and in the Controller’s configuration of the Services, unless required to do so by applicable law. Where Navige is required by law to Process Personal Data other than as instructed, Navige will inform the Controller before doing so, unless the law prohibits such notification.
4.2
Confidentiality of processing staff. Navige will ensure that all persons it authorises to Process Personal Data on its behalf are subject to appropriate binding obligations of confidentiality with respect to that Personal Data.
4.3
Security. Navige will implement and maintain the technical and organisational security measures set out in Schedule 3.
4.4
Assistance with Data Subject rights. Taking into account the nature of the Processing, Navige will provide reasonable assistance to the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising rights under Applicable Data Protection Law.
4.5
Assistance with controller obligations. Navige will assist the Controller with its obligations under Articles 32–36 of the EU GDPR and equivalent provisions of UK GDPR, including in respect of security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the Processing and the information available to Navige.
4.6
No sale or sharing of Personal Data. Navige will not sell, rent, disclose, or otherwise make Personal Data available to any third party for that third party’s own purposes. Navige will not Process Personal Data for any purpose other than the provision of the Services, unless expressly instructed by the Controller.
4.7
No training. Navige does not use the Controller’s Personal Data, call content, or usage data to train machine learning models, and does not make it available to any third party for that purpose.
Article 5 — Sub-processors
5.1
The Controller grants Navige general written authorisation to engage the Sub-processors listed in Schedule 2. Navige will not engage a Sub-processor outside of Schedule 2 without prior notification to the Controller in accordance with clause 5.3.
5.2
Navige will impose on each Sub-processor data protection obligations equivalent to those imposed on Navige under this DPA, in particular in respect of appropriate technical and organisational security measures.
5.3
Navige will notify the Controller of any intended addition or replacement of a Sub-processor at least 14 days in advance by publishing an updated Schedule 2 at app.navige.ai/legal/dpa and by direct notification where possible. The Controller may object to a proposed change on reasonable grounds by notifying Navige in writing within 14 days of notification. If the parties cannot resolve a reasonable objection within a further 14 days, either party may terminate the affected part of the Services on written notice without penalty.
5.4
Navige remains fully liable to the Controller for the acts and omissions of its Sub-processors to the same extent Navige would itself be liable if performing the Processing directly.
Article 6 — Confidentiality
6.1
Navige will keep Personal Data strictly confidential and will not disclose it to any party except: (a) to Sub-processors engaged in accordance with Article 5; (b) as required by applicable law, regulation, or court order; or (c) as expressly instructed by the Controller.
6.2
Where Navige receives a legally binding request from a public authority for disclosure of Personal Data, Navige will, to the extent permitted by law, promptly notify the Controller before disclosing and will use reasonable endeavours to seek appropriate limitations on the scope of any required disclosure.
Article 7 — Personal Data Breaches
7.1
Navige will notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a confirmed Personal Data Breach affecting the Controller’s Personal Data.
7.2
The notification will include, to the extent then known: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects and Personal Data records involved; (c) the likely consequences of the breach; (d) the measures taken or proposed to address the breach and to mitigate its potential adverse effects.
7.3
Where all information cannot be provided simultaneously, Navige may provide it in phases without undue further delay. Navige will cooperate fully with the Controller in investigating and remediating any breach and will provide all information reasonably required for the Controller to meet its obligations to notify supervisory authorities and affected Data Subjects.
Article 8 — International Transfers
8.1
Navige’s production infrastructure — the gateway, the console, the database and its backups — is operated by Railway Corp, a company incorporated in the United States. Personal Data Processed under this DPA is therefore transferred to, and may be accessed from, the United States.
8.2
Each transfer under clause 8.1, and each transfer to the other Sub-processors listed in Schedule 2, is subject to an appropriate transfer safeguard: the Standard Contractual Clauses for transfers subject to EU GDPR, and the UK IDTA for transfers subject to UK GDPR, in each case as indicated in Schedule 2.
8.3
For the purposes of the SCCs, the Controller is the data exporter and Navige is the data importer, and Module Two (controller to processor) applies. Where Navige transfers Personal Data onward to a Sub-processor, Module Three (processor to processor) applies to that onward transfer.
8.4
Navige will inform the Controller if it becomes aware of any change that would prevent it from complying with the transfer safeguards above, and the parties will work in good faith to identify an alternative lawful basis for the transfer or to terminate the affected Processing.
Article 9 — Data Subject Rights
9.1
Where Navige receives a request directly from a Data Subject relating to the exercise of their rights under Applicable Data Protection Law (including rights of access, correction, erasure, restriction, portability, or objection), Navige will promptly forward the request to the Controller and will not respond on the Controller’s behalf unless instructed to do so.
9.2
Taking into account the nature of the Processing, Navige will provide such technical assistance as is reasonably requested by the Controller to enable the Controller to fulfil its obligations to respond to Data Subject requests within the time periods required by Applicable Data Protection Law.
Article 10 — Retention, Deletion and Return of Data
10.1
Retention during the term. Navige retains Processing data for as long as the Controller’s account exists, unless the Controller instructs otherwise.
10.2
No automatic time-based deletion. The Services do not currently apply an automated retention schedule, and Processing data is not deleted automatically after a fixed period. Deletion occurs when the Controller deletes its account, when the Controller instructs deletion under clause 10.3, or on termination under clause 10.4. Navige will give Controllers not less than 30 days’ notice before introducing any automatic deletion schedule, and will publish it in this clause.
This clause replaces a statement in version 1.1 that audit log data was deleted automatically on a plan-based schedule. That did not describe the Service. It has been corrected rather than left in place, because a retention promise that is not kept is both inaccurate and a breach of this DPA.
10.3
Deletion on request. The Controller may instruct deletion of its Processing data at any time, in whole or for a defined period, by written request to the contact in Article 14. Navige will complete the deletion within 30 days and confirm it in writing.
10.4
On termination. Upon termination or expiry of the service agreement, Navige will, at the Controller’s election made in writing within 30 days of termination: (a) securely delete or destroy all Personal Data within 30 days of the election; or (b) provide the Controller with a complete export of Personal Data in machine-readable format (JSON or CSV) and then securely delete or destroy all copies. If the Controller makes no election within 30 days of termination, Navige will securely delete all Personal Data.
10.5
Account deletion. Deleting an organisation removes, in a single cascading operation, its agents, credentials, tools, policies, the action ledger, transactions, steps and interventions, together with the logins of any person left belonging to no other organisation. Deletion is irreversible and is not subject to a recovery window.
10.6
Blockchain anchors. Where the Controller has enabled blockchain anchoring (an optional feature, off by default), the anchors stored on the Polygon public blockchain contain only cryptographic hashes of log data. No Personal Data is transmitted to or stored on the Polygon network, and these hashes cannot be deleted. Navige will provide the Controller with documentation confirming that no Personal Data is contained in any blockchain record.
10.7
Navige may retain Personal Data beyond the periods above only where required to do so by applicable law or a binding order of a competent authority. In such cases, Navige will notify the Controller (to the extent permitted by law), will maintain the confidentiality of such data, and will limit Processing to what is strictly required by law.
Article 11 — Audit Rights
11.1
Navige will make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations of this DPA, and will permit and contribute to audits and inspections carried out by the Controller or a third-party auditor appointed by the Controller for this purpose.
11.2
The Controller will provide not less than 14 days’ prior written notice of any audit, except where an audit is triggered by a suspected or confirmed Personal Data Breach, in which case shorter notice is accepted. The Controller will ensure that any appointed third-party auditor is subject to binding obligations of confidentiality. Audits will be conducted during normal business hours and in a manner that does not unreasonably disrupt Navige’s operations. The parties will agree in good faith on the scope, timing, and cost of audits before they commence.
11.3
Where Navige holds a current SOC 2 Type 1 or Type 2 report, ISO 27001 certificate, or equivalent third-party certification covering the relevant aspects of the Services, Navige may provide that certification to the Controller in place of a direct audit under clause 11.1. Navige does not currently hold such certification, and has not commenced a formal certification process. Until a current certification is available, or where it does not address specific areas of concern, the Controller may request a direct audit as set out in clause 11.1.
Article 12 — Liability
12.1
Liability of the parties under or in connection with this DPA is subject to the limitation of liability provisions in the service agreement between the parties.
12.2
Nothing in this DPA limits or excludes any liability that cannot lawfully be limited or excluded under Applicable Data Protection Law, including any liability arising from the rights of Data Subjects.
Article 13 — General
13.1
Governing law and jurisdiction. This DPA is governed by the laws of England and Wales. Each party submits to the exclusive jurisdiction of the courts of England and Wales for all disputes arising under or in connection with this DPA, except where Applicable Data Protection Law requires a different governing law or jurisdiction in respect of a particular Data Subject.
13.2
Changes to this DPA. Navige may update this DPA to reflect changes to the Services or to Applicable Data Protection Law. Where a change materially reduces the Controller’s rights or Navige’s obligations, Navige will give not less than 30 days’ notice before it takes effect, and the Controller may terminate the affected Services without penalty before that date. Each version is identified by a version number and effective date at the head of this document.
13.3
Entire agreement. This DPA, together with the service agreement and any applicable Standard Contractual Clauses or UK IDTA, constitutes the entire agreement between the parties with respect to the Processing of Personal Data in connection with the Services and supersedes any prior representations or agreements relating to the same subject matter.
Article 14 — Contact
14.1
Data protection enquiries, deletion instructions under clause 10.3, sub-processor objections under clause 5.3, audit requests under Article 11 and breach correspondence under Article 7 should be sent to hello@navige.ai.
14.2
Navige Ltd is registered in the United Kingdom. Navige has not appointed a Data Protection Officer, having assessed that it is not required to do so under Article 37 of the UK or EU GDPR; the contact in clause 14.1 is the responsible point of contact for all matters under this DPA.
Schedule 1 — Details of Processing
Subject matter
AI agent governance, spend measurement, monitoring and audit logging services
Duration
For the term of the service agreement, subject to Article 10
Nature of processing
Collection, interception, masking, storage, evaluation, pricing, structuring and deletion of AI tool call and AI model call metadata; and, where the Controller enables it, retrieval and storage of aggregate daily cost figures from the Controller’s model provider accounts
Purpose
Enabling the Controller to monitor AI agent activity, enforce governance rules, measure and control spend, maintain tamper-evident audit records, reconcile reported savings against provider-issued invoices, and support the Controller’s regulatory requirements
Types of Personal Data
- Names, job titles, and work email addresses of employees and contractors
- Account registration data: name, company, and work email of the account holder, and a hashed password where the account was created with one
- Where the account holder signs in with a third-party identity provider: the identifier, name and email address returned by that provider
- Redacted content of AI tool call arguments and parameters, which may contain personal data of employees or third parties. Masking is applied before storage, as described in Schedule 3
- Timestamps, AI platform identifiers, model names, agent identifiers and correlation identifiers
- Where provider billing is connected: the identity of the account owner who enabled it, and the credential they supplied, held encrypted. The cost figures themselves are organisational billing records rather than Personal Data, and contain no call content
Categories of Data Subjects
- Employees and contractors of the Controller who operate or administer AI agents and applications
- Third parties whose personal data may be referenced within AI tool call arguments, to the extent it survives masking
- Account holders and administrators who manage the Navige account
Data Navige does not process
- The text of prompts and completions passed through the model proxy
- Special category data, which the Services are not designed to process and must not be sent to them
- Payment card data, which is collected and held by Stripe and never reaches Navige’s systems
Schedule 2 — Approved Sub-processors
Current Sub-processors — last updated 14 October 2026.
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Railway Corp | Cloud infrastructure, compute, and database storage (PostgreSQL and Redis). Hosts the Navige gateway and console, and stores all audit log, governance, spend and account data. | United States | SCCs / UK IDTA |
| Resend Inc | Transactional email delivery: account verification, welcome and billing messages, weekly reports, and human-approval notifications. | United States | SCCs / UK IDTA |
| Stripe Inc | Payment processing, billing and subscription management. Stripe holds payment card data; it does not receive tool call data, audit log content, or spend records. | United States | SCCs / UK IDTA |
| Framer B.V. | Hosting of the public website at navige.ai, including the page that renders the sign-up form. Data entered into that form is submitted directly to Navige’s own systems and is not received or stored by Framer. Framer processes website visitor data, such as IP address and page requests, in its capacity as host. | Netherlands / EU | EU — no transfer safeguard required |
Not Sub-processors.
Identity providers. Where a user chooses to sign in with Google, Microsoft, GitHub or Slack, or through the Controller’s own SAML or OIDC provider, that provider acts as an independent controller of the sign-in it performs. Navige receives the identifier, name and email it returns. No Personal Data is processed by that provider on Navige’s behalf.
Model providers. Calls routed through the Navige proxy are forwarded to the provider the Controller has chosen, using the Controller’s own credential. That provider processes the call for the Controller, under the Controller’s own agreement with it, not on Navige’s behalf. The same applies to the optional provider billing retrieval under clause 2.5.
Polygon. For Controllers who enable blockchain anchoring, the Polygon public blockchain receives only a keccak256 hash of each batch of audit records, chained to the hash of the batch before it. No Personal Data, call content or identifiable information is transmitted to or stored on the Polygon network.
Identity providers. Where a user chooses to sign in with Google, Microsoft, GitHub or Slack, or through the Controller’s own SAML or OIDC provider, that provider acts as an independent controller of the sign-in it performs. Navige receives the identifier, name and email it returns. No Personal Data is processed by that provider on Navige’s behalf.
Model providers. Calls routed through the Navige proxy are forwarded to the provider the Controller has chosen, using the Controller’s own credential. That provider processes the call for the Controller, under the Controller’s own agreement with it, not on Navige’s behalf. The same applies to the optional provider billing retrieval under clause 2.5.
Polygon. For Controllers who enable blockchain anchoring, the Polygon public blockchain receives only a keccak256 hash of each batch of audit records, chained to the hash of the batch before it. No Personal Data, call content or identifiable information is transmitted to or stored on the Polygon network.
Schedule 3 — Technical and Organisational Security Measures
Measures in place as of 14 October 2026.
Encryption in transit
All data transmitted between the Controller’s agents and the Navige API is encrypted in transit using TLS 1.2 or higher. Connections that do not support TLS 1.2 are rejected. Internal traffic between Navige services travels over a private network that is not exposed to the public internet.
Encryption at rest
All data at rest is encrypted using AES-256, managed by our infrastructure provider, Railway. Backup storage is also encrypted. Credentials the Controller supplies for optional integrations are additionally encrypted at the application layer using AES-256-GCM before being written.
PII masking before storage
Before any tool call argument is written to persistent storage, Navige applies automated detection and masking to the following categories: email addresses, international and local telephone numbers, payment card numbers, UK National Insurance numbers, US Social Security Numbers, and IBANs. Only the masked value is stored; the original is never persisted. The number of values masked in each call is recorded, so a compliance report can state it without re-reading the data.
Secret redaction
The same path detects and removes credentials before storage: OpenAI, Anthropic, AWS, GitHub and Navige API keys, bearer tokens, JSON web tokens, and values assigned to password, secret, token or private-key fields. Credential-bearing query parameters are redacted from any URL before it is logged.
API key security
Navige agent keys are stored as irreversible SHA-256 hashes alongside an eight-character display prefix. Plaintext keys are shown to the account holder once, at the time of issuance, and are not retrievable afterwards by anyone, including Navige staff.
Access controls and data isolation
Each Controller’s data is stored under a unique organisation identifier, and access controls are enforced at the application layer so that one Controller’s data is never visible to another. Administrative access to production systems is restricted to personnel with an operational need, is subject to access review, and is logged.
Append-only audit records
The action ledger is append-only: a database trigger refuses any update or delete against it, so a governance decision cannot be altered or quietly removed after the fact. The sole exception is the cascading deletion of an entire organisation under clause 10.5, which is the mechanism by which erasure rights are honoured.
Audit log integrity
For Controllers who enable blockchain anchoring (optional, off by default), a keccak256 hash of each batch of audit records — chained to the hash of the batch before it — is anchored to the Polygon public blockchain. Any individual decision can be proved to have been part of an anchored batch, and unaltered since, using a signed receipt that verifies offline against Navige’s published signing key.
Failure behaviour
Where Navige cannot reach its own policy, counter or budget state, the decision it returns is recorded as a degraded decision and never as a normal allow or deny. Read-shaped and unclassified actions fail open; actions that write, destroy or move money fail closed. The Controller may change both defaults.
Separation of environments
Production data is not copied into development or test environments. The automated test suite refuses to run against a production database.
Version history
- 1.2 — 14 October 2026. Retention stated accurately (10.1–10.3); international transfers restated against the actual hosting arrangement (Article 8); SCC modules identified (8.3); Anthropic removed from Schedule 2 and Framer added; contact details added (Article 14); no-training commitment (4.7) and prompt-content position (2.7) made explicit; Schedule 3 expanded to cover secret redaction, append-only records, failure behaviour and environment separation.
- 1.1 — 6 October 2026. Added optional provider billing reconciliation (2.5–2.6).
Navige Ltd, registered in the United Kingdom · hello@navige.ai