Legal
Privacy Policy
Effective date: 18 October 2026
This Privacy Policy describes how Brainfy AI Inc. handles personal data collected through our website (navlyt.com) and our compliance platform.
1. Who We Are
Brainfy AI Inc. ("Navlyt", "we", "our", or "us") provides a compliance and operations platform for charter and air taxi operators. Our registered address is available upon written request. Questions about this policy can be sent to support@navlyt.com.
2. Information We Collect
We collect information you provide directly (name, email, company, role, billing details), information generated through your use of the platform (compliance tasks, crew records, document uploads, audit evidence, usage logs), and limited technical data (IP address, browser type, device identifiers, session cookies) solely for security and service reliability. We do not sell personal data to third parties.
3. How We Use Your Information
We use your information to: (a) deliver and maintain the Navlyt platform; (b) send transactional communications such as expiry alerts, task reminders, and billing receipts; (c) provide product updates and compliance-related notices you have opted into; (d) improve and secure the platform; and (e) comply with legal obligations. We do not use your data to train third-party AI models.
4. Data Sharing
We share data only with: (a) infrastructure sub-processors (Supabase for database and file hosting, Vercel for delivery, Resend for transactional email) under binding data processing agreements; (b) AI providers (Anthropic, and OpenAI as a fallback), which receive the text of a document only when you choose to analyse it, solely to generate proposed findings for your review; (c) payment processors (Stripe) for billing; and (d) law enforcement or regulators when legally required. We require all sub-processors to maintain equivalent data protection standards.
5. Data Retention
We retain account data for the duration of your subscription plus 90 days after cancellation to allow data export. Compliance records (crew certifications, audit evidence, documents) may be retained longer where required by FAA, Transport Canada, EASA, or equivalent regulatory record-keeping obligations. You can delete your account in the Navlyt mobile app (More → Account & privacy) or by emailing support@navlyt.com; see navlyt.com/account-deletion. If you are the only member of your organization, its documents, tasks and findings are permanently deleted with your account, so export any records you are required to retain before deleting.
6. Your Rights
Depending on your jurisdiction, you may have the right to: access, correct, or delete personal data we hold; restrict or object to processing; data portability; and withdraw consent at any time. EEA, UK, and Swiss users have rights under GDPR and equivalent frameworks. California residents have rights under CCPA. Submit requests to support@navlyt.com and we will respond within 30 days.
7. Security
Navlyt uses TLS 1.2+ for data in transit, AES-256 encryption for data at rest, role-based access controls, and regular security review. We pursue SOC 2 Type II attestation. In the event of a security incident affecting your data, we will notify you within 72 hours as required by applicable law.
8. Cookies
We use strictly necessary session cookies to authenticate users and maintain session state. We use no third-party advertising cookies. We use Google Analytics 4 for aggregated website analytics; it sets analytics cookies and does not store IP addresses. You can disable cookies in your browser, though this will impair authentication.
8a. Mobile Apps and Notifications
The Navlyt iOS and Android apps use the same account and data as the web platform. Your session is stored in your device's secure storage. If you turn on reminders, we store your device's push notification token to send them; turning reminders off or deleting your account removes it. The apps contain no advertising and do not track you across other companies' apps or websites.
9. International Transfers
Navlyt's database and file storage are hosted in Canada (Supabase, ca-central-1). Some sub-processors, including our AI providers and email provider, process data in the United States. Where data is transferred from the EEA or UK to the US, we rely on Standard Contractual Clauses approved by the European Commission. A copy of the applicable SCCs is available on request.
10. Children
Navlyt is a business-to-business platform not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided data to us, contact support@navlyt.com and we will delete it.
11. Changes to This Policy
We will post updates to this policy with a revised effective date. For material changes, we will send advance notice by email to the account administrator. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
12. Contact
Privacy questions or requests: support@navlyt.com. For EU/UK inquiries, you may also contact our lead supervisory authority or file a complaint with your local data protection authority.
Questions? Email us at support@navlyt.com