Privacy Policy

Who we are and when this policy applies

Navvi One provides a multi-tenant recruitment operations platform to customer organizations. Navvi One acts as the operator of the service and is responsible for information collected for account administration, service delivery, security, support and this public website. For recruitment records and other content a customer places in Navvi One, the customer generally determines why that information is processed and Navvi One processes it to provide the service under the customer agreement.

Information we collect

• Account and identity information, such as name, business contact details, organization, login provider identifiers, tenant membership and role.
• Customer content and operational records submitted to the platform, subject to the customer's configuration and use of Navvi One.
• Service, security and audit information, such as session, access, configuration, request and lifecycle events needed to operate and protect the service.
• Website, sales and support information you provide through a form or email, including your contact details, company, current software, team size and message.
• Integration information required to connect and operate third-party services that a customer administrator enables.

Zoom Workplace integration data

When an authorized administrator connects Zoom Workplace, Navvi One may process the Zoom account identity; Zoom user-directory identity, name, email and status; and Zoom Phone user or extension identity, extension number, site, Phone status, calling-plan information and optional assigned direct numbers. A direct number, sometimes called a DID, is not required for a Zoom user to be associated with Navvi.

When the Zoom Phone communication capability is enabled, Navvi One may also process Zoom Phone call-history and Call Element metadata, including participants or numbers, direction, timing, duration, outcome and provider identifiers. User synchronization and Zoom Phone activity logging are in development and are not currently available production functionality.

For authorization and connection management, Navvi One stores the Zoom account identifier, encrypted OAuth access and refresh credentials, granted scopes, connection lifecycle metadata, hashed OAuth attempt state and nonce with associated metadata, and an integration lifecycle audit fingerprint. Credentials are encrypted using AES-256-GCM with a versioned keyring. OAuth attempt state and nonce values are stored as hashes rather than as their original values.

The current requested capability set excludes recordings and audio or video content, recording transcripts, AI call summaries, voicemail content, Zoom Meetings data, and chat or message content.

How we use information

• Provide, secure, maintain and troubleshoot Navvi One.
• Authenticate users, enforce tenant and role boundaries, and administer enabled integrations.
• Respond to sales, support and service communications.
• Monitor service reliability, investigate misuse and maintain accountable lifecycle records.
• Meet contractual and legal obligations and establish or defend legal claims.

Third-party integrations

When a customer enables an integration, Navvi One exchanges only the information and credentials needed for the enabled function and granted permissions. The third party's own terms and privacy practices also apply to its service. Administrators should review requested permissions before authorizing a connection. Integration capabilities may expand only after product, permission and policy updates are made available.

Sharing and service providers

We may share information with infrastructure, communications, security and support providers acting for Navvi One; with an enabled integration provider at the customer's direction; within the customer organization according to access controls; or where required by law, a corporate transaction, or the protection of rights and safety. We do not sell personal information.

Cookies and browser storage

The public Navvi One website does not currently use marketing analytics or advertising cookies. The Navvi One application and enabled authorization flows may use cookies or browser storage that are necessary for authentication, security, session operation and applicable user preferences. For example, the Zoom Workplace connection flow uses a short-lived, Secure, HttpOnly browser cookie to bind an authorization attempt to the initiating browser.

Retention and deletion

We retain information for as long as needed to provide the service, maintain security and audit records, meet contractual or legal obligations, and resolve disputes. Retention varies by record type and customer configuration. Disconnecting an integration stops its authorized use and revokes credentials where supported; limited lifecycle history may remain for security, accountability and account-reservation integrity. Customers may request deletion subject to contractual, legal, security and backup requirements.

Security and international processing

Navvi One uses administrative, technical and organizational safeguards appropriate to the service. No system can guarantee absolute security. Service providers or integration providers may process information in other jurisdictions, where local laws may apply. See our Security page for current control information.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to certain processing, or to request portability. When Navvi One processes customer-controlled recruitment data, requests should normally be directed to that customer.

Changes

We may update this policy as the service, integrations or legal requirements change. We will post the revised policy here and update its effective date.

Contact us

For privacy questions or requests, contact support@navvi.one. Please do not include passwords, credentials or sensitive customer records in your initial message.