Privacy Policy

1. Data Controller

Navero App, a eenmanszaak registered in the Netherlands, acts as the data controller for personal data processed through our platform unless explicitly stated otherwise.

Registered address: Pompenburg 384, Rotterdam, the Netherlands. KvK number: 99925451. VAT number: NL005418730B96.

2. Data We Process

• Account and profile data (such as email address, account identifiers, authentication method, security settings, language, and region).
• Portfolio-related data you provide or authorize us to import, including accounts, holdings, balances, transactions, dividends, notes, and calculated analytics.
• Subscription and purchase data, such as product, billing provider, purchase or receipt identifiers, entitlement status, renewal state, and subscription dates. Navero does not receive your full App Store payment-card details.
• Mobile-device and usage data, such as app installation or device identifiers, app version, operating system, language, time zone, app interactions, and technical request metadata.
• When you choose Google Sign-In, Google's iOS SDK may process a user identifier to record the OAuth grant and an IP address that may estimate a general location for fraud prevention. Navero does not request device location permission or a phone-number scope and sends only the resulting identity token to the Navero backend.
• Push-notification data, including the Expo push token, platform, permission and category preferences, notification route/content needed for delivery, delivery status, and error receipts.
• Support communications, issue reports, and attachments you choose to upload, including selected photos, screenshots, or documents.
• Email choices and consent records, suppression status, and delivery events such as sent, delivered, opened, clicked, bounced, complaint, and unsubscribe events.

3. Legal Bases

We process personal data on one or more legal bases: performance of a contract for requested account and service communications, legitimate interests where those interests are not overridden by your rights, legal obligations, and consent where required.

Where applicable law requires consent for direct marketing by email, we send account-opening, sales/conversion, or product-marketing emails only after obtaining valid consent. Any legally available existing-customer exception is used only when its conditions are satisfied.

4. Purposes of Processing

• To provide and secure the service.
• To import, organize, and display portfolio information.
• To communicate service updates and support responses.
• To help you complete an account-opening process you started and explain available plans, where permitted by law.
• To send optional product updates and marketing communications according to your separate choices.
• To record email delivery, engagement, suppression, and preference events so we can operate communications, measure effectiveness, prevent unwanted sends, and demonstrate compliance.
• To validate purchases, prevent duplicate billing, provide subscription entitlements across Navero mobile and web, and restore App Store purchases.
• To register devices for notifications, apply your notification choices, deliver requested alerts, route opened notifications to the relevant screen, and diagnose delivery failures.
• If enabled in a future release after any required consent controls are available, to measure production-app onboarding and authentication funnels, reliability, and feature usage using Firebase Analytics. The current iOS release keeps Firebase Analytics collection disabled, excludes advertising-ID support, and does not use mobile analytics for cross-company advertising tracking.
• To improve reliability, usability, and fraud prevention.
• To comply with legal and regulatory obligations.

5. Email Communications and Your Choices

Essential account, authentication, security, billing, and support messages are service communications and are not controlled by optional marketing preferences.

Account-opening reminders and plan offers are an optional non-transactional category. If you choose this category during registration, Navero may send helpful account-opening reminders and information or offers about available plans while the account-opening process remains incomplete, but only where this is permitted by law and any required consent has been obtained.

Separately, Navero may send a limited number of account-opening service messages to help you complete a process you initiated. These messages are support-focused and do not contain plan offers or product promotion.

Product-marketing emails and weekly or monthly digest emails are separate categories. A choice about one category does not automatically opt you into another.

You can change these choices through the preferences link in an email. Each non-transactional message provides a simple way to stop that category, and you can also unsubscribe from all optional email. Withdrawing consent or objecting does not affect essential service messages or processing that occurred before your choice changed.

6. Sharing of Data

We may share data with processors and service providers that support hosting, communications, customer support, analytics, notifications, identity, and billing operations under appropriate contractual safeguards.

Mobile providers include Apple for App Store distribution, Sign in with Apple, purchases, subscriptions, and push delivery; RevenueCat for purchase validation and entitlement synchronization; Google for Google Sign-In and Firebase Analytics; and Expo for push-token registration and forwarding notification payloads to Apple Push Notification service. Expo states that push content is held only as needed for delivery rather than stored in its databases.

Other providers include Resend for transactional and permitted marketing email delivery and delivery-event processing, and Paddle for web subscription and payment processing.

We do not sell personal data.

We do not combine mobile user or device data with third-party data for targeted advertising, share it with data brokers, or otherwise use it for tracking as Apple defines that term.

We may disclose data when legally required or to protect rights, security, and platform integrity.

7. International Transfers

If personal data is transferred outside the European Economic Area, we apply appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses.

8. Retention

We retain personal data only as long as necessary for the purposes described in this policy, including legal, accounting, and security obligations.

Account and portfolio data are generally retained while your account is active and for up to 12 months after account closure, unless a shorter or longer period is required by law.

Billing and tax records are retained for statutory periods that apply to us (for Dutch tax administration purposes, this is commonly up to 7 years).

Security and operational logs are retained for up to 12 months unless extended retention is required for incident investigation or legal obligations.

Email delivery and engagement events are retained only as long as needed for communications operations, measurement, security, and compliance. We may retain suppression and objection records longer so that we continue to honor your choice not to receive optional email.

Active push tokens and notification preferences are retained while needed to provide notifications and are revoked or removed when you disable notifications, sign out where supported, delete your account, or when the provider reports that the device is no longer registered. Short-lived delivery tickets and receipts are retained only for delivery and troubleshooting.

App Store and RevenueCat purchase records are retained for subscription entitlement, fraud prevention, dispute, accounting, and legal obligations. Firebase Analytics collection is disabled in the current iOS release. If analytics is enabled in a future release after any required consent controls are available, its data will be retained according to the published production configuration and will not be used by Navero for advertising tracking.

Support attachments are retained only as long as needed to resolve and document the support request, subject to security, dispute, and legal-retention needs.

Encrypted backups are retained on a rolling basis for up to 35 days before automatic deletion or overwrite.

9. Your Rights

• Access, rectification, erasure, and data portability.
• Restriction of processing and objection to processing based on legitimate interests.
• Withdrawal of consent where processing is based on consent.
• Objection at any time to processing for direct marketing; after an objection, we stop using your personal data for that purpose.
• Where available, data portability exports can be requested through in-product self-service downloads (CSV and JSON formats).
• Deletion requests are handled without undue delay and, in normal cases, within 30 days, subject to legal retention obligations.
• Lodging a complaint with a supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Security

We use technical and organizational security measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction.

These measures include encryption in transit, access controls based on least privilege, monitoring, and security hardening for production systems.

No method of transmission or storage is completely secure, but we continuously work to reduce risk and respond quickly to incidents.

11. Cookies and Similar Technologies

We use cookies or similar technologies necessary for service functionality and security. Where legally required, non-essential cookies are used only with valid consent.

12. Contact

For privacy requests or questions, contact Navero App at support@navero.app.