Privacy Policy
Navi is built by Ovika Labs Ltd, a company registered in England and Wales (company no. 17119956), registered office: 3 St. Thomas Court, Bexley, DA5 1AU, United Kingdom. We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office under number C1996309.
This policy covers the Navi app and the ovika.net website. It tells you what we collect, why, what we never do with it, and the rights you have. We have tried to keep it short enough to actually read.
The short version
- Navi is a home-admin app: it helps you keep on top of the things your household runs on — policies, renewals, your vehicles and home, and the bills behind them — based on what it can see.
- We see your bank data only if you explicitly connect a bank — and even then we can only read it, never move or change anything. You can disconnect at any time, and we delete that connection's data when you do.
- Navi is built to show you derived insights rather than a raw bank-statement view.
- We never sell your data, never use your bank data for marketing or advertising, and never share it except with the providers needed to run the service or where the law requires.
- Your core Navi service data is stored and processed in the United Kingdom. Support email and notifications may be processed by the providers listed below.
- Delete your account and your data is deleted — genuinely. Deleted data may remain in encrypted backups for up to seven days.
What we collect
What you give us
- The details you sign up with — your name and the email address you sign in with.
- Things you add to Navi so it can help you — for example a vehicle registration number or your postcode.
- Documents you choose to send or forward to Navi (for example a renewal letter), so Navi can read the dates and details in them for you.
Bank data — only with your explicit consent
If you choose to connect a bank account, Navi retrieves read-only account, balance and transaction data through Finexer Ltd, an account information service provider authorised by the Financial Conduct Authority. Ovika Labs Ltd will act as an agent of Finexer. You authorise access at your own bank using your bank's own security (Strong Customer Authentication); Navi never sees your bank login details. We retrieve up to about 13 months of transaction history, which is what we need to spot annual commitments such as insurance renewals. Consent is reconfirmed at least every 90 days and you can revoke it at any time in the app.
Finexer requires a customer record for you before a bank can be connected. The first time you connect, we send Finexer your name and your sign-in email address to create that record, and nothing else about you.
We minimise this data as it arrives: we strip identifiers we do not need. We do not store account numbers or sort codes in our transaction records, we do not store running balances, and we never hold card numbers.
Public-register data
For items you add, Navi looks up public or official records to keep them current — for example MOT and vehicle records from the DVSA, or council tax band information for your property. These lookups use only what you provided (such as a registration plate or postcode).
Technical data
Basic technical information needed to run and secure the service — such as device type and app version, and server logs of requests to our systems.
Website visitors
The ovika.net website uses no cookies, no analytics and no trackers, and your browser makes no requests to any third party when you visit it.
How we use your data, and the legal basis
| Purpose | Data | Legal basis (UK GDPR) |
|---|---|---|
| Providing the Navi service you signed up for — keeping an honest, current picture of your household admin (the items, renewals and dates we can observe) | Sign-up details, items you add, documents you send, register lookups | Performance of a contract (Art. 6(1)(b)) |
| Retrieving and analysing your bank data to identify the recurring commitments (such as bills, policies and subscriptions) within your household admin | Bank account, balance and transaction data via Finexer | Your explicit consent (Art. 6(1)(a)) |
| Keeping the service secure, preventing fraud and abuse | Technical data, logs | Legitimate interests (Art. 6(1)(f)) |
| Meeting our legal obligations (for example responding to lawful requests or exercising your data rights) | Any of the above as relevant | Legal obligation (Art. 6(1)(c)) |
What we never do
- We never sell your personal data.
- We never use your bank data for marketing, advertising or profiling for advertising.
- We never give you financial advice, and we never make automated decisions about you that have legal or similarly significant effects.
- Access to your data is scoped to your household by design — enforced at the deepest layer of our systems, and checked automatically in our build pipeline.
Who we share data with
Only the providers needed to run the service, under contracts that protect your data:
- Finexer Ltd — the FCA-authorised provider through which bank connections are made. Finexer's own privacy policy describes its processing.
- Amazon Web Services — our cloud infrastructure (including Amazon Cognito for sign-in), in the UK (London, eu-west-2) region.
- Cloudflare — serves the ovika.net website.
- Zoho — runs our company email — if you write to any @ovika.net address, your correspondence is processed there (hosted in the EU).
- Expo — delivers app notifications (via Apple and Google's push services) if you enable them.
We do not share your personal data with anyone else, unless we are required to by law.
Where your data lives
Your Navi service data is stored and processed in the United Kingdom (AWS eu-west-2, London). Beyond that, the website is served through Cloudflare's global network, support email is hosted in the EU, and app notifications are delivered through Expo, Apple and Google — each under appropriate safeguards.
How long we keep it
- While you use Navi: we keep a minimised transaction record and the insights derived from it over a rolling window of about 13 months — the period needed to see a full year of your household's commitments and renewals. Older transaction records are purged on a schedule.
- If you disconnect a bank or revoke consent: we stop retrieving data immediately and delete that connection's bank data.
- If you delete your account: all your bank-derived data, insights and documents are deleted from our live systems and your bank consent is revoked. Deleted data may remain in encrypted backups for up to seven days, after which it no longer exists in any copy.
How we protect it — and if something goes wrong
All data is encrypted in transit and at rest, with additional field-level encryption for the most sensitive data. Access is least-privilege, systems are monitored, and callbacks from our providers are cryptographically verified. Security measures are reviewed at least annually.
If a data breach were ever likely to put you at high risk, we will tell you without undue delay, and we notify the Information Commissioner's Office where the law requires it.
Your rights
You have the right to access, correct, delete, and receive a copy of your personal data; to withdraw consent at any time; to object to or restrict certain processing; and to complain to the Information Commissioner's Office (ico.org.uk). To exercise any right, contact us at support@ovika.net — we respond within the timescales set by law.
Age
Navi is for adults. You must be at least 18 to use it.
Changes to this policy
If we change this policy, we will post the new version here with a new effective date, and tell you in the app before any material change takes effect.
If Navi ever closes
If we ever shut the service down, we will give you notice where we can and delete your personal data as described above.
Contact
Ovika Labs Ltd · 3 St. Thomas Court, Bexley, DA5 1AU, United Kingdom · support@ovika.net