Introduction
NavisTeams ("NavisTeams," "we," "us," or "our") is a workforce management platform operated by Skyros Properties LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform at app.navisteams.com and navisteams.com (collectively, the "Platform"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Platform.
1. Information We Collect
1.1 Information You Provide
- Account registration data: name, email address, password, role, and organization details
- Employee profile data: first name, last name, work email, job title, department, hire date, employment type, and profile photo
- HR and onboarding documents: uploaded files including identification documents, certifications, licenses, signed agreements, and compliance forms
- Timesheet and scheduling data: clock-in/out times, shift assignments, break records, and overtime data
- Task and checklist data: task assignments, completion status, notes, and step records
- Messages and communications sent through the Platform's internal messaging features
- Virtual meeting data: meeting titles, descriptions, attendee lists, and video conference links
- Performance rankings: scores and manager notes entered by authorized managers and administrators
- Marketing calendar data: events, action items, and import records
- Support requests and feedback submitted through the Platform
1.2 Information Collected Automatically
- Log data: IP address, browser type, operating system, pages visited, time spent, and referring URLs
- Device identifiers and session tokens
- Cookies and similar tracking technologies used for authentication and session management
- Usage analytics including feature interactions and error reports
1.3 Information from Third-Party Integrations
When you connect third-party services, we receive limited data necessary to provide the integration:
- Google (Google Meet, Google Calendar): OAuth tokens, account email address, and calendar event data
- Zoom: OAuth tokens, account email address, and meeting metadata
- Intuit QuickBooks Online: OAuth tokens, company name, realm ID, and timesheet sync data
- Microsoft Teams: OAuth tokens and account identifiers (when connected)
- Point-of-sale systems (Square, Roller, and others): API credentials and connection status
2. How We Use Your Information
We use the information we collect to:
- Create and manage your account and organization
- Provide, operate, and improve the Platform's workforce management features
- Process timesheets, schedules, and compliance records
- Send email notifications and reminders related to your account, tasks, documents, and deadlines
- Power AI-assisted features including natural language reporting, form parsing, performance insights, and marketing calendar event extraction (see Section 4 for AI disclosure)
- Facilitate connections to third-party integrations you authorize
- Respond to support requests and troubleshoot issues
- Enforce our Terms of Service and comply with legal obligations
- Protect against fraud, unauthorized access, and security threats
- Generate anonymized, aggregated analytics to improve the Platform
4. Artificial Intelligence Disclosure
NavisTeams uses the Anthropic Claude API to power certain AI features including:
- Natural language reporting and analytics queries
- AI Form Builder (parsing uploaded PDFs, images, and text into task templates)
- Performance ranking insights and manager summaries
- Marketing calendar event extraction from uploaded files
When you use these features, the text, document content, or data you submit is sent to Anthropic's API for processing. Anthropic processes this data pursuant to its own privacy policy and data processing agreements. AI-generated outputs are suggestions only and do not constitute legal, HR, employment, or financial advice. You are responsible for reviewing and validating all AI-generated content before acting on it.
We do not use your data to train AI models without your explicit consent.
5. Data Retention
We retain your data for as long as your account is active or as needed to provide the Platform. Specifically:
- Active account data is retained for the duration of your subscription
- Deleted tasks and records are soft-deleted (marked with a deleted_at timestamp) and retained for 90 days before permanent deletion
- HR documents are retained according to the retention period configured by your organization administrator (default: 7 years to support employment compliance)
- Audit logs are retained for 12 months
- After account termination, we retain minimal data for 30 days to allow export, then permanently delete it within 90 days
- Backup data may persist for up to 30 additional days after permanent deletion
6. Data Security
We implement industry-standard security measures to protect your information including:
- Encryption of data in transit via TLS 1.2 or higher
- Row-level security (RLS) enforced at the database level ensuring users can only access data within their organization
- Authentication via Supabase Auth with email verification gating
- Password protection including Have I Been Pwned (HIBP) breach detection
- Login rate limiting and account lockout protections
- Cross-tenant data isolation enforced at every query level
- Audit logging of sensitive administrative actions
- File upload validation (MIME type and size enforcement)
No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
7. Employee Data and Employer Responsibilities
NavisTeams is a business-to-business platform. When an employer (the "Organization Administrator") uses NavisTeams to manage employee data:
- The Organization Administrator is the data controller for employee data entered into the Platform
- NavisTeams acts as a data processor on behalf of the Organization Administrator
- Organization Administrators are responsible for ensuring their use of the Platform complies with applicable employment laws, including the Fair Labor Standards Act (FLSA), California Labor Code, WARN Act, and all applicable state and local labor regulations
- Employees should contact their employer (the Organization Administrator) regarding how their data is used within the Platform
8. Minor Employees
Some organizations using NavisTeams (including entertainment venues and food service operations) may employ workers under the age of 18. NavisTeams's scheduling and compliance features include minor-hour limit tracking designed to assist employers in complying with applicable minor employment laws. However, Organization Administrators remain solely responsible for compliance with all federal and state child labor laws. NavisTeams does not knowingly collect personal information from individuals under 13 without verifiable parental consent.
9. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: You may request information about the personal information we have collected about you and how it has been used and shared
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions
- Right to Correct: You may request correction of inaccurate personal information
- Right to Opt-Out of Sale: We do not sell personal information
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise these rights, contact us at privacy@navisteams.com. We will respond within 45 days.
11. Third-Party Links
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.
14. Marketing Communications and Data
14.1 Marketing Communications We May Send You
As a NavisTeams account holder or subscriber, we may send you:
- Product updates, new feature announcements, and platform improvements
- Account-related notifications and onboarding guidance
- Promotional offers, pricing updates, and plan upgrade suggestions
- Industry insights, best practices, and educational content related to workforce management
- Event invitations and webinar announcements
You may opt out of non-essential marketing communications at any time by clicking "Unsubscribe" in any marketing email or by contacting us at privacy@navisteams.com. Transactional and account-related emails (such as security alerts, billing notices, and task notifications) cannot be opted out of while your account is active.
14.2 Data We Use for Our Own Marketing
We may use the following data for our internal marketing and product improvement purposes:
- Aggregated, anonymized usage patterns (e.g., which features are most used, average session length, feature adoption rates) — never individual-level data
- Account tier and organization size (to send relevant plan upgrade communications)
- Your email address and name (for personalized communications)
- Your role (owner, admin, manager) to send role-appropriate content
We do not use employee profile data, timesheet data, HR documents, messages, or any workforce operational data for marketing purposes.
14.3 Marketing Calendar Feature Data
The Marketing Calendar feature within NavisTeams stores your organization's marketing events, promotions, campaigns, and action items. This data is:
- Owned entirely by your organization
- Never used by NavisTeams for our own marketing or shared with third parties
- Processed by the Anthropic Claude API solely when you use the AI import or AI action item generation features
- Retained according to your organization's configured retention period
14.4 SMS and Text Marketing (If Applicable)
If your organization uses NavisTeams's SlickText integration or any SMS-connected workflow tools, the following applies:
- SMS marketing campaigns are operated by your organization, not NavisTeams
- NavisTeams facilitates the connection but does not control, send, or have access to the content of your SMS campaigns
- Your organization is solely responsible for TCPA compliance, including obtaining proper written consent from recipients before sending marketing text messages
- Standard message and data rates may apply to recipients
14.5 Third-Party Marketing Tools
NavisTeams does not share your personal information with third-party advertising networks, data brokers, or marketing platforms. We do not run retargeting campaigns using your data or allow third-party pixels on authenticated platform pages.
14.6 Do Not Sell or Share
We do not sell, rent, or share your personal information or your employees' data with any third party for their own marketing purposes, consistent with California's CCPA/CPRA "Do Not Sell or Share" provisions.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Platform at least 30 days before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.
16. Contact Us
For privacy-related questions, requests, or concerns:
Email: privacy@navisteams.com
NavisTeams / Skyros Properties LLC
California, United States