Privacy
Birth date, time and place are personal data. Navapatra treats them as input to a calculation and nothing more. This page describes the API; the privacy policy is the binding text and includes the Data Processing Addendum that applies to every plan.
Who is responsible
Section titled “Who is responsible”For data in your API requests, Navapatra is a processor (a Data Processor under India’s Digital Personal Data Protection Act, 2023) acting on your instructions. You are the controller (Data Fiduciary): you give your end users notice and obtain any consent the law requires, including verifiable parental consent for children’s data where required.
What happens to a request
Section titled “What happens to a request”- Request and response bodies are never stored or logged. That covers birth data, kundali payloads sent for matching or charts, and every result.
- Each request writes one log line with the request id, the route (for example
POST /v1/kundali), the HTTP status, the duration and your organization id. No body, no query string, no IP address, no birth data. The platform’s own per-request invocation logs, which would include the URL, are switched off. - Usage records hold the organization, key, endpoint, status, credits charged, duration and time. They feed your dashboard charts and billing.
- Unexpected errors are logged by error type and code location only, because error messages can echo request values.
- Rate limits for the
demokey and publishable (pk_) keys are counted per client IP address (IPv6 by its /64 prefix). The counter holds only a token count and a timestamp. - Nothing is cached between requests: responses carry
Cache-Control: no-store.
There are no server-side profile ids. Matching and chart endpoints take the data each time, which is why they accept a kundali payload you saved yourself.
What you control
Section titled “What you control”If you store charts, you are responsible for them under the privacy law that applies to your users. Responses are deterministic, so you can store only the input and recompute when needed, with the same meta versions giving byte-identical results.
The API itself keeps nothing: there is no option to store birth data on our side.
Where data is processed
Section titled “Where data is processed”| Sub-processor | Location | Purpose |
|---|---|---|
| Cloudflare, Inc. | United States, global edge network | Hosting, logs, KV, Durable Objects (including rate-limit counters), queues, Turnstile |
| Supabase Inc. | Mumbai, India | Database: account, organization, billing, usage and audit data |
| Resend | United States | Transactional email |
| PostHog | EU | Website analytics, only with consent (the docs use none) |
Payment providers process payments as independent controllers.
Retention
Section titled “Retention”| Data | Kept for |
|---|---|
| Request log lines | Up to 30 days |
| Usage rollups (counts per hour, key and endpoint) | 25 months |
| Audit log IP addresses | 30 days |
| Payment records and invoices | As long as Nepal tax law requires |
| Request and response bodies | Never stored |
Requests to delete account data are completed within 30 days.
The docs and the request console
Section titled “The docs and the request console”The request console in the API reference sends requests from your browser straight to https://api.navapatra.com/v1 with the key you enter (the demo key by default). The key is kept in memory for that page only, and the console’s third-party telemetry is switched off.
Questions about privacy, data requests and grievances: see the contact in the privacy policy. General support: hello@navapatra.com.