Skip to content
Navapatra

Change language

Get API keySign in

Privacy policy

Effective 2026-10-24

Who we are

Navapatra is provided by Phantom Inc Pvt Ltd, a private limited company incorporated in Nepal, with its registered office in Kathmandu, Nepal.

We process personal data in accordance with Nepal's Individual Privacy Act, 2075 (2018) and India's Digital Personal Data Protection Act, 2023, where they apply.

Our role

  • Account, billing and website data: we are the controller (the Data Fiduciary under the Indian Act).
  • Data in API requests, which we process on your instructions to compute responses: we are a processor (a Data Processor). You are the controller (Data Fiduciary). You are responsible for giving your end users notice, obtaining any consent the law requires, and obtaining verifiable parental consent where the law requires it for children's data.

The short version

Birth data you send to the API is used to compute the response and is never stored or logged. Saved profiles, if launched, will be opt-in and covered by an update to this policy.

What we collect

  • Account details: email, name, organisation and team roles.
  • Sign-in sessions for the dashboard: the IP address and browser user agent, kept until the session expires.
  • Billing details: payment records (from the payment provider or your bank transfer, recorded by our team), invoices and, if you give them, the legal name, address and PAN printed on your invoices.
  • Audit log: security and billing actions in your organisation (for example key changes and payments) with the IP address that made them. The IP address is removed after 30 days.
  • Request log: one line per API request with the request id, route, status, duration and organisation id. No IP address, request body or query string.
  • Usage records: organisation, key, endpoint, status, credits charged, duration and time, rolled up per hour.
  • Rate limiting: for the demo key and publishable (pk_) keys, the client IP address (IPv6 shortened to its /64 prefix) is the name of a rate-limit counter that holds only a token count and a timestamp. The counter is deleted after 10 minutes without requests.

What we never collect

  • Request and response bodies, including birth dates, times and places.
  • Birth data from the free tools on this website.
  • Birth data or API payloads in analytics.

Analytics and cookies

The website uses PostHog, hosted in the EU, only after you agree in the consent banner. It records page views and a few product events (pricing viewed, signup started, free tool used), never form contents. Autocapture and session recording are off, and PostHog keeps its identifier in your browser's local storage. The docs do not use analytics.

The free tools use Cloudflare Turnstile to check that a person, not a bot, is making the request.

Sub-processors

  • Cloudflare, Inc. (United States; global edge network): hosting, Workers Logs, KV, Durable Objects (including the rate-limit counters above), queues and Turnstile.
  • Supabase Inc. (database hosted in Mumbai, India): account, organisation, billing, usage and audit data.
  • Resend (United States): transactional email.
  • PostHog (EU): website analytics, only with your consent.

Payment providers (bank transfer, and Khalti, eSewa or connectIPS when enabled) process your payment as independent controllers under their own terms.

Where data is processed

Requests are served by Cloudflare's global network, so they may be processed in the data centre nearest to the caller. Account, organisation, billing, usage and audit data is stored in Mumbai, India. Transactional email is sent from the United States, and website analytics, with consent, is processed in the EU.

Retention

  • Request and response bodies: never stored.
  • Request log lines: up to 30 days.
  • Usage records: hourly rollups for 25 months.
  • Audit log: as long as payment records. IP addresses are removed after 30 days.
  • Webhook delivery records: 30 days.
  • Sign-in sessions: until they expire.
  • Payments, invoices, credit notes and the credit ledger: as long as Nepal tax law requires.
  • Closed organisations: 30 days after closure, members, invitations, API keys, webhook endpoints and alert settings are deleted and the organisation record is anonymised. Statutory records are kept with the buyer email removed; a VAT invoice keeps the buyer name, PAN and address as issued.

Data Processing Addendum

This addendum applies to all customers on all plans, for personal data in API requests that we process for you.

  • We process that data only on your documented instructions, which are the API requests you send and these terms.
  • Our personnel with access to it are bound by confidentiality.
  • We maintain appropriate technical and organisational security measures, including encryption in transit, key hashing and access controls.
  • We use the sub-processors listed above. We give at least 30 days of notice by email before adding a new one. You may object by closing your account before the change takes effect, and we refund your unexpired paid credits pro rata.
  • We help you respond to requests from your end users to exercise their rights.
  • We notify you of a personal data breach affecting your data without undue delay and in any case within 48 hours of becoming aware of it.
  • Request data is not kept after the response. At the end of the service we delete your data as described under Retention, except records we must keep by law.
  • Data may be processed in the locations listed under "Where data is processed".

Your rights

You can access, correct, export or delete your account data from the dashboard, or ask us by email at privacy@navapatra.com. We complete requests within 30 days. Where processing is based on consent, you can withdraw it at any time; for analytics, use the consent banner.

Privacy contact and grievances

Privacy questions, requests and grievances: privacy@navapatra.com. We respond within 30 days. If you are not satisfied with our response, you may complain to the data protection authority that applies to you.