Privacy Policy

1. Who we are

NavonStack (“we”, “us”) is a business based in India, run as a sole proprietorship. We build APINine, a service that watches production APIs for abuse, anomalies and outages. This policy covers:

• this website, navonstack.com, including the blog at navonstack.com/blog;
• the APINine dashboard at apinine.navonstack.com;
• the APINine SDK, which you install in your own application, and the collector it sends data to.

We handle personal data under India’s Digital Personal Data Protection Act, 2023 and the rules made under it. Where the EU or UK GDPR applies to you, we follow it too.

2. What we collect

When you visit the website

• Website analytics, only if you accept. When you first visit, we ask whether we may use HubSpot’s tracking code. If you accept, it records the pages you visit, sets cookies that recognise your browser on later visits, and may use your IP address to work out which company you’re visiting from. If you later become a contact of ours, HubSpot can link your earlier visits to your contact record. If you decline, it doesn’t run. See Cookies and tracking.
• Technical data. Our hosting and network providers process your IP address, browser details and the pages you request to deliver and protect the site.
• Fonts. Pages load fonts from Google Fonts, so your browser connects to Google’s servers.

When you comment on the blog

The comment form asks for your name, email address and comment, and records which post you commented on. We use these to read and reply to your comment. We don’t publish your email address.

When you create a dashboard account

• Your email address, your workspace name, and your password, which we store only as a one-way hash (BCrypt). We never store the password itself.
• The email addresses of teammates you invite.
• The settings you enter: project names, a Slack webhook URL, and email addresses that should receive alerts.
• A session cookie that keeps you signed in.

When your application sends telemetry through the SDK

For each request your API handles, the SDK sends:

• the HTTP method, the route pattern (for example /api/users/{id}), or the request path when no route matches, the status code and the duration;
• the caller’s IP address, unless you turn IP capture off with the SDK’s RedactClientIp option;
• a SHA-256 hash of the caller’s API key, if you configure an API-key header. The hash is computed inside your application, and the key itself never leaves it;
• a request ID, a timestamp, your project, service and environment names, and any custom tags you choose to add;
• periodic heartbeats, so we can tell when your application stops reporting.

The SDK never captures request or response bodies, and it doesn’t send request headers. From this telemetry we produce findings and alerts. These contain the same kinds of fields, such as caller IPs, routes, counts and times.

When you email us or we contact you

We keep the emails you send us and our replies. We also contact people who may find APINine useful. To do that, we get work contact details, such as name, job title, company and work email, from business-data providers (Apollo.io and Lusha). We keep them in our CRM (HubSpot). If you’d rather not hear from us, reply and say so, and we’ll stop.

Payments

We don’t take payments online yet. When we do, Razorpay will process them, and we won’t receive or store your card details.

3. How we use it

• To run the service: to detect abuse and anomalies in your telemetry, raise alerts, deliver them by Slack or email, and enforce plan limits.
• To operate your account: to sign you in, keep it secure, and contact you about it.
• To support you: to answer your questions and fix problems.
• To understand interest in APINine: to learn which companies visit the site, and to reach out to people who may find it useful.
• To meet legal obligations, and to protect the service and its users from abuse.

We don’t sell personal data, and we don’t use your telemetry to advertise to you. We don’t train machine-learning models on your telemetry. APINine’s detection is rule-based.

Legal basis

Where the EU or UK GDPR applies, each use relies on one of these legal bases:

Where India’s DPDP Act applies, we process personal data with your consent, or for a use the Act allows without consent, such as a purpose you gave us your data for, or meeting a legal obligation.

4. Who processes it

We use these providers to run NavonStack and APINine. Each one gets only the data its job needs.

If you connect Slack, we send alerts to the webhook you provide. From then on, Slack handles them under your agreement with Slack. We may also disclose data when the law requires it.

5. Cookies and tracking

• Dashboard: one session cookie keeps you signed in. It’s required for the dashboard to work and is removed when you sign out.
• Website, only if you accept: HubSpot’s tracking code sets cookies (__hstc, hubspotutk, __hssc and __hssrc) that recognise your browser and count your visits.
• Website, always: your browser remembers whether you accepted or declined, so we don’t ask on every page. Cloudflare may set cookies it needs for security.

The website asks before the tracker runs. If you decline, or don’t answer, it doesn’t load. You can change your choice at any time. Declining also removes the cookies HubSpot set on this site.

Change your tracking choice

You can also block or delete cookies and site data in your browser settings. Blocking them doesn’t affect your ability to read the website.

6. How long we keep it

• Telemetry, findings and alerts. Your plan sets a retention period: 30 days on Free, 90 days on Starter. Automatic deletion at the end of that period is still being built. Until it’s live, data may be kept longer than your plan’s period. If you ask, we’ll delete it sooner.
• Account data. We keep it while your account is open, and delete it within 30 days after you ask us to close the account.
• Emails, comments and business contact data. We keep these while they’re useful for the conversation, and delete them when you ask.
• Records we must keep by law, such as financial records once payments start, are kept for the period the law requires.

7. Security

We protect data with these measures:

• Connections to the dashboard and the collector are encrypted with HTTPS.
• Passwords are stored as BCrypt hashes, and API keys as SHA-256 hashes.
• Each customer’s data is kept separate from every other customer’s.
• The SDK never captures request or response bodies.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you and notify the authorities as the law requires.

8. Your rights

You can ask us to:

• tell you what personal data we hold about you, and how we use it;
• correct or complete it;
• delete it;
• stop processing that depends on your consent, by withdrawing it at any time;
• under India’s DPDP Act, nominate someone to exercise these rights for you if you die or become unable to.

If the EU or UK GDPR applies to you, you can also object to processing, ask us to restrict it, and ask for a copy of your data in a portable format.

To make a request or raise a grievance, email hello@navonstack.com with “Privacy” in the subject. We may need to confirm your identity first, and we aim to reply within 30 days. If you’re not satisfied with our answer, you can complain to the Data Protection Board of India. In the EU or UK, you can complain to your local data protection authority.

9. Data about your own users

When your application sends us telemetry about the people who call your API, such as their IP addresses, you decide what is collected, and we process it on your behalf to provide APINine. You’re responsible for telling your users about it and having a lawful basis for it.

The SDK’s options let you limit what’s sent. You can turn off IP capture, exclude paths, and choose not to add custom tags. If you need a data processing agreement, email us.

10. Where data is processed

We’re based in India. Several of our providers are based in the United States and other countries, so your data may be processed outside the country where you live. We only use providers that commit to protecting it, and we follow any restrictions the Indian government sets on transfers.

11. Children

NavonStack and APINine are for businesses and developers. They’re not meant for anyone under 18, and we don’t knowingly collect data about children. If you think we have, email us and we’ll delete it.

12. Changes and contact

We’ll update this policy when what we collect or how we use it changes, and we’ll change the date at the top. If a change is significant, we’ll also tell account holders by email or in the dashboard.

Questions about this policy, or about your data: hello@navonstack.com.

See also our Terms of Service.