Your data at NavLayers

Effective 2026-10-13

1. Who is responsible

NavLayers is run by NavLayers Team, Panchkula, Haryana ("we"). We are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR, which apply when you use NavLayers from the EU, the EEA or the UK.

Questions about your data, and complaints, go to our Grievance Officer:

Grievance Officer: NavLayers Team
Email: support@navlayers.com
Address: Panchkula, Haryana

We acknowledge every complaint within 48 hours and resolve it within one month of receiving it.

2. The editor and your maps

The editor runs entirely in your browser. Your projects, the map and the videos you export are made on your device and are not sent to us. To keep your work between visits, the editor stores your current project, your choice of light or dark mode and whether you have seen the guide in your browser's local storage. This stays on your device; you can clear it at any time in your browser's settings. It is strictly necessary for the service you asked for, so we do not ask for consent (for visitors in the EU: Art. 5(3) of the ePrivacy Directive).

The map data, place names and fonts are loaded from our own server. We load nothing from other companies' servers (no Google Fonts, no content delivery networks, no analytics), except Google's advertising code on some information pages (section 7).

3. Visiting the website (server log files)

When you open a page, your browser sends technical data to our server: IP address, date and time, the page requested, the referring page, and your browser and operating system. The server needs this to deliver the pages and keeps it in log files to keep the service secure and find faults. Log files are deleted by our host after a short period, usually within 30 days, unless a security incident has to be investigated. Purpose: a secure, working website (for visitors in the EU and UK, legal basis Art. 6(1)(f) GDPR, our legitimate interest).

Our host is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, which stores our website and database and processes this data on our behalf under a data processing agreement.

4. Your account

To export clips you need an account; you must be at least 18 years old to create one. We store your email address, your password (only as a salted hash, never in readable form), the date you joined, and for each export: when it happened, the format, the size and the frame rate. We need this to provide the service and to protect it from abuse. You give us this data when you create the account, for that purpose (DPDP Act: the specified purpose you consent to by signing up; GDPR: Art. 6(1)(b), performing our contract with you). We keep it until you delete your account, which you can do at any time on your account page; it is then deleted at once.

Signing in with Google or Apple. If you choose Continue with Google or Continue with Apple, you sign in on Google's or Apple's own page, and they tell us your email address and an account number that identifies you to us (with Apple you can choose to share a forwarding address instead of your real one). We store both with your account so that the button signs you in next time; we receive nothing else, such as your name or contacts. Nothing is loaded from Google or Apple until you press the button. Google and Apple learn that you signed in to NavLayers, but nothing about what you do here. They process the sign-in on their side under their own responsibility: policies.google.com/privacy and apple.com/legal/privacy. You can disconnect them on your account page at any time.

Sign-in cookies. When you sign in, we set one cookie (nl_auth) with a random code that keeps you signed in for up to 30 days. While a sign-in with Google or Apple is under way, a second cookie (nl_oauth) with a random code ties it to your browser; it is deleted when you come back, at the latest after 10 minutes. Both are strictly necessary for the service you asked for. We set no other cookies ourselves; for the cookies of Google's advertising see section 7.

Security. To protect sign-in and the forms from abuse, we count requests per IP address for a short time (at most a day).

AI apps (Claude, ChatGPT, Codex and others). If you connect an AI app to NavLayers (see Use with AI), you sign in here and allow it. We then store the connection: the app's name and the addresses it registered, when you connected it and last used it, and its access codes (only as hashes). The app can make, change, list and delete map animations in your account, look up places, and read your email address, plan and how many clips you have left; it cannot see your password, payment details or the maps saved in your browser. Animations made this way are stored on our server with your account until you or the app delete them, or you delete your account; anyone who has an animation's link can open it. What you type into the AI app, and what our server answers it, is processed by the company behind that app under its own privacy policy (for example Anthropic for Claude, OpenAI for ChatGPT and Codex); we do not control that. Purpose: the connection you asked for (GDPR: Art. 6(1)(b)). You can disconnect an app at any time on your account page; its access ends at once.

5. Google user data (Sign in with Google)

This section explains how NavLayers handles information it receives from Google when you choose Continue with Google. It applies only to that sign-in.

What we access. With your permission on Google's sign-in page, we request only the scopes openid and email. From them we receive your Google account's email address, whether Google has verified that address, and a unique account identifier ("sub") that Google issues for NavLayers. We do not request or receive your name, profile picture, contacts, Gmail, Google Drive, calendar or any other Google data, and we do not receive your Google password.

How we use it. Only to sign you in and to keep your NavLayers account: the identifier recognises you the next time you choose Continue with Google, and the email address is your account's address (for sign-in, password reset, receipts and service messages about your account). We do not use Google user data for advertising, we do not sell it, we do not use it to build profiles, and we do not use it to develop, improve or train artificial intelligence or machine learning models.

Sharing. We do not share or transfer Google user data with anyone, except with our hosting provider (Hostinger, see section 3), which stores our database on our behalf under a data processing agreement, or where the law requires it.

Storage and protection. The email address and identifier are stored in our database with your account. Access is protected by encrypted connections (HTTPS), and the database is reachable only by our server. Sign-in sessions are stored only as one-way hashes.

Retention and deletion. We keep this data as long as your account exists. You can remove the Google sign-in at any time on your account page (Sign-in methods → Disconnect); the identifier is then deleted at once. When you delete your account on the account page, all of its data, including the Google identifier and email address, is deleted at once. You can also ask us to delete it by writing to support@navlayers.com, and you can revoke NavLayers's access in your Google account at myaccount.google.com/connections.

Limited Use. NavLayers's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Donations (PayPal)

NavLayers is free to use. If you choose to support it with a donation, you donate on PayPal's own page; we never see your card or bank details. PayPal tells us your name, email address, the amount and the date, and we keep these as records of the donation. Recipient: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, which also processes the payment under its own responsibility, for example to prevent fraud and meet legal duties: paypal.com/privacy. You give this data to make the donation, for that purpose (GDPR: Art. 6(1)(b) and (c)). Donation records are kept for as long as tax and accounting law requires.

7. Advertising (Google AdSense)

Some information pages (such as the home page, the FAQ, About and this policy) show ads from Google AdSense, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). There are no ads in the editor, on the sign-in and account pages, or in our emails. To show them, your browser loads code from Google's servers, which receive your IP address, the page you are on and technical details of your browser.

Your choice. Where the law requires it, in particular when you open a page with ads from the EU, the EEA, the UK or Switzerland, Google first asks for your consent (Google's consent message, a consent management platform certified by Google that uses the IAB Transparency and Consent Framework). Only if you agree may Google and its advertising partners store or read cookies and similar identifiers on your device and show ads based on your interests; Google's consent message lists the purposes and the partners. Legal basis: your consent (DPDP Act; GDPR: Art. 6(1)(a)). If you do not agree, Google can still show ads that are not based on your interests (non-personalised or limited ads). You can change or withdraw your choice at any time under Cookie settings, at the bottom of every page; withdrawing does not affect what happened before. You can also turn off personalised ads for your Google account at myadcenter.google.com.

Google's own processing. Google decides itself how it uses this data, as a separate controller under its own privacy policy: how Google uses information from sites that use its services. Google may process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. We do not receive personal data about you from Google, only totals of how many ads were shown and clicked.

8. Email news

If you subscribe to our email news (with the box when you create an account, or on your account page), we send occasional emails about new features, tips and NavLayers news to your account's email address, a few times a year at most. You are subscribed only after you click the link in the confirmation email we send first (double opt-in). We store when you asked to subscribe and when you confirmed, to be able to prove your consent, and a random code for the unsubscribe link. Legal basis: your consent (DPDP Act; GDPR: Art. 6(1)(a)).

You can unsubscribe at any time, free of charge: with the link in every news email, the unsubscribe button of your email app, on your account page, or by writing to us. The news then stops at once, and we delete the subscription details. The emails are plain text: we do not track whether you open them or click their links. They are sent from our mailbox at our host Hostinger (section 3).

9. Contact form and email

When you write to us, by email or through the contact form, we use your name, email address and message to answer you, and delete them when the matter is settled unless the law requires us to keep them. We also send you emails the service needs, such as sign-up codes, password reset links and confirmations. News emails come only if you subscribe to them (section 8).

10. Where your data is processed

We are based in India and manage NavLayers from there; our host stores the website and database in its data centres. If you use NavLayers from the EU, the EEA or the UK, your data therefore reaches India, for which the EU has not decided that the level of data protection is adequate. This is necessary to provide the service you ask for (Art. 49(1)(b) GDPR). We protect your data as this policy describes, and you keep the rights in section 12.

11. Who receives data

Only the service providers named above (hosting and email: Hostinger; if you donate: PayPal; advertising: Google; if you choose to sign in with them: Google or Apple; if you connect one: the AI app you chose), and authorities where the law requires it. We do not sell personal data.

12. Your rights

Everyone can ask us for a summary of the personal data we hold about them and how we use it, have it corrected, completed, updated or erased, withdraw consent (by deleting the account, or writing to us), and complain to our Grievance Officer (section 1). We answer within one month.

In India (DPDP Act) you can also nominate another person to exercise your rights if you die or become unable to, and, if our answer to a complaint does not satisfy you, complain to the Data Protection Board of India.

In the EU, EEA and UK (GDPR) you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21), and you can complain to a data protection supervisory authority, in particular the one where you live or work.

13. No automated decisions

We do not make decisions about you based solely on automated processing, and we do not build profiles.

14. Changes

We update this policy when the service or the law changes. The current version is always on this page; important changes are announced by email.