Navoras turns text into speech in Kenyan English and Kiswahili. To do that we handle information about the people who use Navoras, and the text and audio they send us. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it.
Who we are
Navoras ("we", "us") is based in Nairobi, Kenya. You can reach us at Write to us using the form .
We follow Kenya's Data Protection Act, 2019 and its regulations. If you are in the European Union or the United Kingdom, we also apply the rights the GDPR gives you.
Your data and your customers' data
Information reaches us in two ways, and our responsibility differs between them.
- Information about you, the people who use Navoras: your email address, your workspace, your payments and how you use the service. We decide how this is used, so we are its data controller.
- What you send to be spoken or aligned: the text of your requests, audio you send for alignment, and pronunciation dictionaries. They may name or include your own customers. You decide what goes in, so for this material you are the controller and we are your data processor, as our terms of service set out.
What we collect
When you sign up and use your account
- Your email address, and a password if you choose to set one (stored only as a hash).
- If you turn on two-step log-in, the key your authenticator app uses (encrypted) and your recovery codes (stored only as hashes).
- The workspaces you belong to, your role in each, the invitations you send and receive, and a log of changes to members, roles, keys, plans and billing.
- Your API keys, stored only as hashes, with their names, permissions, limits and when they were last used.
When you make speech
- For every request: when it was made, which key or person made it, the endpoint, voice and model, how many characters and credits, how long it took, whether it worked, and a SHA-256 fingerprint of the text, which can't be turned back into it.
- With logging on (the default): the text and the audio, for your plan's history days, so you can find them in History and so a repeat with the same seed is free. With logging off, for a request or a whole key, we keep neither.
- Audio you send for forced alignment is used only to time it and is not kept; its text is kept only as a fingerprint.
- Our logs carry request IDs, never your text.
When you pay
Payments are handled by Paystack. You enter your card or M-Pesa details on Paystack's checkout, not ours, so we never see or store your full card number or M-Pesa PIN. We keep the payment's reference, amount, method, plan or pack, dates and whether it went through, and Paystack's identifiers for your subscription and, if you pay by card, for the saved card (its brand, last four digits and expiry), so a plan can renew and auto top-up can work.
When you write to us
When you use our contact page we keep your name, email address, company (if you give one), the topic and your message, with your IP address and browser details, and your account if you were logged in. We use them only to answer you.
When you raise a support case we keep what it's about, your messages and ours, any files you attach, and who raised it. If you name a request, we keep what it was (its ID, endpoint, voice, model, result and timing), never its text. If you answer one of our replies by email, Brevo receives your email and passes us its text, its files and the address it came from. When a case is solved, we keep whether you told us it fixed things. Owners and admins of your workspace can read its cases; members see their own.
Automatically
- Your IP address and browser details, in our server logs, to check a key's allowed addresses, and to limit how often log-in, sign-up and similar actions can be tried.
- When you last logged in, and which device sessions are open.
- Whether our emails reached you, which our email provider, Brevo, records.
We don't use advertising trackers or analytics cookies, and we don't buy information about you from anyone.
Why we use it
| What we do | Why we're allowed to |
|---|---|
| Run your account and workspaces, make your speech, keep your history | To perform our contract with you |
| Take payments, grant and charge credits, send receipts | To perform our contract, and to keep the records tax law requires |
| Send account emails: log-in links, invitations, credits running low, payment problems | To perform our contract |
| Answer messages and support cases | Our legitimate interest in answering you, or steps you ask for before signing up |
| Keep the service secure, stop abuse, fraud and bots, fix errors | Our legitimate interest in a safe, working service |
| Understand usage and costs, to set prices and plan capacity | Our legitimate interest in running a sustainable business |
| Respond to legal requests, enforce our terms | Legal obligation, and our legitimate interests |
We don't sell personal information, and we don't use it for advertising.
How speech is made
Navoras makes speech with open models it runs on its own servers: your text is not sent to any other AI company. Before a voice reads it, our text layer writes out numbers, money and dates. When you ask for read-back, a speech recognition model, also run by us, listens to the audio to check it.
We don't train our models on your text or audio. Our voices are made from recordings by Kenyan voice actors, made with their written consent.
Who we share it with
We share information only with the companies that help us run Navoras, each bound by contract to use it only for that purpose and to protect it:
| Provider | What they do for us |
|---|---|
| Hostinger | Hosts the server that runs Navoras, and the history's audio kept on it |
| Neon | Hosts our database |
| Cloudflare | Carries traffic to our site and API and protects it from attacks; checks that sign-ups and contact messages come from people, not bots (Turnstile, on those forms only) |
| Paystack | Card and M-Pesa payments |
| Brevo | Sends our emails and records their delivery; receives your email replies to support cases |
When we add GPU servers in a cloud region to make speech, the provider will be added here before any of your text reaches it. Inside your workspace, the people you invite see what their role allows. We may also disclose information when the law requires it, to protect someone's safety, or to a buyer if Navoras is sold or merged, who would be bound by this policy.
Where it's stored
Our database is hosted by Neon in Frankfurt, Germany, and our server by Hostinger. Cloudflare handles traffic in many countries. When information leaves Kenya, we rely on the safeguards the Data Protection Act requires: providers bound by contract to protect it, with security measures at least as strong as this policy describes.
How long we keep it
| Information | Kept for |
|---|---|
| Your account | As long as you have it. Ask us to delete it and we will, along with workspaces where you are the only member. |
| Requests' text and audio | Your plan's history days, then deleted; at once if you delete them; never with logging off. |
| Requests' usage records (no text) | As long as the workspace exists, for its usage and billing. |
| Log-in links and sessions | Log-in links work for 15 minutes; a session lasts up to 14 days. |
| Invitations | 7 days, or until accepted. |
| Payment records and receipts | As long as Kenyan tax law requires, even after an account is deleted. |
| Contact page messages | As long as we need them to answer you and follow up. Ask us and we'll delete them. |
| Support cases and their files | As long as the workspace exists; deleted with it. |
| Server logs | Only as long as needed to keep the service secure and working. |
Cookies
Navoras uses only the cookies it needs to work. There are no analytics or advertising cookies.
| Name | What it's for |
|---|---|
| _navoras_key | Keeps you logged in while you use Navoras, and protects forms from forgery. Ends when you close your browser. |
| _navoras_web_user_remember_me | Keeps you logged in between visits, for up to 14 days. |
Your browser also remembers whether you chose the light or dark theme (in its local storage, not a cookie), and Cloudflare's check on the sign-up and contact pages may store what it needs to tell people from bots.
How we protect it
- Everything travels over encrypted connections.
- Passwords, API keys, and log-in and invitation links are stored only as hashes. A key is shown once, when it's made.
- Anyone can add two-step log-in with an authenticator app; it's required for the people who run Navoras and, when a workspace's owner chooses, for its owners and admins.
- Every workspace's data is kept apart from every other's, and audio is reached only through it.
- Changes to members, roles, keys and billing are logged.
No system is perfectly secure. If a breach puts your information at risk, we will tell you without undue delay, and tell the Data Protection Commissioner as the law requires.
Your rights
You have the right to:
- be told how your information is used (this policy);
- get a copy of the information we hold about you;
- have it corrected if it's wrong, or deleted;
- object to, or ask us to restrict, how we use it;
- receive it in a format you can take elsewhere;
- withdraw your consent where we relied on it.
Email Write to us using the form to use any of these rights. We may ask you to prove who you are first.
If your name or words were in a request a business made with Navoras, contact that business first: they decided to use them. We'll help them answer you.
If you're unhappy with how we've handled your information, you can complain to Kenya's Office of the Data Protection Commissioner , or to the data protection authority where you live.
Children
Navoras is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.
Changes to this policy
When this policy changes, we'll update the date at the top. If a change matters to how your information is used, we'll email workspace owners before it takes effect.
Contact us
Questions about this policy or your information: Write to us using the form , or use our contact page.