NNAVLETIC

Privacy Policy

Last updated: September 14, 2026

Navletic (https://navletic.com) is a college-recruiting product operated by Mallorca Labs. This policy describes how we collect, use, store, and share information, including Google user data.

Questions or requests: privacy@navletic.com

Information we collect

  • Waitlist. Name and email you submit so we can contact you about Navletic.
  • Account. Email, name, and authentication (password, or Google Sign-In using openid, email, and profile). Google Sign-In is for logging in. It does not grant access to Gmail.
  • Workspace. Recruiting data you enter or generate in the product: athlete profiles, school lists, in-app email drafts, roster information, and similar workspace content.
  • Gmail (only if you click Connect Gmail). See “Google user data” below.

Google user data (Gmail)

Connecting Gmail is optional and separate from signing in with Google. It lets Navletic create email drafts in one Gmail account for your recruiting workspace. Other members of your workspace can see which account is connected and which messages were exported.

When you connect Gmail, Navletic requests https://www.googleapis.com/auth/gmail.compose.

What we access, use, and store

This applies only if you connect Gmail. Signing in with Google alone does not give us Gmail access.

  • Encrypted tokens that let us create drafts
  • The email address and account id of the connected Google account
  • A record of each draft we created, including the draft, message, and thread ids Google returns, so we can show export status and avoid duplicate drafts

How we use it

We use Gmail access only to create drafts (recipients, subject, body, attachments) in your Gmail Drafts folder via the Gmail API. You review, edit, and send those drafts in Gmail.

What we do not do

  • We do not send mail through the Gmail API
  • We do not read your inbox, labels, or existing messages
  • We do not modify or delete mail other than creating drafts
  • We do not sell Google user data
  • We do not use Google user data for advertising, retargeting, or credit decisions
  • We do not use Google user data to train or improve generalized or foundational AI models
  • We do not share Google user data with third parties except subprocessors that host the product (acting on our instructions) or when required by law

Limited Use

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Human access to Gmail-scope data is limited to cases you consent to and to security or legal exceptions under that policy.

Other uses of Navletic data

We use waitlist, account, and workspace data to run Navletic, contact you about the product, keep the service secure, and comply with the law. We do not sell this data.

Sharing

We use subprocessors (hosting, database, email delivery) that process data on our instructions. We do not sell personal information.

Disconnect and deletion

Disconnect Gmail. In the workspace, open Email accounts and choose Disconnect Gmail. This deletes the credentials we hold and asks Google to revoke our access once that account is no longer connected anywhere in Navletic. You can also remove Navletic at any time from your Google Account connections. Drafts already in Gmail stay there.

Delete your account. Open the menu next to your name, choose Account, then Delete account. This deletes your sign-in, the recruiting workspaces you own as the athlete, any workspace where you are the only member, and every Gmail connection you made, immediately. Workspaces where you are a parent or helper stay with their athlete; your access ends. Roster content you created stays with its team. If you own a team, transfer ownership first by emailing support@navletic.com. Copies may remain in backups and logs for a period after deletion.

Request Gmail data deletion. Email privacy@navletic.com to ask us to delete the record of your exported drafts. We verify your identity and confirm what the request covers. Messages shared with other workspace members stay in their workspace.

How we protect your data

  • Encryption in transit. All traffic between your browser and Navletic, and between Navletic and Google, uses HTTPS (TLS).
  • Encryption at rest. Gmail access and refresh tokens are encrypted with AES-GCM before they are stored. The encryption key lives only in server configuration, not in the database or in source code.
  • Least privilege. Navletic requests only one Gmail scope, gmail.compose, the narrowest scope that allows creating a draft, and calls only the draft-creation method. The connection also uses the openid and email sign-in scopes to confirm which Google account you connected.
  • Access control. Access to production systems and data is limited to the people who operate Navletic. Humans do not read Gmail-scope data except with your consent or under the security and legal exceptions in the Limited Use section.
  • Revocation. Disconnecting Gmail deletes the tokens we hold and asks Google to revoke our access once that account is no longer connected anywhere in Navletic. Deleting your account deletes every Gmail connection you made.
  • Subprocessors. Our hosting and database providers process data on our instructions under written terms and their own security programs.
  • Incident notification. If we learn of unauthorized access to your data, we will notify affected users and Google as required by law and by the Google API Services User Data Policy.

Retention

We keep Gmail credentials only while Gmail is connected. We keep the record of exported drafts until you delete the related message in Navletic, until its workspace is deleted with your account, or until you ask us to delete it. That record cannot be used to access your Gmail. Deleting it does not delete drafts in Gmail.

Copies may remain in backups and logs for a period after deletion.

Changes

We will post updates on this page and change the last-updated date.

Contact

Mallorca Labs / Navletic
privacy@navletic.com
https://navletic.com