Privacy Policy

Privacy Policy Effective date: [insert date] Last updated: [insert date] Important note: This template is drafted for YachtApp based on the current product functionality and European privacy expectations, including GDPR transparency requirements. Replace all bracketed placeholders, confirm your legal entity details, confirm your processors and hosting locations, and have qualified counsel approve the final text before publication. 1. Who we are YachtApp is a vessel operations and collaboration platform for private boat owners, captains, crew, clubs, and charter or fleet operators. It helps users manage boats, maintenance records, checklists, inventory, reminders, documents, cruises, routes, onboard people, CrewFinder activity, subscriptions, billing, support communications, and ambassador referrals. The controller for personal data processed through YachtApp is: [Legal company name] [Registered address] [Company registration/VAT number, if applicable] Email: [privacy@yachtapp.net] If we appoint a data protection officer or EU representative, their details will be added here. 2. Scope This Privacy Policy explains how we process personal data when you use YachtApp websites, web apps, admin tools, ambassador portal, CrewFinder features, contact forms, subscriptions, and related services. It does not replace privacy notices from third-party services that you choose to use with YachtApp, such as payment providers, app stores, map data providers, email providers, or identity providers. 3. Personal data we collect We may collect and process the following categories of personal data: Account and identity data: name, email address, password credentials handled by Firebase Authentication, profile photo, account memberships, roles, permissions, subscription tier, preferences, and login/session metadata. Organisation and vessel data: account or company name, billing profile, branding assets, boat names and identifiers, vessel documents, engine, rigging, sails, fluids, maintenance history, worklogs, inventory details, reminders, costs, notes, checklists, cruises, route plans, crew and passenger lists, onboard events, and exported operational documents. Collaboration data: invites, accepted or rejected invitations, account member status, user roles, in-app notifications, activity logs, messages, moderation events, and support or contact-form submissions. CrewFinder data: public or restricted crew profiles, contact preferences, sailing experience, availability, interests, race roles, social links, race campaigns, applications, invitations, roster details, readiness checklists, RSVP status, owner notes, and audit logs. Some CrewFinder information may be visible to other users depending on your settings and the feature used. Location and route data: manually entered origins, destinations, waypoints, route notes, map interactions, saved routes, and live navigation track points when you enable location-based features. Location features may be inaccurate and should not be used as the sole source for navigation or safety decisions. Payment and commercial data: subscription plan, billing period, currency, payment status, invoices or payment records, Stripe customer/subscription references, promo code use, cancellation status, and ambassador attribution or commission records. Full card details are processed by the payment provider and are not intended to be stored by YachtApp. Technical and usage data: device and browser information, IP address, log data, security events, diagnostics, performance information, cookies or local storage identifiers, offline queue status, and approximate usage patterns. AI feature data: route summaries, vessel or cruise context, map feature context, editorial prompts, and generated outputs when you choose to use AI-assisted features. Do not submit sensitive personal data, emergency information, or confidential third-party information to AI features unless you have authority to do so. 4. How we collect personal data We collect data directly from you when you register, complete forms, upload files, create records, invite users, publish CrewFinder content, contact us, subscribe, or use YachtApp features. We also generate data from your use of the service, receive limited transaction or billing data from payment providers, and may receive referral or ambassador attribution data from approved partner links. 5. Purposes and legal bases We process personal data for the following purposes and legal bases: To create and manage accounts, provide the application, store vessel records, enable collaboration, operate CrewFinder, send service notifications, and support subscriptions: performance of a contract or steps before entering a contract. To process payments, manage invoices, apply taxes where relevant, prevent fraud, and keep accounting records: contract, legal obligation, and legitimate interests. To secure the service, prevent abuse, moderate CrewFinder content, investigate incidents, keep audit logs, and enforce our Terms: legitimate interests and, where required, legal obligation. To respond to support, contact, and sales enquiries: contract, legitimate interests, or consent depending on the request. To send essential service emails such as password resets, invite notifications, due-date reminders, subscription notices, and administrative notices: contract and legitimate interests. To send marketing communications, ambassador updates, or optional newsletters: consent where required, or legitimate interests where permitted by applicable law. You may opt out at any time. To improve YachtApp, troubleshoot bugs, develop features, and understand aggregated usage: legitimate interests, provided your rights do not override those interests. To provide AI-assisted route analysis or editorial assistance when requested: contract and legitimate interests in delivering the requested feature. 6. Special category data and sensitive data YachtApp is not designed to collect special category data such as health information, biometric data, political opinions, religious beliefs, or trade-union membership. Do not upload or enter such data unless it is strictly necessary and you have a valid legal basis. If crew or passenger lists include passport numbers, identity documents, medical notes, emergency details, or similar sensitive information, you are responsible for collecting and sharing that information lawfully and only where necessary for maritime operations. 7. User content and account administrator responsibilities If you administer an account, invite users, upload documents, add crew or passenger information, create public CrewFinder content, or enter data about another person, you must ensure that you have a lawful basis, provide appropriate notice to those individuals, respect their rights, and keep the data accurate and proportionate. Account administrators control access permissions within their account and should remove access promptly when a person no longer needs it. 8. Sharing personal data We may share personal data with: Service providers that host, secure, deliver, or support YachtApp, including Firebase/Google Cloud services, email delivery providers, payment providers such as Stripe, analytics or diagnostics providers if enabled, and customer support tools. Other users in your account according to their roles and permissions. CrewFinder users or the public where you publish a public profile, listing, campaign, or related information. Ambassadors, referral partners, or internal commercial teams to administer lawful referral attribution and commission reporting. Professional advisers, auditors, insurers, courts, regulators, law enforcement, or public authorities where necessary to comply with law or protect rights, safety, and security. A successor entity in connection with a merger, acquisition, financing, reorganisation, or sale of business assets, subject to appropriate safeguards. 9. International transfers YachtApp may use providers that process data in the European Economic Area, the United Kingdom, the United States, or other countries. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, UK transfer mechanisms, supplementary measures, or another lawful transfer basis. 10. Retention We keep personal data for as long as needed to provide YachtApp, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and preserve security or audit records. Operational records remain in your account until deleted by you or an authorised administrator, subject to backups and legal retention. Billing, tax, and transaction records may be retained for statutory limitation and accounting periods. Public CrewFinder content may remain visible until unpublished, hidden, or deleted according to the feature controls. 11. Security We use technical and organisational measures designed to protect personal data, including authenticated access, role-based permissions, cloud security controls, transaction logging, and restricted administrative access. No online service is completely secure. You are responsible for keeping your login credentials confidential, configuring user roles carefully, and avoiding unnecessary uploads of sensitive documents. 12. Your rights Subject to applicable law, you may have rights to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, to withdraw consent, and not to be subject to solely automated decisions with legal or similarly significant effects. You may also lodge a complaint with your local supervisory authority in the EEA or UK. To exercise rights, contact us at [privacy@yachtapp.net]. We may need to verify your identity and may direct account-level records to the relevant account administrator where appropriate. 13. Cookies and local storage YachtApp may use cookies, local storage, and similar technologies for authentication, security, preferences, active account selection, offline-first functionality, and service operation. If analytics, marketing cookies, or non-essential tracking are enabled, we will provide any consent controls required by applicable law. 14. Children YachtApp is intended for users who are at least 16 years old, or the minimum age required to enter into a binding digital services agreement in their country. Do not use YachtApp if you are below the applicable age or do not have required parental or guardian consent. 15. AI-assisted features AI-assisted outputs are informational and may be incomplete or inaccurate. You remain responsible for reviewing outputs, applying maritime judgement, checking official charts, notices, weather, tides, regulations, and safety requirements, and deciding whether any output is suitable for use. 16. Changes to this Privacy Policy We may update this Privacy Policy from time to time. We will update the effective date and may notify users of material changes through the app, email, or another appropriate method. Continued use of YachtApp after an updated policy becomes effective means the updated policy applies from that date. 17. Contact For privacy questions, requests, or complaints, contact: [Legal company name] [Postal address] Email: [privacy@yachtapp.net]