Privacy Policy

YachtingStack ("we", "us", "our") is committed to protecting your privacy and ensuring the security of your Personal Data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and other applicable data protection laws.

The Data Controller for the Personal Data we process through our Service is:

We collect the following categories of Personal Data:

Under GDPR Article 6, we process your Personal Data on the following legal bases:

• Contractual Necessity (Art. 6(1)(b)): Processing your account and business data is necessary to provide the Service you have subscribed to.
• Legitimate Interest (Art. 6(1)(f)): We process usage and analytics data to improve the Service, ensure security, and prevent fraud. We have conducted a balancing test to ensure our interests do not override your rights.
• Consent (Art. 6(1)(a)): Where required, we obtain your explicit consent before processing (e.g., for marketing communications). You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): We may process data to comply with legal requirements such as tax regulations or court orders.

YachtingStack is a suite of products, and what we do with your data depends on which of them you use:

• To authenticate your identity and manage your account across the suite.
• To operate onboard and onshore workspaces — crew, guest, vessel, charter, maintenance and compliance records that you or your crew enter.
• To run AI agents that answer questions and draft work on your instruction, using the data in your workspace.
• To turn vessel instrument data into performance feedback for the crew, where you use Sailing Advisor.
• To build and operate bespoke software for your business, where you have engaged us to, and to send you the Yachting AI News digest where you have subscribed.
• To compile market and regulatory intelligence, and to produce editorial content.
• To improve and develop new features for the Service.
• To communicate with you about your account, service updates, and (with consent) marketing.
• To ensure the security and integrity of the Service.

We share your data with the following categories of third parties:

• AI Model Providers: We route model requests through OpenRouter, which brokers access to models from Anthropic, OpenAI, Google and others, and we use fal.ai for image generation. Before any request leaves our systems, personal identifiers belonging to crew and guests are replaced with pseudonyms; the mapping stays under our control and is never transmitted. These providers process data under their respective terms and do not use our tenants' data to train their models.
• Analytics Provider (with consent only): If — and only if — you accept analytics cookies, we load Google Analytics 4 to collect page views and key events. Declining or ignoring the banner means the script is never loaded.
• Email Service Provider: We use Mailjet to send transactional and notification emails. Mailjet processes your email address and name according to their privacy policy.
• Infrastructure Providers: Applications run on Railway; databases, file storage and authentication are provided by Supabase. Both may process data in data centres inside and outside the EEA, under the safeguards described in section 6.
• Payment Processors: If you purchase a paid subscription, payment data is processed by our payment provider. We do not store full payment card details.

We do not sell your Personal Data to any third party. We do not share your data for advertising purposes.

Some of our third-party service providers (including AI providers) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission where applicable.
• Binding Corporate Rules where applicable.

You may request a copy of the safeguards we use by contacting us.

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected:

• Account Data: Retained for the duration of your account. Deleted within 30 days of account deletion request.
• AI Outputs and Derived Data: Retained for up to 24 months, unless you delete them earlier or request their deletion.
• Usage Data: Retained in anonymised or aggregated form for up to 24 months for service improvement purposes.
• Billing Data: Retained for 7 years as required by applicable tax and accounting regulations.

Under the GDPR, you have the following rights regarding your Personal Data:

• Right of Access (Art. 15): You can request a copy of the Personal Data we hold about you.
• Right to Rectification (Art. 16): You can request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): You can request deletion of your Personal Data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restrict Processing (Art. 18): You can request that we limit how we process your data.
• Right to Data Portability (Art. 20): You can request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): You can object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA).

For any other requests, please contact us at privacy@yachtingstack.ai. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your Personal Data, including:

• Encryption of data in transit using TLS/SSL.
• JWT-based authentication with cryptographic signature verification (JWKS).
• Centralised identity management via Supabase Auth with secure token handling.
• Regular security assessments and monitoring.
• Access controls limiting data access to authorised personnel only.

We use essential cookies that are strictly necessary for the functioning of the Service (for example, session cookies for authentication). Under the ePrivacy Directive these do not require consent, because they are necessary to deliver the service you asked for.

We use one category of non-essential cookie: analytics, via Google Analytics 4. These are only ever set after you actively accept them. The analytics script is not loaded on page load — it is fetched only once you press Accept, so declining means nothing is downloaded and nothing is stored. Dismissing the banner without choosing counts as a refusal, not as consent.

Refusing costs you nothing: every part of the site works identically either way. You can change your decision at any time using the Cookie preferences link in the footer, and if you switch from accept to reject we delete the analytics cookies already on your device.

We do not use advertising cookies, tracking pixels, cross-site trackers, session recording or heatmaps, and we do not share analytics data for advertising purposes.

The Service is not intended for individuals under the age of 16. We do not knowingly collect Personal Data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

We are not required to appoint a Data Protection Officer under Article 37(1) GDPR: we are not a public authority, and our core activities do not involve regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data. We have assessed this and keep a written record of the assessment, which we review as the business changes.

We have instead named a single point of contact for every data protection matter. Write to this address to exercise any of the rights in section 8, or with any question about this policy:

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

You also have the right to lodge a complaint with your national Data Protection Authority. A list of EEA DPAs can be found on the European Data Protection Board website.