Last updated: July 2026
Account details (name, email), the operational data you enter (vessels, clients, work orders, photos, documents), and basic usage logs. Payment card details go directly to Stripe. We never see or store card numbers.
Solely to provide the Service: showing your data to you and the people you invite, sending the notifications you trigger (quotes, invoices, reports), and processing payments. We do not sell personal data, ever.
Some features send content to a third-party model provider: reading a photographed gauge, drafting a reply, extracting findings from a survey document, translating a message. What travels can include vessel and equipment details, message threads and the names attached to them, and uploaded documents.
Depending on which keys are configured, that provider may be Google, Groq, Anthropic or OpenAI. Each has its own terms on retention and training, and we do not control them. If your workspace needs the provider fixed or the features switched off, ask us. AI output is an aid and is labelled as such where it appears; a person is responsible for what gets recorded.
Members of your organization, according to their role. Yacht owners see just their own boats. Two exceptions worth stating plainly, because both were true and neither was mentioned here before. If you share work with a partner company, that company sees the jobs you share with them. And a maintenance record share link opens without a login: anyone holding the URL can read that boat's history until the link expires, thirty days after it is made.
Our infrastructure providers process data on our behalf under their own security commitments: Vercel (hosting), Neon (database), Cloudflare R2 or equivalent object storage (photographs and uploaded documents), Stripe (payments), Resend (email), Twilio (SMS), and the AI providers named above. Errors may be reported to a monitoring endpoint we configure, which receives the error and the page it happened on.
Each organization's records are separated at the application layer on every query, and row-level security in the database is applied as a second line of defence.
We keep your data while your account is active. Deleting a record in the app hides it and keeps it recoverable for 90 days; the underlying row is retained beyond that, and the change log is permanent by design so a boat's history cannot be quietly rewritten. Ask us to erase an organization's data and we will do it by hand, minus what payment and tax law requires us to keep and minus the change log. Owners and admins can export the core records from Settings at any time; ask us if you need everything, including a copy of what we hold about one person.
Encryption in transit everywhere, encrypted storage at rest, separation between organizations enforced on every query and backed by database policies, and an append-only log of changes. We record IP address and browser for sign-ins and for agreement acceptances, as evidence of who agreed to what. No system is perfect; if a breach affects your data we will notify you without undue delay.
Two, both functional and neither used for advertising: one keeps you signed in, and one remembers which role you last switched to. There is no third-party analytics or advertising tracking on this site.
Staff records include hours, breaks, timesheet confirmations, time off, and any licence or certification documents uploaded for verification. Hours can be corrected by a manager, and any correction made by somebody other than you appears on your own hours page with their name and the date.
See also our Terms of Service.