Privacy & Data

Yacht Social Ltd ("Yacht Social", "we", "us", "our") is the data controller for personal data collected through the Yacht Social platform — including our website, mobile applications, and associated services. We are registered in England and Wales and subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have.

We collect the following categories of personal data:

We process your data on the following legal bases:

You may withdraw consent to marketing communications at any time by clicking "unsubscribe" in any marketing email or contacting us at support@yachtsocial.app.

This section describes one of our most important privacy protections, specifically designed for the marketplace context.

This design decision means that:

• You can enquire about vessels and negotiate charter terms without exposing your personal contact details to owners you haven't yet committed to.
• Owners receive your contact information only when they have a legitimate need — to co-ordinate the confirmed charter — and they are contractually prohibited from using it for any other purpose.
• If a booking is declined, cancelled (before confirmation), or never confirmed, the owner never receives your contact details.

Once a booking is confirmed, owners are permitted to share your contact information only with crew members directly involved in delivering the charter, and must delete it within 90 days of charter completion unless a longer retention period is required by law.

We do not sell your personal data. We share it only in these limited circumstances:

• With Owners (post-confirmation only): As described in Section 4, contact details are shared with the vessel owner following booking confirmation, limited to what is necessary to deliver the charter.
• Payment processors: We use third-party PCI-DSS-compliant processors (e.g. Stripe) to handle payments. They receive only the data necessary to process your transaction.
• Service providers: We use carefully vetted sub-processors for hosting, analytics, and email delivery, each bound by data processing agreements that restrict use to the stated purpose.
• Legal and safety requirements: We may disclose data if required by law, court order, or to protect the safety of our users or the public.
• Business transfers: If Yacht Social is acquired or merges with another entity, your data may transfer as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by law:

• Account data: Until you delete your account, plus 30 days to allow for reinstatement.
• Booking and payment records: 7 years, for tax and accounting compliance.
• Messages: 2 years from the date of the related charter, then deleted.
• Usage logs: 90 days, unless retained longer for a specific security investigation.
• Owner verification documents: Duration of the owner relationship plus 1 year.

When data is no longer required it is securely deleted or anonymised.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction. These include:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• Password hashing using bcrypt with a per-user salt — we never store plain-text passwords.
• Role-based access controls limiting staff access to personal data to those with a documented need.
• Regular security audits and penetration testing by independent third parties.
• JWT-based authentication with short-lived tokens for session management.

No security system is impenetrable. In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and in any event within 72 hours of becoming aware, as required by UK GDPR.

We use a minimal set of cookies and similar technologies:

We do not use third-party advertising cookies or sell browsing data to ad networks. You can clear cookies at any time in your browser settings; note that clearing authentication cookies will log you out.

Under UK GDPR you have the following rights. To exercise any of them, contact us at support@yachtsocial.app. We will respond within 30 days.

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations.
• Restriction: Ask us to pause processing your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format (JSON or CSV) to transfer to another service.
• Objection: Object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To request account deletion, see our account deletion guidance.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Yacht Social primarily processes data within the United Kingdom and the European Economic Area. Where we transfer data outside these regions — for example, to cloud infrastructure or analytics providers — we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK ICO or an adequacy decision.

Our Platform is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data without parental consent, please contact us at support@yachtsocial.app and we will delete it promptly.

For any privacy-related query, request, or complaint: