Privacy Policy

Scope

This policy describes what personal data YachtListings.app collects, why, on what legal basis, who it is shared with, and what you can do about it. It is written against what the software actually does rather than from a template, and it is updated when the software changes.

[Operator to supply: the legal name and registered address of the operating company as data controller, the postal and email address for privacy requests, and — where one is appointed or required — the details of a representative or data protection officer.]

The operating company is established outside the European Union. It nevertheless offers this service to people in the EU and the EEA — the interface is published in German, and the facility directory covers European waters in detail — so the GDPR applies to that processing under Article 3(2), and this policy is written to it. There is a separate section below for California residents.

Who Is the Controller

For your account, your use of the site, and the platform's own communications with you, the operator is the controller.

For the client records a brokerage keeps about its own customers, the brokerage is the controller and the operator is a processor acting on that brokerage's instructions. If a brokerage holds data about you and you want it corrected or erased, the brokerage is the right place to ask; we will pass a request on if you send it to us.

What We Collect and Why

Account and Profile

When you create an account we hold your email address, your name, and whatever you choose to add to your profile: telephone numbers, website, postal address, city, state, country, nationality, timezone, preferred language and preferred currency. Where you pick your address from the map autocomplete, we store the place identifier and the latitude and longitude it returned.

Basis: performance of the contract between you and us (providing the account), and our legitimate interest in operating the service.

Authentication

There are two ways to sign in and neither involves a password we store.

• Magic link. You give an email address, we send a single-use sign-in link that expires after about ten minutes. The token is stored until it expires or is used.
• Google. If you sign in with Google, Google tells us the identifiers, email address and basic profile information covered by the standard sign-in scopes. We store the account linkage and the tokens Google issues so the link keeps working. We do not request access to your Google Drive, Calendar, Contacts or mail.

Each session record holds the session token, its expiry, the IP address and the browser user agent it was created from. These two fields exist so that a session can be attributed and revoked if an account is compromised; they are the only place the platform stores an IP address, other than the audit record of an administrator impersonating an account (see below).

Basis: performance of the contract, and legitimate interest in the security of accounts.

Messages

Messages you send and receive through the platform are stored so that both sides and, for a brokerage, that brokerage's team can refer to them. That includes the body, any attachments, and the delivery state of each outbound message.

Where a conversation runs over an outside channel, the platform stores the identity you used on it: an email address, a telephone number in international format, a Telegram or Discord handle, together with any identifier the provider gives us for the conversation, whether the identity has been verified, and whether you have opted in or out of being contacted on it. An SMS number that replies STOP is recorded as opted out and is not messaged again.

Those identities are held per brokerage. Two brokerages that both know your mobile number hold two separate records; neither can see the other's.

The message content itself also passes through the provider of the channel you chose — Meta for WhatsApp, Twilio for SMS, Telegram, Discord, or the mail servers in the path of an email — under that provider's own terms and its own privacy policy. That is inherent to using the channel.

Basis: performance of the contract for messages you send us; the brokerage's legitimate interest, on whose instruction we process, for a brokerage's own client correspondence.

Enquiries From Visitors Who Have No Account

The public contact form on a listing collects the name, email address, optional telephone number and message you type into it, and passes them to the broker of that listing. The form is protected by Cloudflare Turnstile, which runs a challenge in your browser to distinguish a person from an automated script. We send Turnstile only its own token and our secret key; we do not forward your IP address to it. Turnstile's own processing is governed by Cloudflare's privacy terms.

Basis: taking steps at your request prior to a possible contract, and legitimate interest in preventing abuse of the form.

Personalisation and Behavioural Profiling

This is the part of the platform that would be easiest to describe vaguely, so it is described exactly.

If you are signed in, the platform records how you interact with listings in order to recommend boats to you. Three sets of data are involved:

• Interactions with a listing — for each boat you view: how many times you viewed it, how long the page was in the foreground in total and at most, how many times you opened the gallery, how far down the page you scrolled, and when you first and last viewed it.
• Searches — the filters you searched with and how many results came back, with the time. Only your fifty most recent searches are kept; older ones are deleted automatically.
• A taste profile — a derived summary of the two above, expressing which characteristics of a boat you appear to respond to. It is recalculated periodically and is not a record of any single action.

What is not recorded here: your IP address, your browser user agent, and anything at all about a visitor who is not signed in. Behavioural profiling applies only to registered, signed-in users, and only to listings the platform holds comparison data for. There are no third-party analytics or advertising trackers on the site to record it anywhere else.

Basis: legitimate interest, and it is switched on by default. That is a defensible position only because of the controls attached to it, so here they are:

• You can see, in plain language, what the profile says about you.
• You can switch profiling off. That is your right to object under Article 21, and it is honoured immediately.
• Switching it off erases what was already collected — the interaction records, the search history and the derived profile are deleted, not merely frozen. That is the difference between an objection that works and a checkbox that does not, and it is why the default is defensible.
• You can also erase the collected data without switching profiling off, if you simply want to start again.

All of this is in your account under personalisation. The platform operator can also disable profiling for everybody at once.

Where You Came From

We want to know which of our own campaigns bring brokerages to the platform. That is the whole of it, and it works like this.

If you arrive from a tagged campaign link or from another website, your browser is given the arrival cookie described above. Nothing is sent to us and nothing is stored on our servers at that point — a visitor who reads about the platform and leaves leaves no record with us at all.

If you later register a brokerage, the contents of that cookie are saved once against the brokerage: the campaign labels, the referring site's host name, the page you landed on and the date of that first visit. Nothing about you personally is stored with it — no address, no name, no account identifier, no IP address, no browser details — and the cookie is deleted at that moment. Only the first arrival is ever kept; a later visit never replaces it.

Basis: legitimate interest. It is first-party and single-site: nothing is shared with an advertising network, no profile is built from it, and it never affects what you are shown. It is deleted twenty-four months after the visit it describes.

Two ways to opt out, both honoured: send a Global Privacy Control or Do Not Track signal from your browser, in which case no cookie is set; or switch profiling off in your account, in which case nothing is recorded even if a cookie was already there. Only self-service registrations are recorded this way — a brokerage an administrator sets up by hand is not.

Broker Access to Your Data

A brokerage keeps its own client records: name, email, telephone numbers, website, postal address, nationality, timezone, currency, and its own internal notes about working with you. Those records exist whether or not you have an account, because a broker may have met you before you ever visited this site.

Separately, there is a consent record between you and each brokerage. It has three states — pending, approved and revoked — and it governs whether that brokerage's client record is linked to your platform account, and therefore whether the brokerage sees your account data alongside it.

By default your account is set to approve such a request automatically. You can turn that off, in which case a brokerage's request sits as pending until you approve it. You can revoke a brokerage's consent at any time; the link between their client record and your account is removed immediately.

What revoking does not do is delete the brokerage's own record of you or your correspondence with them. That is their data about their own customer, held under their own responsibility, and an erasure request for it goes to them.

Basis: your consent for the link; the brokerage's legitimate interest, as controller, for its own client record.

Documents

The platform stores documents you or a brokerage upload, including identity documents, vessel registration, survey reports and signed contracts. Documents are marked with a visibility level, and private documents are stored in a separate, non-public storage bucket that is not reachable by URL guessing. Identity documents can carry an expiry date.

Listing photographs, by contrast, are stored in a public bucket, because a listing is published.

Basis: performance of the contract, and the brokerage's legal obligations where the document was collected for client due diligence.

Contracts and Signatures

Where you sign a contract through the platform, we record who signed, when, which version of the document they signed, and where required per-page initials — and we generate and store the executed PDF. This record exists so that the parties can prove what was agreed.

Basis: performance of a contract, and the legitimate interest of all parties in an evidential record.

Email We Send

Outgoing email is sent over SMTP and is logged: sender, recipient, subject, the text and HTML body, the delivery status, and the technical exchange with the mail server. The log exists so that a failed or missing message can be diagnosed — a sign-in link that never arrived, a notification that bounced.

Be aware of two consequences, because they are real. A sign-in link sent to you is present in that log until the link expires and the log entry is removed. And the platform's administrators can read the log. If you would rather your correspondence with a broker not be stored in that form, use the platform's own messaging rather than email.

Basis: legitimate interest in operating a working email service.

Saved Searches and Alerts

If you save a search, we store its criteria and how often you want to hear about matches — instantly, daily or weekly — and the time we last notified you. Every alert email contains an unsubscribe link tied to that specific search, which works without signing in.

Basis: performance of the contract, at your request.

Administrator Impersonation

Platform administrators can, for support purposes, act as another account. Every such session is recorded — which administrator, which account, when, from which IP address and browser. That audit record exists precisely so the ability cannot be used silently.

Basis: legitimate interest in supporting and securing the service.

Feedback

If you submit feedback through the in-app form, the message, any screenshot or attachment you add, and technical information about your browser are sent to the operator's issue tracker at GitHub, where they become part of a development ticket. Do not include information in a feedback report that you would not want recorded there.

Basis: legitimate interest in fixing the software.

Cookies and Local Storage

The platform does not run an advertising network, an analytics product, a tag manager, a session recorder, or an error-reporting SDK. There is nothing on these pages that follows you to another site. One cookie beyond the strictly necessary is described below, under "Where You Came From"; it is first-party, it never leaves us, and it is not used to recognise you.

What is actually stored in your browser:

• A session cookie after you sign in. It is cryptographically signed, marked secure over HTTPS, and expires after seven days. Strictly necessary.
• A language cookie recording whether you chose English or German, so the choice survives a reload. Long-lived, and it contains a language code and nothing else.
• An arrival cookie, and only if you reach the site from a tagged campaign link or from another website. It holds the campaign labels in the link, the host name of the site that referred you, the page you landed on and the date — nothing that identifies you, no address, no browser fingerprint. It lasts ninety days, is deleted the moment a brokerage registration uses it, and is not set at all if your browser sends a Global Privacy Control or Do Not Track signal.
• Browser local storage for interface preferences — the page size of a table, which columns you hid, your light or dark theme. It never leaves your browser and is never sent to us.

Maps are rendered by the Google Maps JavaScript API, which is loaded from Google and may set its own cookies and receive your IP address as any embedded script does. Maps appear on the facility directory, the location picker, and address entry fields.

Processors and Third Parties

The platform depends on the following categories of service. Each processes personal data only as needed to provide its function.

• Object storage — an S3-compatible provider holds images, documents and generated PDFs, in a public bucket for published listing images and a protected bucket for everything else.
• Email delivery — an SMTP service transmits notifications, sign-in links and alerts.
• Google — sign-in with Google, where you use it; the Maps JavaScript API and its Places service for maps and address autocomplete; and, if you import an image from Google Drive, the file you select.
• Cloudflare — Turnstile, on the public contact form only.
• Messaging providers — Meta (WhatsApp), Twilio (SMS), Telegram and Discord, where a conversation runs over that channel. These run under a brokerage's own account with that provider.
• An AI provider — where the operator has configured one, it processes the text or image being worked on for translation, document extraction during client onboarding, image descriptions, voice dictation and the lead assistant. Which provider is a deployment choice; the platform supports both hosted services and a self-hosted model.
• GitHub — for feedback reports only.

We do not sell personal data, and we do not share it with anyone for their own marketing.

International Transfers

The operator is established outside the EEA and its service providers operate internationally, so personal data of EEA and UK residents is transferred outside those areas. [Operator to supply: the transfer mechanism relied on — standard contractual clauses with each processor, together with the supplementary measures assessment — and where a copy may be requested.]

How Long We Keep Things

• Account data — while the account exists.
• Sessions — seven days, or until you sign out.
• Sign-in tokens — about ten minutes.
• Search history — the fifty most recent searches per user; older ones are deleted automatically.
• Interaction and profile data — until you switch profiling off or erase it, at which point it is deleted.
• Brokerage arrival records — twenty-four months from the visit they describe, then deleted automatically.
• Messages, documents and contracts — for as long as the brokerage keeps them, which is generally driven by the retention its own regulator requires, commonly several years after a transaction.
• Email log — for operational troubleshooting; entries containing a sign-in link are removed with the token.

Deleting a user account cascades to that user's sessions, linked accounts, interaction records, search history, taste profile, personal documents and voice recordings. It does not delete a brokerage's own client record, which is that brokerage's data.

Your Rights

Where the GDPR applies you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis. You also have the right to complain to a supervisory authority in your country.

Some of these you can exercise yourself, immediately, without asking anyone:

• View, correct and complete your profile in your account settings.
• See a plain-language view of your taste profile, switch profiling off, or erase the collected activity — in your account under personalisation.
• Grant or revoke a brokerage's access to your account data, and turn off automatic approval of such requests.
• Unsubscribe from a saved-search alert from a link in the email itself.

For the rest — a full export of your data, or erasure of your account — write to the privacy address given at the top of this page. We will respond within one month. There is no self-service export or account-deletion button today; saying so is more useful than implying there is one.

Automated Decision-Making

The platform ranks and recommends listings using the taste profile described above, and where an operator has enabled it, an assistant may answer the first few messages of a new enquiry. Neither produces a legal or similarly significant effect on you: nothing is refused, priced or decided about you automatically. The assistant is constrained in code from discussing price or terms, and stops permanently the moment a person from the brokerage replies.

Children

The platform is not directed at children and accounts require you to be at least 18. We do not knowingly collect data from a child; if you believe we have, contact us and we will delete it.

Security

Private documents are held in storage that is not publicly reachable. Session cookies are signed and marked secure. Message webhooks from outside providers are verified against a per-organisation secret. Provider credentials a brokerage enters are stored server-side and are never sent back to a browser. No system is perfectly secure, and we do not claim otherwise; if we become aware of a breach affecting your personal data we will notify you and the relevant authority as the law requires.

California Residents

If you are a California resident, the California Consumer Privacy Act as amended gives you rights over the personal information we hold.

What we collect. In CCPA categories: identifiers (name, email address, telephone number, postal address, account identifiers, and the IP address recorded with a session); customer records (address, nationality, and the details in a brokerage's client record); commercial information (listings you viewed, searches you ran, enquiries you sent); internet activity (your interaction with listings, as described above, when signed in; and, for a brokerage, the campaign or referring site the registration came from); geolocation only in the coarse sense of an address or a map point you chose yourself; and inferences, in the form of the taste profile. We do not collect biometric data or precise device location, and we do not infer sensitive characteristics.

Sources. You, your activity on the site, a brokerage you have dealt with, and Google if you sign in with Google.

Purposes. Operating the service, connecting you with brokers, recommending listings, security, and support.

We do not sell or share personal information as those terms are defined in the CCPA, including for cross-context behavioural advertising. There is no advertising or analytics tracker on the site to do it with. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" mechanism to offer — the answer to the question is simply no.

Your rights. To know what we collect and what we do with it; to access it; to have it corrected; to have it deleted; to limit the use of sensitive personal information (we do not use any in a way that triggers this); and not to be discriminated against for exercising any of them. Exercise them through the account controls above or by writing to the privacy address, and we will verify your request through the email address on your account before acting on it. You may use an authorised agent.

Changes to This Policy

When the software changes in a way that changes this document, this document changes with it. Material changes will be announced before they take effect. The terms of service and the pricing page set out the rest of the relationship.