Privacy Policy
Last updated: 31 August 2026 · Version 3.0.0
Version 3.0.0 · Effective date: 31 August 2026
This Privacy Policy explains how Nauticare B.V. ("Nauticare," "we," "us" or "our") processes personal data when you visit our website www.nauticare.io, use the Nauticare web application at app.nauticare.io or our mobile applications for iOS and Android, or are in contact with us as a customer, prospect, partner or supplier. We process personal data in accordance with the General Data Protection Regulation (the "GDPR") and Dutch law.
Who we are
Nauticare B.V., Haarlemmerweg 331 A, 1051 LH Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 95652469, is the controller for the processing described in this Privacy Policy. You can contact us at info@nauticare.io. We are not required to appoint a data protection officer and have not done so.
Data in our customers' accounts
Our customers (yacht management companies, family offices, owners and their crews) use Nauticare to manage their vessels, crew, documents and operations. For the data they and their users store in the Service, such as crew profiles, certificates, passports, hours of rest, maintenance records and AI assistant conversations, the customer is the controller and Nauticare is the processor. We process that data only on the customer's instructions, under our Data Processing Agreement, which also lists our sub-processors and security measures.
If you are a crew member or other user invited by a customer and you have questions about your data in a customer's account, or want to exercise your rights over it, please contact that customer (usually your employer or management company). If you contact us, we will forward your request to them.
The rest of this Privacy Policy covers the data we process for our own purposes.
What data we process and why
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Creating and managing your account | Name, e-mail address, company name, role, password (hashed), login method (including Google sign-in), account settings | Performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in providing the Service to our business customers (Art. 6(1)(f)) | For as long as the account exists, then up to 12 months |
| Providing, securing and improving the Service | Log and usage data (IP address, device and browser type, pages and features used, timestamps), error reports, AI usage volumes | Legitimate interest in operating a secure, working and improving Service (Art. 6(1)(f)) | Logs: 1 month. Usage statistics: in aggregated or anonymised form |
| Subscriptions, billing and accounting | Company and billing details, contact person, VAT number, subscription and payment status, limited payment details such as card brand and last four digits (payment details are entered directly on Stripe's checkout page; we never see full card numbers) | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | 7 years (Dutch tax retention obligation) |
| Customer support and onboarding | Contact details and the content of your messages by e-mail, WhatsApp, phone or video call | Performance of a contract and legitimate interest in supporting our customers (Art. 6(1)(b) and (f)) | Up to 2 years after the last contact |
| Sales and customer relationship | Name, company, role, contact details, fleet and vessel information, notes of conversations and meetings, how you found us | Legitimate interest in developing and managing business relationships (Art. 6(1)(f)) | Up to 3 years after the last contact |
| Recording and transcribing video calls | Audio and video of the call, automated transcript and summary | Legitimate interest in accurate follow-up of meetings (Art. 6(1)(f)). We announce the recording at the start of the call; you can ask us not to record | Up to 12 months, or as long as the related customer relationship lasts |
| Website forms (contact, demo, brochure, templates, referral) | The details you enter in the form | Legitimate interest in responding to your request (Art. 6(1)(f)) | Up to 3 years after the last contact |
| Newsletters and marketing e-mails | Name, e-mail address, company, your interaction with our e-mails | Consent (Art. 6(1)(a)), or, for existing customers, our legitimate interest in informing them about similar services (Art. 6(1)(f)). You can unsubscribe at any time via the link in every e-mail | Until you unsubscribe |
| Surveys and feedback | Your answers and contact details, if provided | Legitimate interest in improving our Service (Art. 6(1)(f)) | Up to 2 years |
| Website analytics and advertising | Cookie and device data, see our Cookie Policy | Consent (Art. 6(1)(a)) for analytics and advertising cookies; legitimate interest for strictly necessary cookies | As set out in the Cookie Policy |
| Legal compliance and disputes | Any relevant data | Legal obligation and legitimate interest in defending our rights (Art. 6(1)(c) and (f)) | As long as necessary for the matter |
Where we rely on legitimate interest, we have weighed our interests against yours. You can object at any time (see "Your rights" below). Providing your account and billing details is necessary to use the Service; without them we cannot provide it.
We do not use automated decision-making that produces legal or similarly significant effects for you.
AI functionality
The Service contains optional AI-assisted functions. When you use them, the content of your request and the data needed to answer it are sent to our AI model providers (OpenAI, Anthropic and Google Gemini) through their business APIs. The assistant can also prepare actions in the Service, such as updating inventory quantities, which are only carried out after you approve them. Under their terms, this data is not used to train their models, and we do not use your data to train AI models either. Further details are in the Data Processing Agreement.
Who we share data with
We do not sell personal data. We share personal data only with:
- Service providers acting on our behalf, such as Google (Google Cloud hosting in the Netherlands, Google Workspace for e-mail and documents), Mailchimp (e-mail delivery and newsletters), Calendly (meeting scheduling, recording and transcription), Notion (customer relationship management), Tally (surveys), our website hosting provider, Google Tag Manager and CookieYes (website tags and cookie consent) and, where you consent, analytics and advertising providers. They may only use the data to provide their services to us.
- AI model providers (OpenAI, Anthropic, Google), as described above.
- Stripe, for subscription payments. When you buy a subscription in the app, you are redirected to a Stripe checkout page, where you enter your payment details (and, if you wish, your business details) directly with Stripe, before returning to the app. Stripe processes this data on our behalf to handle your subscription and also, as an independent controller, for its own purposes such as fraud prevention and legal compliance, as described in the Stripe Privacy Policy.
- WhatsApp (Meta), if you contact us via WhatsApp. Meta processes those messages under its own terms.
- The customer whose account you use, for data you enter in that account.
- Professional advisers (such as accountants and lawyers), bound by confidentiality.
- Authorities, where we are legally required to share data.
- A buyer or successor, in the event of a merger, acquisition or sale of (part of) our business, who must honour this Privacy Policy.
International transfers
We store our main data in the European Union. Some of our service providers (including OpenAI, Anthropic, Google, Mailchimp, Stripe, Calendly, Notion and Meta) process data in the United States or other countries outside the European Economic Area. In those cases we rely on an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can request more information about these safeguards by contacting us.
Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, access control and multi-factor authentication. Our measures for the Service are described in the Technical and Organisational Measures.
Your rights
You have the right to request access to, correction of, or deletion of your personal data, to restrict or object to its processing, and to receive your data in a portable format. Where processing is based on consent, you can withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal. You can object at any time to the use of your data for direct marketing.
To exercise your rights, e-mail info@nauticare.io. We may ask you to verify your identity, and we respond within one month. For data in a customer's account, see "Data in our customers' accounts" above.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. If you live or work in another EU country, you can also contact the authority there.
Age
The Service is intended for professionals aged 18 and over. We do not knowingly collect personal data from children.
Third-party websites
Our website and Service may link to third-party websites, applications or services. We are not responsible for their privacy practices; please read their privacy policies.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The version and effective date at the top show when it was last changed. For significant changes, we will inform account holders by e-mail or in the Service.
How to contact us
If you have any questions about this Privacy Policy, please send an email to info@nauticare.io.