**Effective from 20 September 2026**

This Privacy Statement explains what personal data we process when you use the YachtPass
platform, why we process it, who we share it with, and what rights you have.

It applies to the YachtPass mobile apps and to the YachtPass web application, including dealer
branded versions of it. It does not cover our marketing website, or the websites and systems of
the dealerships you deal with — those parties have their own privacy statements.

---

## 1. Who we are

`[Legal entity name, e.g. YachtPass B.V.]`
`[Registered address]`
`[Chamber of Commerce (KvK) number]`
Email: [email protected]
Telephone: +31 6 19965143

We are the controller for the personal data described in this statement. This also applies where
a dealership manages your account on your behalf: the dealership acts within the limits we set,
and we remain responsible for the platform.

We have not appointed a Data Protection Officer. For any question about your personal data,
write to **[email protected]**.

## 2. Who this is about

- **Boat owners** who use the platform for their vessel.
- **Crew** invited to a vessel by its owner.
- **Dealership staff** who use the dealer portal.
- **People named by a user**, for example a crew member on a crew list or an emergency contact.

If someone else entered your details, you have the same rights as anyone else. Contact us and we
will tell you what we hold.

## 3. What personal data we process

**Account and contact details.** Name, email address, telephone number and country code, profile
photo, preferred language, role, the dealership you are connected to, the date of your last login,
and whether you completed onboarding.

**Identity details.** If you complete the identity check or order a physical YachtPass, we process
the name as written in your passport, date of birth, place of birth, nationality, passport or ID
number and its expiry date, home address and postcode, and any emergency information you enter.
These fields are stored separately from the rest of your profile and are readable only through
restricted database functions.

**Vessel data.** Boat name, hull identification number (HIN), build number, specifications, engines,
purchase details, manuals, and the maintenance and service history you record.

**Documents you upload.** In your Digital Vault you can store registration and flag state papers,
ownership and legal documents, insurance policies and claims, and identity documents such as
passports, visas, boating licences, maritime radio licences (Marcom-B), crew lists, customs
declarations and transit logs, as well as maintenance and service records. Files are stored in
private storage. Where a document is scanned, we also store text extracted from it.

**Support and communication.** Support tickets, messages, internal notes, attachments, and the
audit trail of who did what and when.

**ChatBoat.** Your questions, the conversation history, the passages from your manuals and
documents used to answer, any thumbs up or down you give, and the answer itself. See §8.

**Technical data.** Session tokens, push notification tokens, device platform, app version, and —
only when the app crashes — an error report containing the error message, the technical stack
trace, the screen you were on, your app and operating system version, your user agent, and your
user ID.

**Access logs.** Every view, download, upload and deletion of a document in your Digital Vault is
logged with the identity of the person acting, the time, the IP address and the user agent.

**Payment data.** If you buy a paid service, our payment provider handles your payment details. We
never see or store your card number; we store only a customer reference and the status of your
purchase.

## 4. Why we process it, and on what legal basis

**To provide the platform** — creating and managing your account, storing your vessel data and
documents, generating your physical YachtPass, running the ticketing system, sending you notifications,
and answering your ChatBoat questions.
*Legal basis: performance of a contract (Art. 6(1)(b) GDPR).*

**To let you sign in** — sending one-time login codes by email and maintaining your session.
*Legal basis: performance of a contract (Art. 6(1)(b) GDPR).*

**To connect you to your dealership** — giving your dealership access to the parts of your account
it needs in order to service your vessel.
*Legal basis: performance of a contract (Art. 6(1)(b) GDPR), and our legitimate interest and that
of your dealership in servicing your vessel properly (Art. 6(1)(f) GDPR).*

**To share documents with authorities at your request** — if you choose to share documents through
a QR code or a share link.
*Legal basis: your consent (Art. 6(1)(a) GDPR). You choose per document; you can stop sharing at
any time.*

**To take payments and keep our books** — processing purchases and retaining invoices.
*Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation
(Art. 6(1)(c) GDPR).*

**To keep the platform secure and working** — error reports, access logs, abuse investigation, and
audit trails.
*Legal basis: our legitimate interest in a secure and reliable service, and in being able to
demonstrate who accessed which document (Art. 6(1)(f) GDPR).*

**To improve ChatBoat** — reviewing questions that were answered badly, so that the next answer is
better. See §8.
*Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).*

**To send you product news about YachtPass** — only if you are already a customer, and every such
email contains an unsubscribe link.
*Legal basis: our legitimate interest in informing our own customers about our own service
(Art. 6(1)(f) GDPR). Unsubscribing does not affect the transactional emails you need in order to
use the platform, such as login codes and ticket updates.*

## 5. Special categories of personal data

The Digital Vault lets you upload medical certificates. A medical certificate contains health data,
which is a special category of personal data under Art. 9 GDPR.

We do not ask for health data and we do not need it to provide the platform. If you choose to
upload such a document, we process it **only on the basis of your explicit consent**
(Art. 9(2)(a) GDPR), for the sole purpose of storing it for you and making it available to the
people you have given access. You can withdraw that consent at any time by deleting the document.

## 6. Who can see your data inside the platform

**You**, and anyone you invite as crew, within the permissions you give them.

**Your dealership**, if your account is connected to one. Dealership staff can see your vessel data,
manuals, onboarding progress and support tickets. Whether they can also see your name, email,
telephone number, identity answers and your registration, ownership, insurance and identity
documents depends on a setting your dealership controls: with it switched on, only the staff
assigned to your account plus the dealership's management can see those; with it off, all staff at
that dealership can. Dealership access is enforced in our database, not only in the interface.

**Authorities you share with.** If you use the QR code or share link on your YachtPass, anyone
holding that code can open a page showing your name and the documents you selected for sharing.
The link is unguessable, but it is not password protected — treat it like a key.

**Our staff**, only where needed for support, security or maintenance.

## 7. Service providers we use

We use the following providers to run the platform. They process your data on our instructions and
for no purpose of their own. We make agreements with our providers in line with Art. 28 GDPR.

| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, file storage, background functions | EU |
| Vercel | Hosting of the web application | US / EU |
| Expo (EAS) | App builds, over-the-air updates, push notification delivery | US |
| Railway | Hosting of the ChatBoat service and our PDF generation service | US / EU |
| Resend | Sending email (login codes, invitations, notifications, product news) | US |
| Stripe | Payment processing | EU / US |
| Yousign | Qualified electronic signatures; processes the signer's name, email and identity | EU (France) |
| Anthropic | The AI model that writes ChatBoat's answers | US |
| Voyage AI | Turning your questions and manual passages into search vectors | US |
| Mistral AI | Reading text from scanned documents | EU (France) |
| Google | Address suggestions while you type an address | US / EU |
| Apple, Google | Distribution of the mobile apps through their app stores | US |

If your dealership uses its own service system, we also pass the content of your support tickets,
including your name and email address, to that system so your dealership can act on them. Your
dealership is responsible for what happens there.

## 8. ChatBoat and artificial intelligence

**ChatBoat is an AI system, not a person.** Every answer is generated automatically. Before you use
ChatBoat for the first time, and again whenever we materially change that notice, we ask you to
confirm that you have read and understood it. We record the date and the version you confirmed.

When you ask a question, we send your question, an identifier for you and for your vessel, and the
identifiers of the manuals you are allowed to search to our ChatBoat service. That service retrieves
the relevant passages from your manuals and documents and sends your question together with those
passages to our AI providers, which generate an answer. Your conversations are stored in your
account until you or we delete them.

If an answer fails or you mark it as unhelpful, we may review the question and the answer so we can
improve future results, and we store the text of the question for that purpose. Questions from one
user are never shown to another user.

ChatBoat does not make any decision about you. We do not carry out automated decision-making that
produces legal effects for you or similarly significantly affects you, within the meaning of
Art. 22 GDPR.

## 9. Transfers outside the EEA

Your account data, your documents and your vessel data are stored in the European Union.

Some of the providers listed in §7 are established outside the European Economic Area, in the
United States. This means that when you use ChatBoat, your question and the relevant passages from
your manuals and documents are transferred to the United States, and that our email, hosting, push
notification and app distribution providers may process data there as well.

These transfers take place on the basis of the European Commission's Standard Contractual Clauses,
together with additional measures where required, in accordance with Chapter V GDPR. You can ask us
for a copy of the safeguards we rely on by writing to [email protected].

## 10. How long we keep your data

We keep your personal data for as long as you have an account with us.

When your account ends, we keep your data for a maximum of **90 days**, so that we can deal with any
final questions and meet our legal obligations. After that period we delete it or make it anonymous.

Two exceptions:

- **Invoices and payment records** are kept for seven years, because Dutch tax law requires it.
- **Documents you shared with your dealership** may remain in that dealership's own records. We
  cannot delete those for you; ask your dealership.

You can delete individual documents, conversations and vessels yourself at any time, without waiting
for your account to end.

## 11. How we protect your data

All data is encrypted in transit and at rest. Access to your account requires a one-time code sent
to your email address; we do not use or store passwords. Access to your data inside our database is
restricted per user and per role, and enforced by the database itself. Every access to a document in
your Digital Vault is logged.

We are working towards SOC 2 Type II certification. We are not certified yet, and we will say so on
this page when that changes.

## 12. Your rights

You have the right to:

- **access** your personal data and receive a copy of it;
- **rectify** data that is incorrect or incomplete;
- **erase** your data ("right to be forgotten");
- **restrict** our processing of your data;
- **data portability** — receive the data you gave us in a structured, commonly used,
  machine-readable format;
- **object** to processing based on our legitimate interest, including the product news described
  in §4;
- **withdraw consent** at any time where we rely on consent, without affecting processing that
  already took place.

To exercise any of these rights, write to **[email protected]**. We respond within one month. If
your request is complex we may extend that by two months, and we will tell you if we do.

**Deleting your account.** There is no delete button in the app yet. Send a request to
[email protected], or use the form linked from your settings screen, and we will delete your
account, your documents, your conversations and your vessel data, subject to the retention periods
in §10.

**Complaints.** If you are not happy with how we handle your data, you can complain to the Dutch
data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to
the supervisory authority in the EU country where you live or work.

## 13. Cookies and local storage

We do not use tracking cookies, advertising cookies or analytics tools on the platform. We store
your login session and a small number of preferences, such as your chosen language, on your own
device. That storage is strictly necessary to let you stay signed in, so it does not require your
consent and there is no cookie banner.

## 14. Children

The platform is for people aged 18 and over. We do not knowingly collect data from children. If you
believe a child has given us personal data, contact us and we will remove it.

## 15. Changes to this statement

We may update this statement. The current version and its effective date are always published on
this page. We recommend that you check it from time to time.

## 16. Contact

Questions about this statement, or about your personal data:

**[email protected]** · +31 6 19965143 · `[Registered address]`