Privacy policy

• Account: name, email, password (stored hashed by our authentication provider), and for brokers a company name. Needed to run your account (contract).
• Wishlist and requests: yachts you save, and the details in a charter request or question (dates, guests, message, phone). We pass a request to the broker of that yacht and email you a confirmation.
• Viewing history for suggestions: which yachts you open, how long, what you save or dismiss. Only if you choose “Personalise” in the banner (consent). It is stored against a random ID, not your name, and brokers see only anonymous, masked hints. If you sign in, the history joins your account so suggestions match on every device. You can delete it in your account and withdraw consent at any time.
• Billing (brokers): billing name, company, address, country and VAT number, and invoice and payment records. We keep invoices as long as accounting and tax law require.
• Technical data: IP address and device data in server logs and for abuse prevention and rate limits (legitimate interest). Cloudflare Turnstile checks that sign-ups come from people.
• Content you upload: listing text, photos and video, which are public when the listing is active.

The chat assistant sends your messages, and the listing facts it needs, to Google's Gemini models to produce a reply. The broker listing assistant sends the notes and photos a broker submits. We do not use them to train models of our own. Do not enter sensitive personal data in the chat.

• Supabase: database, authentication and file storage.
• Cloudflare: hosting, security and Turnstile.
• Resend: sending account and request emails; we stop mailing an address that bounces or complains.
• Google (Gemini): AI replies and listing drafts.
• PayPal, Wise, Skydo and your bank: payments, under their own privacy policies.
• YouTube or Vimeo: only when you press play on an embedded video, through their privacy-enhanced players.
• The broker or operator you contact, who receives your request and reply email address.

Some providers process data outside the EU/EEA under standard contractual clauses or equivalent safeguards.

You can access, correct, export or delete your data, object to processing and withdraw consent. In your account, “Delete my data” removes your wishlist, requests and viewing history. To delete the login itself, or for any other request, email us; we reply within 30 days. You can complain to your data protection authority (in Greece the Hellenic Data Protection Authority, in Italy the Garante per la protezione dei dati personali).

We use browser storage for your sign-in, your saved yachts and, only with your consent, an anonymous viewing ID. We do not use advertising cookies. Embedded video loads third-party content only after you press play.