Privacy Policy

We only collect the data necessary to operate the service:

• Account data: name, email address, role (administrator, mechanic, boat owner, etc.), password (stored only as an irreversible bcrypt hash), optional profile photo.
• Fingerprint sign-in (optional): for each registered device, a public key and its technical data (key identifier, signature counter, connection methods, key type and backup flag), its name (“Android · Chrome”) and the dates it was added and last used. No biometric data: the fingerprint (or face) is checked by the device itself and never leaves it; Captain Crews only receives a digital signature. This data is kept until the device is removed (by you or an administrator), the password is changed or reset, or the account is deactivated or deleted. Your account also stores the date fingerprint sign-in was first offered to you or turned on, so that it is only offered once; it is deleted with the account.
• Business data entered by the user: boat sheets, maintenance work orders, time tracking, leave, uploaded supplier invoices, documents, notes.
• Documents read by AI (only if you use “Fill in from a document” or “Read registration certificates”): the photo or PDF of a vehicle registration certificate or of a boat document (registration certificate, builder's and engine plates). A vehicle registration certificate often shows the name and address of the vehicle's holder, who may be someone other than you; a boat's registration certificate, those of its owners. The application keeps only the unit's technical data that you have approved. The document itself is kept only if you attach it to the unit's documents; it is then filed there as “private”.
• Technical session data: IP address at sign-in, browser, timestamps of recent actions. Used for security (brute-force protection) and rate-limiting of API calls.
• Voice and transcriptions (only if you use the voice assistant): your voice is transcribed to text by your browser (Web Speech API, local processing) or by a third-party service, see "Processors". The text of your question is then sent to the AI engine.
• Demo request (marketing site form, before any account is created): the name, company, email address, phone number and message you choose to enter. This information is used solely to reply to you. It is never sold, and never used for unsolicited outreach.
• Technical error reports: when an error occurs in the application or on the site, the error message, the page address (sensitive parameters masked), the browser and device type, and the trail of recent technical actions (pages opened, clicked element described by its structure rather than its label, network calls, addresses of stored files masked). Inside the application only, for a share of the screens opened, speed measurements are also collected: loading times and technical addresses of resources and calls, without their content. On the marketing site, nothing is sent unless an error occurs. These reports never include a recording of your screen and are not linked to your account.

• Performance of the contract: running the application, calculating working hours, generating reports, storing documents.
• Pre-contractual steps: replying to a demo, quote or information request from a prospective customer.
• Legitimate interest: preventing abuse (brute-force protection, fraud detection), detecting and fixing technical errors in the application and on the site, improving the service.
• Legal obligation: retention of accounting documents for the legally required period, responding to authorities upon a valid court order.

We never sell your data. No processing for advertising purposes.

• Primary database: Neon Postgres hosted in the United Kingdom (eu-west-2 region, London). Encryption at rest and in transit (TLS 1.3).
• Uploaded files (photos, PDFs, invoices): Vercel Blob Storage in the United Kingdom (lhr1 region — London). The application serves them only after authentication and a permission check; each file is stored at a secret address that cannot be guessed.
• Application hosting: Vercel (lhr1 region — London, United Kingdom).
• Backups: Neon performs point-in-time recovery over the last 7 days. In addition, the database is copied every night, encrypted before it is sent with a key that only we hold, to Cloudflare R2 (storage in Western Europe) and to a private GitHub repository (United States); uploaded files are copied to Cloudflare R2 three times a day. Retention periods in §5.

The United Kingdom benefits from an adequacy decision by the European Commission: personal data may be transferred there from the European Economic Area without additional safeguards.

No data is transferred to the United States, or to any country outside the European Economic Area that is not recognised as adequate, without equivalent safeguards (Standard Contractual Clauses or equivalent).

Some processing activities are subcontracted to specialized partners, each bound by a Data Processing Agreement (DPA):

• Anthropic (United States) — the Claude artificial intelligence engine. It is used for the conversational assistant, automatic invoice reading (OCR), the reading of registration certificates to fill in a vehicle's record and the reading of a boat's documents (registration certificate, builder's and engine plates) to fill in its record. For these documents, the photo or PDF is sent to Anthropic for the reading only. The application keeps only the unit's technical data (registration number, serial number, dates, dimensions, power, weights…). The AI is instructed never to copy the holder's name or address, and nothing is saved until you have checked it. The same applies to the names, addresses, shares and mortgages of a boat's owners. Captain Crews keeps the document only if you attach it to the unit's documents. At Anthropic, requests and responses are deleted within 30 days, unless the law requires otherwise or misuse is being investigated. They are not used to train Anthropic's models. The data is stored in the United States; processing may take place in other countries (Europe, Asia, Australia). Anthropic acts as a processor under its data processing agreement (DPA), incorporated into its commercial terms; this agreement includes the European Union's standard contractual clauses.
• ElevenLabs (USA) — voice synthesis of the assistant's reply, only when you enable voice mode. The reply text is sent and the resulting audio is returned. No long-term storage.
• Resend (USA) — sending transactional emails: password reset, notifications, demo-request acknowledgements. No business data transmitted. Resend acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Vercel (USA, hosting in the United Kingdom) — application hosting and file storage. Vercel acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Neon (USA, hosting in the United Kingdom) — database.
• Cloudflare (USA, storage in Western Europe) and GitHub (USA) — storage of backups (details in §3 and §5). The copy of the database reaches them encrypted, with a key that neither of them holds.
• Microsoft (USA) — Microsoft Clarity, audience measurement on the public marketing pages only, loaded after the cookie banner is accepted and switched off as soon as you enter the application: no recording of its screens or of your business data (details in §8). Microsoft acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Dealfront / Leadfeeder (Finland and Germany, EU) — identifies the company a visit to the marketing site only comes from, based on the public IP address, after the cookie banner is accepted.
• Sentry (USA, data hosted in the European Union — Frankfurt, Germany) — detection and diagnosis of technical errors in the application and on the site (reports described in §1). Reports sent by your browser go through our own domain, with no cookies; no advertising use; your IP address and the location derived from it are not retained. Some technical metadata may be processed in the United States under contractual safeguards. Error detection from your browser starts on 30 September 2026 (14-day notice, §10); on the server side it has been in place since May 2026.

• Active account: as long as you use the service.
• Deleted account: business data is kept for 30 days after termination to allow recovery, then permanently erased (except where a legal obligation to retain accounting records applies, e.g. supplier invoices kept for 10 years on the tenant side). It remains in the encrypted backups until they expire (see “Backups” below).
• Sign-in attempts, sessions, error reports and technical logs: 90 days maximum.
• Documents and questions sent to the AI: Captain Crews does not keep a registration certificate or boat document sent for reading, unless you attach it to the unit's documents. At Anthropic, every request (registration certificate, boat document or invoice being read, question to the assistant…) is deleted within 30 days, unless the law requires otherwise (up to 2 years if flagged by a misuse check).
• Activity log (who did what in the application: name and email address of the author, the action and the item concerned — for example the deleted account; for each successful sign-in, the IP address and browser used): 24 months, including after the author's account has been deleted. It is used for the security of the service and to trace an operation in the event of a dispute.
• Demo request with no follow-up: 3 years from the last contact, then erased. You can ask for immediate deletion at any time.
• Encrypted backups: 90 days for the database. A file deleted from the application (photo, document) is removed from the backups about 90 days after its deletion (up to 120 days if it had been uploaded less than a month earlier).

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): request the deletion of your data, subject to legal retention obligations.
• Right to portability: receive your data in a structured format (JSON / CSV).
• Right to object and right to restriction of processing.
• Right to withdraw your consent at any time (without affecting prior processing).

To exercise these rights, contact us at info@captaincrews.com, specifying the subject of your request. We respond within 30 days. If our response does not satisfy you, you may refer the matter to the competent supervisory authority: the CNIL in France, or the Data Protection Office in Mauritius.

• Authentication via bcrypt-hashed passwords (12 rounds).
• Optional two-factor authentication (2FA) via TOTP (Google Authenticator, Authy, etc.).
• Optional fingerprint sign-in (passkeys, WebAuthn standard): each key is bound to the captaincrews.com domain and cannot be used by a fake site.
• HS256-signed JWT sessions with revocation support (global kill switch on password change).
• Temporary account lockout after consecutive failed sign-ins: 30 minutes from 5 failures, 2 hours from 10; a permanent block can only be set by an administrator.
• Rate-limiting of sensitive API calls.
• Standard HTTP security headers: HSTS, X-Frame-Options DENY, X-Content-Type-Options, restrictive Permissions-Policy; Content-Security-Policy on uploaded files served by the application.

Inside the application, Captain Crews uses only cookies needed for it to function or to remember your display preferences, with no tracking:

• anm_session — authenticated session cookie (httpOnly, secure, sameSite=lax, 30-day lifetime).
• anm_pending_2fa — temporary cookie between password entry and 2FA validation (5-minute lifetime).
• locale, cc_boat_hero — display preference cookies, with no tracking: interface language and compact view of a unit's sheet (1-year lifetime).

On the public pages of captaincrews.com only, and only after you accept the banner shown on your first visit, two audience-measurement tools are loaded. They are switched off as soon as you enter the application and record neither its screens nor your business data:

• Microsoft Clarity (Microsoft Corporation, USA) — audience measurement and anonymised recording of browsing journeys on the public pages, to understand how the site is used and improve it. When you enter the application, Clarity stops; one last technical signal, with no screen content, may still carry the address of the application page then open (for example after going back or a long period of inactivity).
• Leadfeeder / Dealfront (Finland and Germany, EU) — identifies, from the public IP address, the company a visit comes from. No individual is identified and no value typed into a form is passed to it. As soon as you enter the application, the tool is switched off by a technical cookie (ldfdr_opt_out), which also erases its visit identifier (_lfa); this cookie is lifted when you return to the site.

No advertising cookies, no retargeting cookies, no social network pixels, no sale of data. If you decline the banner, neither tool is loaded and the site works exactly the same.

Error detection (Sentry) — in the application and on the site alike, an error-detection module runs without waiting for the banner: it serves the security and proper functioning of the service you are using, not audience measurement. On the marketing site, it sends nothing unless an error occurs. It sets no cookies and writes nothing to your browser's storage, so declining the banner does not disable it. It is based on our legitimate interest (§2). These reports contain no cookie, no IP address and no account identifier; for any question about this processing, write to us (see §6).

Change my cookie choice

Captain Crews is a B2B professional tool intended for companies. No access is provided for persons under 16 years of age. If we became aware that an account had been created for a minor, we would delete it immediately.

This policy may be amended to reflect technical or regulatory changes. The update date is shown at the top of the page. Substantial changes will be notified to you by email at least 14 days before they take effect. Latest notice: client companies were informed by email on 16 September 2026 of the activation of browser-side error detection (see §4, Sentry), which took effect on 30 September 2026.

Any question, request to exercise a right, or report of a security incident:

Assistance Nautic Ltd
Avenue Shebeck, Albion 91001, Mauritius
BRN: C18153647
Email: info@captaincrews.com