Privacy Policy

We only collect the data necessary to operate the service:

• Account data: name, email address, role (administrator, mechanic, boat owner, etc.), password (stored only as an irreversible bcrypt hash), optional profile photo.
• Business data entered by the user: boat sheets, maintenance work orders, time tracking, leave, uploaded supplier invoices, documents, notes.
• Technical session data: IP address at sign-in, browser, timestamps of recent actions. Used for security (brute-force protection) and rate-limiting of API calls.
• Voice and transcriptions (only if you use the voice assistant): your voice is transcribed to text by your browser (Web Speech API, local processing) or by a third-party service, see "Processors". The text of your question is then sent to the AI engine.

• Performance of the contract: running the application, calculating working hours, generating reports, storing documents.
• Legitimate interest: preventing abuse (brute-force protection, fraud detection), improving the service.
• Legal obligation: retention of accounting documents for the legally required period, responding to authorities upon a valid court order.

We never sell your data. No processing for advertising purposes.

• Primary database: Neon Postgres hosted in the EU-West-2 region (London, United Kingdom). Encryption at rest and in transit (TLS 1.3).
• Uploaded files (photos, PDFs, invoices): Vercel Blob Storage in the EU region (lhr1 — London). Authenticated access only.
• Application hosting: Vercel (EU region lhr1).
• Backup: Neon performs point-in-time recovery over the last 7 days.

No data is transferred to the United States or other countries outside the EU without equivalent safeguards (Standard Contractual Clauses or equivalent).

Some processing activities are subcontracted to specialized partners, each bound by a Data Processing Agreement (DPA):

• Anthropic (USA, DPA signed) — the Claude artificial intelligence engine used for the conversational assistant and the automatic invoice extraction (OCR). Requests are not used to train Anthropic's models.
• ElevenLabs (USA) — voice synthesis of the assistant's reply, only when you enable voice mode. The reply text is sent and the resulting audio is returned. No long-term storage.
• Zoho Mail (USA / India, Free plan) — sending transactional emails (password reset). No business data transmitted.
• Vercel (USA, DPA signed, hosting in the EU) — application hosting and file storage.
• Neon (USA, hosting in the EU) — database.
• Cloudflare Turnstile (USA) — anti-bot CAPTCHA on the sign-in page. Anonymous.

• Active account: as long as you use the service.
• Deleted account: business data is kept for 30 days after termination to allow recovery, then permanently erased (except where a legal obligation to retain accounting records applies, e.g. supplier invoices kept for 10 years on the tenant side).
• Security logs (sign-ins, errors): 90 days maximum.
• Backups: 7 days.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): request the deletion of your data, subject to legal retention obligations.
• Right to portability: receive your data in a structured format (JSON / CSV).
• Right to object and right to restriction of processing.
• Right to withdraw your consent at any time (without affecting prior processing).

To exercise these rights, contact us at info@captaincrews.com, specifying the subject of your request. We respond within 30 days. If our response does not satisfy you, you may refer the matter to the competent supervisory authority: the CNIL in France, or the Data Protection Office in Mauritius.

• Authentication via bcrypt-hashed passwords (12 rounds).
• Optional two-factor authentication (2FA) via TOTP (Google Authenticator, Authy, etc.).
• HS256-signed JWT sessions with revocation support (global kill switch on password change).
• Automatic account lockout after 5 consecutive failed sign-in attempts (30 minutes); 10 failures = permanent block (unlocked by an administrator).
• Rate-limiting of sensitive API calls.
• Cloudflare Turnstile anti-bot CAPTCHA on the sign-in page after several failures.
• Standard HTTP security headers: HSTS, X-Frame-Options DENY, Content-Security-Policy, restrictive Permissions-Policy.

Captain Crews uses only strictly necessary cookies for the application to function:

• anm_session — authenticated session cookie (httpOnly, secure, sameSite=lax, 30-day lifetime).
• anm_pending_2fa — temporary cookie between password entry and 2FA validation (5-minute lifetime).

No advertising cookies, no tracking cookies, no third-party integrations such as Google Analytics or Meta Pixel.

Captain Crews is a B2B professional tool intended for companies. No access is provided for persons under 16 years of age. If we became aware that an account had been created for a minor, we would delete it immediately.

This policy may be amended to reflect technical or regulatory changes. The update date is shown at the top of the page. Substantial changes will be notified to you by email at least 14 days before they take effect.

Any question, request to exercise a right, or report of a security incident:

Assistance Nautic Ltd
Avenue Shebeck, Albion 91001, Mauritius
BRN: C18153647
Email: info@captaincrews.com