Privacy Policy

We only collect the data necessary to operate the service:

• Account data: name, email address, role (administrator, mechanic, boat owner, etc.), password (stored only as an irreversible bcrypt hash), optional profile photo.
• Fingerprint sign-in (optional): for each registered device, a public key and its technical data (key identifier, signature counter, connection methods, key type and backup flag), its name (“Android · Chrome”) and the dates it was added and last used. No biometric data: the fingerprint (or face) is checked by the device itself and never leaves it; Captain Crews only receives a digital signature. This data is kept until the device is removed (by you or an administrator), the password is changed or reset, or the account is deactivated or deleted. Your account also stores the date fingerprint sign-in was first offered to you or turned on, so that it is only offered once; it is deleted with the account.
• Business data entered by the user: boat sheets, maintenance work orders, time tracking, leave, uploaded supplier invoices, documents, notes.
• Documents read by AI (when you use “Fill in from a document” or “Read registration certificates”; the other photos and documents sent to the AI are described in §4): the photo or PDF of a vehicle registration certificate or of a boat document (registration certificate, builder's and engine plates). A vehicle registration certificate often shows the name and address of the vehicle's holder, who may be someone other than you; a boat's registration certificate, those of its owners. The application keeps only the unit's technical data that you have approved. The document itself is kept only if you attach it to the unit's documents; it is then filed there as “private”.
• Technical session data: IP address at sign-in, browser, timestamps of recent actions. Used for security (brute-force protection) and rate-limiting of API calls.
• Voice and transcriptions (only if you use the voice assistant): your voice is transcribed to text by the speech recognition of your browser or phone; depending on the device, this happens on the device itself or through the online service of the browser's or phone's maker (for example Google, Apple or Microsoft). Captain Crews only receives the text, not the recording of your voice. The text of your question is then sent to the AI engine, together with the data the assistant looks up to answer you (see §4).
• Demo request (marketing site form, before any account is created): the name, company, email address, phone number and message you choose to enter. This information is used solely to reply to you. It is never sold, and never used for unsolicited outreach. With your request, we also receive a few details about your visit that you don't have to enter: your optional answer to "How did you hear about us?", the first page you viewed on our site, the name of the site that brought you there (its domain only, for example "google.com"), the campaign parameters in the address ("utm"), the page you viewed just before the form, your browser language and the country that our host estimates from your IP address (only the country code is passed on to us with your request; your IP address is neither attached to it nor kept with it). Nothing is stored on your device: no cookie. These details are attached to the email that forwards your request to us, are kept with it, and are only used to learn how people find us.
• Technical error reports: when an error occurs in the application or on the site, the error message, the page address (sensitive parameters masked), the browser and device type, and the trail of recent technical actions (pages opened, clicked element described by its structure rather than its label, network calls, addresses of stored files masked). Inside the application only, for a share of the screens opened, speed measurements are also collected: loading times and technical addresses of resources and calls, without their content. On the marketing site, nothing is sent unless an error occurs. These reports never include a recording of your screen and are not linked to your account.

• Performance of the contract: running the application, calculating working hours, generating reports, storing documents.
• Pre-contractual steps: replying to a demo, quote or information request from a prospective customer.
• Legitimate interest: preventing abuse (brute-force protection, fraud detection), detecting and fixing technical errors in the application and on the site, improving the service.
• Legal obligation: retention of accounting documents for the legally required period, responding to authorities upon a valid court order.

We never sell your data. No processing for advertising purposes.

• Primary database: Neon Postgres hosted in the United Kingdom (eu-west-2 region, London). Encryption at rest and in transit (TLS).
• Uploaded files (photos, PDFs, invoices): Vercel Blob Storage in the United Kingdom (lhr1 region — London). The application displays a file only after sign-in and a permission check; the file is stored at a secret address that cannot be guessed. Strictly private storage is being prepared.
• Application hosting: Vercel (lhr1 region — London, United Kingdom).
• Backups: Neon performs point-in-time recovery over the last 7 days. In addition, the database is copied every night, encrypted before it is sent with a key that only we hold, to Cloudflare R2 (storage in Western Europe) and to a private GitHub repository (United States); uploaded files are copied to Cloudflare R2 three times a day. Retention periods in §5.

The United Kingdom benefits from an adequacy decision by the European Commission: personal data may be transferred there from the European Economic Area without additional safeguards.

No data is transferred to the United States, or to any country outside the European Economic Area that is not recognised as adequate, without equivalent safeguards (Standard Contractual Clauses or equivalent).

Some processing activities are subcontracted to specialized partners, each bound by a Data Processing Agreement (DPA):

• Anthropic (United States) — the Claude artificial intelligence engine. It is used for the conversational assistant, automatic invoice reading (OCR), the reading of registration certificates to fill in a vehicle's record and the reading of a boat's documents (registration certificate, builder's and engine plates) to fill in its record. For these documents, the photo or PDF is sent to Anthropic for the reading only. The application keeps only the unit's technical data (registration number, serial number, dates, dimensions, power, weights…). The AI is instructed never to copy the holder's name or address, and nothing is saved until you have checked it. The same applies to the names, addresses, shares and mortgages of a boat's owners. Captain Crews keeps the document only if you attach it to the unit's documents. The engine is also used to sort a unit's photo by area (the photo is sent), to sort uploaded documents and link them to a unit (the document is sent, with the list of the fleet's units), to read an uploaded document and suggest its type, expiry date and a summary, to read an imported fleet spreadsheet, to translate the texts you type (for example job titles and notes) for a reader of another language, and to analyse a dictated job. When the assistant answers questions about staff, the results of its look-ups are also sent to it: employees' names, email addresses and job titles, hours statistics, schedules, leave and absences. At Anthropic, requests and responses are deleted within 30 days, unless the law requires otherwise or misuse is being investigated. They are not used to train Anthropic's models. The data is stored in the United States; processing may take place in other countries (Europe, Asia, Australia). Anthropic acts as a processor under its data processing agreement (DPA), incorporated into its commercial terms; this agreement includes the European Union's standard contractual clauses.
• ElevenLabs (USA) — voice synthesis of the assistant's reply. Off by default: it is switched on for a company only at that company's request, and is then used only when you enable voice mode. The reply text is sent and the resulting audio is returned.
• Resend (USA) — sending transactional emails: password reset, a security alert when a fingerprint is added to your account for logging in or your 6-digit code is enabled, demo requests (forwarded to our team, with an acknowledgement to the requester) and internal AI-spending alerts sent to the Captain Crews team. No business data transmitted. Resend acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Vercel (USA, hosting in the United Kingdom) — application hosting and file storage. Vercel acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Neon (USA, hosting in the United Kingdom) — database.
• Cloudflare (USA, storage in Western Europe) and GitHub (USA) — storage of backups (details in §3 and §5). The copy of the database reaches them encrypted, with a key that neither of them holds.
• Microsoft (USA) — Microsoft Clarity, audience measurement on the public marketing pages only, loaded after the cookie banner is accepted and switched off as soon as you enter the application: no recording of its screens or of your business data (details in §8). Microsoft acts as a processor under its data processing agreement (DPA), incorporated into its terms of service.
• Dealfront / Leadfeeder (Finland and Germany, EU) — identifies the company a visit to the marketing site only comes from, based on the public IP address, after the cookie banner is accepted.
• Sentry (USA, data hosted in the European Union — Frankfurt, Germany) — detection and diagnosis of technical errors in the application and on the site (reports described in §1). Reports sent by your browser go through our own domain, with no cookies; no advertising use; your IP address and the location derived from it are not retained. Some technical metadata may be processed in the United States under contractual safeguards. Error detection from your browser starts on 30 September 2026 (14-day notice, §10); on the server side it has been in place since May 2026.

• Active account: as long as you use the service.
• To limit abuse of the contact and “forgot password” forms, we keep a cryptographic hash of the IP address, never the IP address itself. It is erased during daily cleanup: we keep it for about 24 hours, longer in the event of an outage.
• Deleted account: business data is kept for 30 days after termination to allow recovery, then permanently erased (except where a legal obligation to retain accounting records applies, e.g. supplier invoices kept for 10 years on the tenant side). It remains in the encrypted backups until they expire (see “Backups” below). Uploaded files (photos, documents, attachments) are erased when the record, unit or company that contains them is deleted, or when they are deleted directly in the application, unless they are still used elsewhere (for example a document that also serves as the receipt of an invoice); the profile photo of a deleted account is erased too. A deleted invoice first spends 30 days in the application's bin, where it can be restored, then it is erased with its file. When a user account is deleted, its personal data is erased, but what it wrote for others (work reports, notes and messages with their attachments, incident reports) remains visible to the other participants, signed “Deleted account”. An erased file is then removed from the backups as described below.
• Sign-in attempts, sessions, error reports and technical logs: 90 days maximum.
• Documents and questions sent to the AI: Captain Crews does not keep a registration certificate or boat document sent for reading, unless you attach it to the unit's documents. At Anthropic, every request (registration certificate, boat document or invoice being read, question to the assistant…) is deleted within 30 days, unless the law requires otherwise (up to 2 years if flagged by a misuse check).
• Activity log (who did what in the application: name and email address of the author, the action and the item concerned — for example the deleted account; for each successful sign-in, the IP address and browser used; for each sign-in refused because of a wrong password, its date and the account concerned, without IP address or browser): 24 months, including after the author's account has been deleted. It is used for the security of the service and to trace an operation in the event of a dispute. The only exception to this period: the entry that proves acceptance of the Terms of Service is kept as long as the account that accepted them exists; the 24-month rule then applies.
• Demo request with no follow-up: 3 years from the last contact, then erased. You can ask for immediate deletion at any time.
• Encrypted backups: 90 days for the database. A file deleted from the application (photo, document) is removed from the backups about 90 days after its deletion (up to 120 days if it had been uploaded less than a month earlier).

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): request the deletion of your data, subject to legal retention obligations.
• Right to portability: receive your data in a structured, open format, as a ZIP archive containing CSV tables, text sheets, PDFs and your original files (photos, documents).
• Right to object and right to restriction of processing.
• Right to withdraw your consent at any time (without affecting prior processing).

To exercise these rights, contact us at info@captaincrews.com, specifying the subject of your request. We respond within 30 days. If our response does not satisfy you, you may refer the matter to the competent supervisory authority: the CNIL in France, or the Data Protection Office in Mauritius.

• Authentication via bcrypt-hashed passwords (12 rounds).
• Optional two-factor authentication (2FA) via TOTP (Google Authenticator, Authy, etc.).
• Optional fingerprint sign-in (passkeys, WebAuthn standard): each key is bound to the captaincrews.com domain and cannot be used by a fake site.
• HS256-signed JWT sessions with revocation support (global kill switch on password change).
• Temporary account lockout after consecutive failed sign-ins: 30 minutes from 5 failures within 24 hours, 2 hours from 10; a permanent block can only be set by an administrator.
• Rate-limiting of sensitive API calls.
• Standard HTTP security headers: HSTS, X-Frame-Options DENY, X-Content-Type-Options, restrictive Permissions-Policy; Content-Security-Policy on uploaded files served by the application.
• Reporting a security vulnerability: write to info@captaincrews.com (address also published in /.well-known/security.txt), without making it public before it is fixed.

Inside the application, Captain Crews uses only cookies needed for it to function or to remember your display preferences, with no tracking:

• anm_session — authenticated session cookie (httpOnly, secure, sameSite=lax, 30-day lifetime).
• anm_pending_2fa — temporary cookie between password entry and 2FA validation (5-minute lifetime).
• locale, bandeau_langue, devise, cc_boat_hero — display preference cookies, with no tracking: interface language (also set on the public website when you choose a language), your choice not to see the website's language suggestion again, the currency of the website's prices (euro or US dollar) and compact view of a unit's sheet (1-year lifetime).

On the public pages of captaincrews.com only, and only after you accept the banner shown on your first visit, two audience-measurement tools are loaded. They are switched off as soon as you enter the application and record neither its screens nor your business data:

• Microsoft Clarity (Microsoft Corporation, USA) — audience measurement and anonymised recording of browsing journeys on the public pages, to understand how the site is used and improve it. When you enter the application, Clarity stops; one last technical signal, with no screen content, may still carry the address of the application page then open (for example after going back or a long period of inactivity).
• Leadfeeder / Dealfront (Finland and Germany, EU) — identifies, from the public IP address, the company a visit comes from. No individual is identified and no value typed into a form is passed to it. As soon as you enter the application, the tool is switched off by a technical cookie (ldfdr_opt_out), which also erases its visit identifier (_lfa); this cookie is lifted when you return to the site.

No advertising cookies, no retargeting cookies, no social network pixels, no sale of data. If you decline the banner, neither tool is loaded and the site works exactly the same.

Error detection (Sentry) — in the application and on the site alike, an error-detection module runs without waiting for the banner: it serves the security and proper functioning of the service you are using, not audience measurement. On the marketing site, it sends nothing unless an error occurs. It sets no cookies and writes nothing to your browser's storage, so declining the banner does not disable it. It is based on our legitimate interest (§2). These reports contain no cookie, no IP address and no account identifier; for any question about this processing, write to us (see §6).

Change my cookie choice

Captain Crews is a B2B professional tool intended for companies. No access is provided for persons under 16 years of age. If we became aware that an account had been created for a minor, we would delete it immediately.

This policy may be amended to reflect technical or regulatory changes. The update date is shown at the top of the page. Substantial changes will be notified to you by email at least 14 days before they take effect. Latest notice: client companies were informed by email on 16 September 2026 of the activation of browser-side error detection (see §4, Sentry), which took effect on 30 September 2026. Update of 15 October 2026: clarifications, and one addition to the activity log: sign-ins refused because of a wrong password are recorded there (date and account concerned, without IP address or browser); no email was sent for it.

Any question, request to exercise a right, or report of a security incident:

Assistance Nautic Ltd
Avenue Shebeck, Albion 91001, Mauritius
BRN: C18153647
Email: info@captaincrews.com