Privacy Policy
This explains what personal data YachtPlan collects, why, who sees it and your rights, under the EU/UK General Data Protection Regulation (GDPR) and Italian data protection law.
1. Who is responsible (the data controller)
Stefania Malpeli, Marina di Pertusola, Lerici (SP), Italy. Contact for anything privacy-related: stefania@devalier.com. We reply within one month.
2. What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, and your name if you sign in with Google; Google’s stable account id | Your account and signing in | Contract (providing the service you asked for) |
| Confirmation that you are 18+, that you accepted the Terms, which version and when | Proof you met the age rule and agreed to the Terms | Legitimate interest (running the service lawfully) |
| Signed-in browsers: a scrambled version of the session token, the IP address and browser description (user agent) from when you signed in, and the dates | Keeping you signed in and security | Contract and legitimate interest (security) |
| If you ask for an email link: your email address and a scrambled version of the one-time code (valid 15 minutes, once) | Letting you in | Contract |
| Your boats and everything you enter: vessel details (which can include hull number, MMSI, call sign, home port), checklists, completions and notes, engine-hour readings and maintenance events | The service itself | Contract |
| Documents you upload (the files) and what is derived from them: title, summary, filing position | Your document vault and, if you switch AI on, filing and reading them | Contract; AI use is your choice (section 4) |
| Your settings: language, units, and AI connection (provider, address, model, on/off, and your API key, stored encrypted) | Remembering your preferences | Contract |
| Your task-email setting (off, daily or weekly) and when we last sent one. If you turn it on: an email with your overdue and due-soon tasks, sent to your account address | Sending the reminders you asked for | Your consent: it is off until you turn it on, and you can turn it off at any time in Settings or with the link in every email |
We do not use analytics, advertising identifiers or location, we do not sell your data, and we do not use it for advertising or profiling.
3. AI
AI is off unless you switch it on and enter your own API key. Then, when you upload a document or ask for a translation, YachtPlan’s server sends the relevant content — the document file, your checklist structure for context, and text to translate — to the provider you chose, using your key. We send no name, email or account details with it, but a document or checklist can itself contain personal data, so do not upload what you should not share. The provider acts under your agreement with it and its own privacy terms; we do not control it and it is not our processor for this purpose. Your key is encrypted at rest and never written to logs. AI output is automated and can be wrong; it only suggests checklist content and never has a legal or similar effect on you. With the AI switch off, nothing is sent to any AI provider.
4. Who else sees your data
- OVHcloud (European Union), which runs our server and stores the database and uploaded files, on our instructions.
- netcup (Germany) keeps encrypted backup copies of our database and uploaded files, on our instructions.
- Cloudflare passes the traffic between your browser and our server through its network to protect it and speed it up, so it technically sees your requests, including your IP address, on our instructions.
- Google, if you choose “Continue with Google”: it knows you signed in to YachtPlan, and we receive your email, name and account id.
- The email service that delivers sign-in links and, if you turn them on, task emails (when email is enabled): it sees your email address and the message.
- The AI provider you choose, as described in section 3.
- Authorities, if the law requires it.
Some of these providers may process data outside the EU under their own safeguards (for example standard contractual clauses). We do not sell or rent data, or share it for marketing.
5. How long we keep it
Your account, boats, checklists, documents and settings: until you delete your account. Signed-in browser records: until they expire (14 days) or you sign out, and removed with your account. Email-link records are deleted shortly after they expire. When you delete your account everything above is erased from our live systems immediately, including uploaded files. Backups are encrypted and kept for about a month, so copies of deleted data may remain there until they expire. Templates you made public to others are not personal data to us unless they contain it; check before you share.
6. Your rights
You can ask to see, correct or delete your data, restrict or object to its use, receive it in a portable format and withdraw consent at any time. In the app you can download your data (a JSON file; your API key is not included, and uploaded files are downloadable one by one from the vault) and delete your account yourself. For anything else write to stefania@devalier.com. You can complain to the supervisory authority: the Garante per la protezione dei dati personali (www.garanteprivacy.it).
7. Age
YachtPlan is for people aged 18 or over (see section 1 of the Terms for why). We do not knowingly keep data about anyone younger; tell us and we will delete it.
8. Security
Connections use HTTPS, session and sign-in tokens are stored only as digests, AI keys are encrypted at rest, and each account’s data is separated from others’. No system is perfectly secure; if a breach puts your rights at risk we will notify you and the authority as the law requires.
9. Changes
If we change this policy in a way that matters, we update the version date above.