Privacy Policy

Last updated: October 2026

Vessel Signature (“we”, “us”) provides a platform that records and certifies the maintenance history of recreational boats. This policy explains what personal data we process, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller is Vessel Signature. For any privacy request, contact privacy@vesselsignature.com.

2. What we process, and why

• Account data (name, email, password hash or Google account link) — to operate your account. Legal basis: contract.
• Vessel and maintenance data (boat details, engine data, maintenance records, photos, invoices, uploaded manuals) — the core service you ask us to provide. Legal basis: contract.
• Billing data (subscription status, billing address, VAT ID) — processed by Stripe; we never store card numbers. Legal basis: contract and legal obligation.
• Usage analytics — only with your consent (cookie banner), via PostHog (EU region). Legal basis: consent, revocable anytime in Settings.
• Error diagnostics — crash reports via Sentry to keep the service reliable. Legal basis: legitimate interest.

3. Public sharing you control

Buyer Reports and mechanic verification pages are public to anyone with their link, by your explicit action (generating a report or a verification code). Reports expire automatically. Do not generate a report if you do not want its contents viewable by whoever holds the link.

4. Certification hashes

To seal records, we compute a cryptographic hash (SHA-256) of the record and may anchor that hash on a public ledger. The hash is not reversible: no personal data, photos, or documents are ever published — only the fingerprint that lets a record be proven unaltered.

5. Learning from the fleet

When you say something is wrong with your boat and later log the work that fixed it, we ask at 30 and 90 days whether the fix held. Each night we copy a de-identified (pseudonymised) example of that to a separate table: the boat's model, year and equipment, engine hours in broad ranges, the kind of job, who did it, and whether it held. It never contains your name, your email, the boat's name, anything you wrote, photos, documents, places or prices, and boats are identified only by a keyed one-way code.

We use these examples, on the basis of our legitimate interest in improving the service, to learn which fixes hold on which boats — for example, to suggest the likely cause of a symptom. They never change a boat's Trust or Care score and are never sold. You can turn this off at any time in Settings → Help the fleet learn: your boats' examples are removed at once, and nothing in your record changes. Deleting your account removes them too.

6. Processors we use

• Vercel (hosting, file storage)
• Stripe (payments, VAT)
• Google (optional sign-in)
• PostHog, EU region (analytics, consent-based)
• Sentry (error monitoring)
• Upstash (abuse protection / rate limiting)
• OpenAI / Anthropic (processing of manuals you upload, to power answers about your boat — never used to train their models under our API terms)

7. Retention

We keep your data while your account exists. Deleting your account in Settings permanently removes your account, boats, records, photos, manuals, and reports. Invoices and billing records are retained where tax law requires it.

8. Your rights

You can access, correct, export, or erase your data, object to or restrict processing, and withdraw consent at any time. Account deletion is self-service in Settings; for anything else, email privacy@vesselsignature.com. You may also lodge a complaint with your local data protection authority.

9. Cookies

Essential cookies keep you signed in. Analytics cookies are set only after you accept them in the cookie banner, and you can withdraw that consent in Settings → Privacy at any time.

10. Changes

We will announce material changes to this policy by email or in-app before they take effect.