Privacy policy
Draft, 2 November 2026. To be reviewed by a solicitor before launch. The company details are to be confirmed.
Who we are
Yotcrew is an app and website for superyacht crew, run by [company name, registered address, company number] (“Yotcrew”, “we”). You can contact us about your data at [privacy@domain].
What we hold about you, and why
| Information | Why | Lawful basis |
|---|---|---|
| Name, email, password (stored scrambled), date of birth, position, photo, bio, languages, skills | Your crew profile and account | Contract (running the service for you) |
| Uniform sizes, birthday cake choice | So your boat can kit you out and celebrate | Contract |
| Dietary needs, medical certificates (ENG1) | Catering and showing you’re fit to work at sea | Your explicit consent, which you can withdraw at any time in Settings |
| Certificates, passport, seaman’s book and other documents, with scans | Your record, and your boat’s crew compliance | Contract; legal obligations of the vessel (crew records) |
| Next of kin (name, relationship, phone, email) | Emergencies | Legitimate interests (your and your next of kin’s vital interests) |
| Sea time, trips, testimonials and references | Your sea service record for MCA certificates and your career | Contract |
| What you do on board: jobs, checklists, watch schedules, handovers, chat, work and safety reports | Running the vessel day to day | Contract; legitimate interests of the vessel |
| Device and app information, crash reports, your time zone | Keeping the app working and sending reminders at the right time | Legitimate interests |
Who can see it
- Your shipmates see your crew profile (name, photo, position, bio, uniform, food, radio, cabin).
- Your certificates and documents: only you, your vessel’s admins and your head of department. Each time someone else opens one of your scans it’s logged and you’re told; you can see who opened what, and set any document to “Ask me first”.
- Private chats: only the two people in them. Anonymous safety reports keep no name or account at all.
- Your sea time and references are yours: they stay with you when you leave a boat.
- We never sell your data or use it for advertising.
Who processes it for us
- Supabase (database and file storage), London, United Kingdom
- Expo (app updates and push notifications), United States
- Vercel (website hosting), United States
- Sentry (crash reports, without names or emails), United States
- Google (sending sign-up emails), United States
Transfers to the United States are protected by each company’s data processing agreement and the UK International Data Transfer Addendum / EU Standard Contractual Clauses or the UK–US data bridge.
How long we keep it
Your profile, papers and sea time stay until you delete your account. Notifications are deleted after 60 days. Your vessel’s operational records (jobs, checklists, watch history, handovers) stay with the vessel; when you delete your account your name on them becomes “Former crew”. Full schedule: [link].
Your rights
- See everything we hold: Settings → Download my data.
- Correct it: Edit profile, or ask your vessel’s admin for boat details.
- Delete it: Settings → Delete account removes your profile, papers, scans and messages.
- Withdraw consent for dietary and medical data in Settings.
- Object or complain: contact us, or the Information Commissioner’s Office (ico.org.uk).
We answer requests within one month.
Security
Everything is sent encrypted. Your sign-in on your phone is kept encrypted with a key in the phone’s keychain. Database rules decide who can see what, on the server. Scans open through links that expire within minutes. If a breach ever puts your data at risk, we’ll tell the ICO within 72 hours and tell you without delay.
Changes
We’ll tell you in the app before any important change to this policy.