Privacy Policy
Effective Date: April 6, 2025
Welcome to Sails Search. This Privacy Policy describes how SailsSearch (the "Platform," "we," "us," or "our") collects, uses, discloses, and protects your personal information. SailsSearch is owned and operated by Ivan Lebedynskyi, an individual, located at 48 Chyhyrynska Street, apt. 16, Cherkasy, 18000, Ukraine. This Policy applies to all users of our website and mobile applications (iOS and Android) (collectively, the "Services"). By using the Services, you agree to the terms of this Privacy Policy, which forms part of our Terms and Conditions. We are committed to complying with all applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's Lei Geral de Proteção de Dados (LGPD), and relevant Apple App Store and Google Play Store privacy requirements.
We understand your privacy is important. Please read this Policy carefully to understand our practices regarding your information. If you do not agree with any part of this Privacy Policy, please do not use our Services. If you have questions, you can contact us using the information in the Contact Us section below.
1. Personal Data We Collect
We collect various types of personal data from you when you use Sails Search, including information you provide directly, data collected automatically, and information from third parties. We limit our collection to what is necessary for the purposes described in this Policy. The types of personal data we may collect include:
1.1 Information You Provide Directly
When you interact with our Platform, you may voluntarily provide personal information, such as when creating an account, completing your profile, subscribing to services, or communicating with other users. This information includes:
- Identification Data: Your first name, last name, date of birth, and a profile photo or avatar.
- Contact Data: Your email address, telephone number, and residential address or mailing address.
- Account Credentials: A unique username (or user ID) and an encrypted password. (Please choose a strong password and keep it confidential. We store passwords in a hashed/encrypted form and never in plain text.)
- Profile Information: Details you add to your profile such as your sailing experience (e.g. years of experience or skill level), sailing or maritime licenses and certifications (education or training credentials), personal bio or description, and any ratings and reviews you receive or provide on the Platform.
- Payment Information: If you make transactions (for example, to pay for a subscription or book a service), you provide payment details. This may include credit or debit card information, bank account details, billing address, and other billing information. Note: Payment card information is processed via our secure payment processor (e.g. Stripe) and we do not store your full card number or CVC on our servers (only a token or abbreviated information may be stored for record-keeping).
- Maritime Qualifications: You may provide details of your maritime education, such as sailing certificates, skipper licenses, or other relevant qualifications. This helps verify your credentials and improve trust in the community.
- User Communications: Copies of communications you send through the Platform, including messages sent via our user chat feature, emails or inquiries to our support team, or responses to surveys and feedback requests.
- Other Information You Choose to Provide: This can include content you post or upload (such as boat listings, trip descriptions, photos or videos you share), responses to questionnaires (e.g. about your sailing preferences), or any other personal data you choose to enter into free-text fields on the Platform.
Important: When providing information, you are responsible for the content and accuracy of the data. Please do not provide any personal data that you are not comfortable sharing, and do not include anyone else's personal information without their consent. Do not upload or share sensitive personal data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, health information, or criminal background) on the Platform. We do not require or intentionally collect sensitive data for our Services. If you do include such information (for example, in a profile description or chat), it is at your discretion, and we will handle it in accordance with this Policy, but we may remove it if it violates our content guidelines. If you provide us with personal data about a third party (for example, information about a friend or crew member), you must ensure you have that person's permission to do so.
1.2 Information We Collect Automatically
When you use SailsSearch (whether via website or mobile app), certain data is collected automatically about your device and usage of the Services. This data helps us understand how the Platform is used, diagnose technical issues, ensure account security, and improve user experience. The information we collect automatically includes:
- Usage Data: Details about your interactions with the Services, such as the dates and times you log in, pages or screens you view, features you use, links you click, searches or queries you make, and other actions on the Platform. We also record session length and frequency (e.g. how often and how long you use the Service), referral URLs (how you arrived at our site/app), and performance logs (such as error reports or crash data).
- Device and Browser Data: Information about the device and software you use to access the Services. This may include your IP address (Internet Protocol address), device type (e.g. phone, tablet, PC brand/model), operating system name and version (e.g. Android, iOS, Windows), browser type and version (if using a web browser), language preferences, unique device identifiers or advertising IDs, and mobile network information.
- Geolocation Data: We may collect location information from your device. Precise Geolocation data (such as GPS coordinates) is collected only if you grant permission through your mobile or browser settings. For example, you might allow location access to find nearby sailing opportunities or to tag the location of an event. If you enable location services, we may gather your real-time geographic location. You can always choose to deny or disable location access via your device settings, although certain location-based features might not be available. Even if you do not share precise GPS data, we may derive approximate location from your IP address (which gives a general region).
- Cookies and Similar Technologies: We use cookies, web beacons, local storage, and similar tracking technologies to collect information about your use of our website and app. Cookies are small text files placed on your device that remember your preferences and activities. For example, cookies help us recognize you when you return, keep you logged in, store site preferences, and analyze how users navigate our site. We also use cookies or pixels from third parties (like Google and Facebook) for analytics and advertising, as described below. For more details, see Section 5 (Cookies and Tracking Technologies) below. You can control or block cookies through your browser settings and other tools (see Section 5 for options).
These automatically collected data points generally do not identify you by name, but they may be linked to your user account or combined with other data we have collected about you. Where required by law, we treat combined information as personal data and protect it accordingly. We may also aggregate or anonymize usage and device data (so it can no longer be linked to any individual user) for analytical or statistical purposes.
1.3 Information from Third Parties
We may obtain personal data about you from third-party sources in some situations, which we combine with data we collect through our Services. For example:
- Third-Party Authentication: If you choose to register or log in via a third-party account (for instance, using "Sign in with Google" or Facebook Login), we will receive certain information from that third-party (such as your name, email, or profile photo) as permitted by the login provider and authorized by you. We use this only for authentication and to pre-fill your profile details.
- Payment Processors: When you make payments through our payment partner (e.g. Stripe), we may receive limited information from them confirming a payment's status. For instance, Stripe might send us a token or confirmation code, your billing address, or notice of a successful or failed payment. (We do not receive your full credit card number from Stripe—this remains with the payment processor.)
- Social Media and Marketing Partners: If you engage with our content on social media (e.g. click a Facebook ad about Sails Search) or if we utilize analytics/advertising services, those third parties may provide us with data such as aggregated demographic information or campaign performance data. For example, we might get insights from Google Analytics or Facebook Ads about how users interact with our site or the effectiveness of our marketing. This information is typically statistical and not tied to you individually, but may include things like age range, general location, or interests if those platforms have such data from your profile.
- Other Users: In some cases, other users of the Platform might provide information about you. For instance, a friend might refer you to the Platform by providing your email address, or a user who has interacted with you could mention you in a review or send you a message through our chat. We require users to ensure they have rights to share any personal data of others.
We will treat any personal information obtained from third parties in accordance with this Privacy Policy. The collection and use of data by third-party sources are governed by their own privacy policies. We encourage you to review the privacy policies of any third-party services you use (such as Google, Facebook, or Stripe) to understand what data they may share with us.
2. How We Use Your Personal Data
We use the personal data collected for the following purposes, and we ensure we have a valid legal basis for each use. In general, we use your data to operate and improve the SailsSearch Platform, to provide you with the services you request, to facilitate safe and efficient sailing-related connections, and to fulfill our legal and contractual obligations. Specifically, we may use your information to:
- Provide and Maintain Our Services: We use identification, contact, and account data to create your account, authenticate you when you log in, and enable you to use the Platform's features. For example, we use your data to allow you to search for yachts or crew, create or join trips and regattas, post or respond to listings, and interact with other users. We also use it to display your profile to other users and to manage any bookings or arrangements you make through Sails Search. Processing your personal data for these purposes is generally necessary to perform our contract with you (the Terms of Service).
- Facilitate Transactions and Payments: We use your personal and payment data to handle subscriptions, bookings, or other transactions you initiate. For instance, if you subscribe to premium features or pay a charter fee, we (and our payment processor Stripe) will use your provided payment information to process the charges. We also use your contact data to send you receipts or transaction notifications. This processing is to perform our contract with you and to comply with financial regulations (e.g. keeping records for accounting and tax purposes).
- Communicate with You: We use your email, phone number, or in-app notifications to communicate important information regarding your account or activities on the Platform. This includes sending confirmation emails, responding to your inquiries or support requests, sending service-related announcements (such as updates to our terms or this Policy), and notifying you about messages or invitations in the Platform (for example, if another user sends you a chat message or a booking request). We may also send push notifications through our mobile app to alert you to new messages, upcoming trip reminders, or other relevant updates. (You can control push notification preferences in your device settings.) These communications are part of our service to you (contractual or legitimate interest to keep you informed).
- Enable User Interactions (Chat and Messaging): SailsSearch includes user communication features, such as chat messaging and forums/reviews. We process the content of these communications to deliver messages between users and to moderate the content for compliance with our community guidelines and safety. For example, our system may monitor chat messages to filter out spam, scams, or abusive language, and our support team may review communications if a user reports harassment or other policy violations. This is done under our legitimate interest in maintaining a safe, trusted community and may also be necessary to enforce our terms of service. Keep in mind that messages you send in the Platform are not end-to-end encrypted, and while we value user privacy, you should not expect absolute confidentiality for communications within Sails Search, especially if they are reported for review.
- Personalize and Improve Your Experience: We use data about your activities and preferences to personalize the Services. This can include recommending relevant yacht listings, crew matches, or training programs based on your profile and past usage, or customizing content shown to you. We may also use cookies and usage data to remember your preferences (such as language or currency selection) and to streamline your experience (for example, remembering recent searches or showing you targeted content that aligns with your interests). We analyze usage and device data to understand how our Services are being used and to make improvements. This helps us debug issues, optimize our user interface, and develop new features. We rely on our legitimate interests in providing an optimal platform and, where required by law (for example, for certain types of personalized advertising or tracking), we will obtain your consent.
- Marketing and Promotional Communications: With your consent (where required), we may use your contact information (email or in-app) to send you marketing communications. This can include newsletters, promotions, surveys, or information about new features or events related to sailing that we think may interest you. For example, we might send a monthly newsletter with sailing tips or special charter deals, or notify you of upcoming regattas on the platform. You have the right to opt out of marketing messages at any time. If you do not wish to receive promotional emails, you can click the "unsubscribe" link in any marketing email or adjust your account settings to disable such communications. (Transactional and service-related communications, as noted above, will still be sent as needed.) We may also tailor the marketing content you see, so that it's relevant -- for instance, showing you ads on other platforms (like Facebook or Google) based on your SailsSearch activity, but such online advertising will typically rely on cookies or advertising identifiers (see Section 5 on Cookies) and, where required, will be done only with appropriate consent.
- Analytics and Statistics: We use aggregated usage data and cookies to carry out analytics on user behavior. For example, we use Google Analytics to understand which pages or features are most popular, how users move through our app, and where they encounter errors. This analytical processing helps us refine our product and business strategy. The information used for analytics is mostly aggregated or pseudonymized. We consider this processing to be under our legitimate interest in running a productive service, but in jurisdictions where consent is needed for analytics cookies (e.g. EU), we will obtain consent through our cookie consent banner.
- Ensure Trust and Safety; Prevent Fraud: We are dedicated to maintaining SailsSearch as a secure and trustworthy community. We may process your data to verify your identity or qualifications (for example, reviewing your provided sailing license or ID documentation if we implement a verification process), or to run checks aimed at preventing fraud or illegal activities. We monitor accounts and usage patterns for suspicious behavior (such as detecting multiple accounts, fraudulent payment attempts, or inappropriate content in profiles or chats). If necessary, we use automated systems and manual reviews to flag and deal with violations. We might also use your data to resolve disputes, such as investigating any complaints between users and taking appropriate action (which could include sharing limited info between the parties or to authorities as needed). This trust and safety processing is based on legitimate interests (protecting our users and business), compliance with legal obligations, and in some cases, performance of our contract (ensuring the platform functions as agreed).
- Legal Compliance and Enforcement: We may use your personal information as necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests. For instance, we may retain and disclose certain data about transactions for tax audits, or respond to a court order or subpoena requesting information (after verifying its validity). We also use data to enforce our own legal rights and agreements -- for example, to investigate violations of our Terms and Conditions, or to enforce this Privacy Policy. We may use your data to contact you regarding an important legal matter, such as notifying you of a data breach or asking for required consent. This processing is necessary for compliance with legal obligations and to protect the vital interests of our company, users, or others.
- Other Purposes (with Notice and Consent): If we intend to use your personal data for any purpose that is not compatible with the original purposes for which it was collected, we will provide you with information about the new purpose and seek your consent where required. We will not use your personal data in ways not outlined in this Privacy Policy without letting you know and obtaining any necessary permission.
We do not sell your personal data to third parties for profit. We only use and share your data as described in this Policy. If we ever need to process your personal information for a purpose that requires your consent under applicable law, we will ask for your consent explicitly and you have the right to decline or withdraw your consent at any time.
3. Legal Bases for Processing (GDPR and Similar Regulations)
For individuals in the European Economic Area (EEA), United Kingdom, Brazil, Canada, and other jurisdictions with comprehensive data protection laws, we want to explain the legal grounds on which we process your personal data. SailsSearch (Ivan Lebedynskyi as the data controller) processes personal data only when we have a lawful basis to do so under applicable law, such as:
- Consent: In cases where we ask for your consent to process data, we will only process your data for the specific purpose you agree to. For example, we rely on consent for sending marketing emails to users in jurisdictions where such consent is required, or for collecting precise geolocation or using certain cookies and analytics tools (in regions like the EU). You have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing we carried out based on consent before its withdrawal. Some features might not be available if consent is withdrawn (for instance, if you disable location access, location-based features will be limited).
- Performance of a Contract: We process personal data that is necessary to provide the services you have requested, under our Terms and Conditions (the contract between you and Sails Search). When you create an account and use our Platform, a contract is formed. For example, we need to process your name, contact info, and profile details to create your account and allow you to interact with others; we need payment info to process a subscription you've signed up for. Without this information, we cannot fulfill our obligations under the user agreement (such as providing the yacht booking or crew matching services).
- Legitimate Interests: We process certain data as needed for our legitimate interests (or those of others), provided such processing is fair, balanced, and does not unduly impact your rights. We have a legitimate interest in maintaining and improving our Services, securing our platform, preventing fraud, and growing our business. For instance, it's in our legitimate interest to collect usage data to understand how to improve our app, to moderate user-generated content to protect our community, and to send you notifications about service updates. When we rely on legitimate interests, we consider and balance any potential impact on your rights (both positive and negative) and will not use your data for activities where our interests are overridden by the impact on you (for example, we would not use sensitive personal data under legitimate interest without your consent). You typically have the right to object to processing based on legitimate interests (see Your Rights below).
- Legal Obligation: We will process personal data when it is necessary for compliance with a legal obligation to which we are subject. This includes obligations under laws and regulations (for example, maintaining transaction records for tax and accounting purposes, or providing information to authorities if legally required, such as under a court order). Another example is handling personal data in accordance with consumer protection laws or data protection authorities' requirements. If we are obligated by law to retain certain data (like records of payments or consents), we must do so.
- Vital Interests: In rare cases, we may need to process personal data to protect your vital interests or those of another person. For example, if we become aware of a situation that poses a serious threat to someone's life or health and personal data is necessary to help prevent harm, we might use or disclose information as needed (this is uncommon and typically would align with a legal obligation or emergency doctrine).
- Public Interest: If ever applicable (likely not in our context), we might process data in the public interest or in the exercise of official authority, but this is generally not relevant to a private platform like Sails Search. We mention it for completeness in line with GDPR's list of bases.
Brazil (LGPD): For users in Brazil, we process your data under the legal bases provided in LGPD, which largely correspond to the ones above (consent, contract performance, legitimate interests, legal obligations, etc.). LGPD also specifically includes bases such as the protection of credit and the processing of personal data obtained from publicly available sources for the purpose of credit rating -- these are not activities SailsSearch engages in, so they are not applicable. We primarily rely on your consent, contract necessity, legitimate interests, or legal duties, as explained.
Canada (PIPEDA): We handle personal information of Canadian users in accordance with the principles of PIPEDA: we obtain consent for collection, use, and disclosure of personal information, except where otherwise permitted or required by law; we use information for the identified purposes and as is reasonable for providing our services; and we allow you to access and correct your information (see Your Rights, Section 9). Where we have your consent (implied or express) to use your info for the purposes outlined, that constitutes our lawful basis under Canadian law. You can withdraw consent as noted above.
If you have any questions about the legal basis upon which we collect and use your personal data, please contact us (see Contact Us at the end of this Policy). Depending on your jurisdiction, some of the above bases may not apply, but we include them to be transparent to our global audience.
4. Cookies and Tracking Technologies
Cookies and similar technologies are an important part of how we collect information automatically. We want to explain what these technologies are and how we use them, as well as your choices regarding them.
What are Cookies? Cookies are small data files placed on your computer or device when you visit a website. They allow the site to remember your actions and preferences over a period of time. There are different types of cookies:
- Session Cookies: Temporary cookies that remain in your browser's memory only during your visit and are deleted when you close the browser. These help the site function (for example, remembering you're logged in as you navigate pages).
- Persistent Cookies: These remain on your device for a set period even after you close the browser, unless deleted manually. They help the site remember you on subsequent visits (for example, keeping you logged in, or remembering your preferences such as language).
- First-Party Cookies: Cookies set by SailsSearch (the site you are visiting). They are used for core functionality and remembering your settings.
- Third-Party Cookies: Cookies set by other domains or services not operated by us. For example, we use Google Analytics which sets cookies to collect web analytics data, and advertising networks like Facebook/Google may set cookies to measure ad performance or for re-targeting.
Similar Technologies: In addition to cookies, we may use web beacons (small graphic images or pixel tags embedded in websites or emails that track if an action is taken or an email is opened), software development kits (SDKs) in our mobile app (which function like cookies for apps by enabling data collection and tracking within the app environment), or local storage objects (like HTML5 localStorage or app storage) to store information (e.g., caching data for improved performance).
How We Use These Technologies:
- Essential Functions: We use cookies to enable core Platform functionality. For example, to keep you logged in as you browse different pages, to maintain your session state, and for load balancing (distributing traffic to keep the site up). Without these, the service may not work properly. These are often session cookies or persistent cookies that remember your login token.
- Preferences: Cookies remember your preferences, such as your chosen language, currency, or other settings, so you don't have to re-enter them each time. They can also remember what you last searched for or which tab you last viewed, to provide a smoother experience.
- Analytics: We use third-party analytics cookies (like Google Analytics) to collect information about how users use our website. These cookies collect information such as the pages you visit, the time spent on those pages, the link that brought you to our site, and any errors encountered. We use these insights to improve site content and functionality. Google Analytics may set cookies (_ga, _gid, etc.) and produce aggregated reports for us. (Google Analytics may also collect your IP address, but we have configured it, where possible, to anonymize IPs in EU regions.)
- Advertising and Marketing: We partner with advertising networks (such as Google Ads and Facebook Ads) that use cookies and pixels to deliver targeted advertisements on their platforms or other sites to users who have visited our site or might be interested in our services. For example, if you visit SailsSearch and consent to advertising cookies, you might later see an ad for SailsSearch on Facebook. These cookies and trackers help us measure the effectiveness of our campaigns (e.g., seeing how many people who clicked an ad ended up registering). We also may use a Facebook Pixel on our site, which tracks certain actions and allows us to create "custom audiences" for our ads.
- Security and Fraud Prevention: Some cookies are used to detect and prevent suspicious or fraudulent activity. For instance, we may use cookies to determine if it's really you making requests to our server (as opposed to a bot), or to throttle request rates.
- Testing and Optimization: We might use cookies during A/B testing of new features to consistently serve you the same variant and track performance. They help us understand which version of a page works better.
Your Choices: When you first visit our website, you may be presented with a cookie consent banner (particularly for users in the EU, UK, and other regions that require consent for non-essential cookies). You can choose to accept or reject certain categories of cookies (e.g., you might accept essential cookies but decline analytics and advertising cookies). Your preferences will be remembered in a cookie (so if you clear cookies, you may be prompted again).
Regardless of the banner, you have the following options to manage cookies:
- Browser Settings: Most web browsers allow you to refuse new cookies, delete existing cookies, or notify you when new cookies are set. Please note that disabling all cookies may affect the functionality of our site. Check your browser's help section for instructions on how to manage cookies. For example, in Chrome you can go to Settings > Privacy and Security > Cookies and other site data; in Safari, Preferences > Privacy.
- Opt-Out Mechanisms: For analytics, you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. For interest-based advertising, you can visit industry opt-out sites like the Network Advertising Initiative (NAI) opt-out page or Digital Advertising Alliance (DAA) opt-out page (for U.S. users), or Your Online Choices (for EU users) to opt out of many ad networks. Additionally, on Facebook you can adjust your ad preferences in your account settings, and on Google you can adjust Ad Personalization settings in your Google account.
- Do Not Track: Some browsers have a "Do Not Track" (DNT) feature that sends a signal to websites that you do not want to be tracked. Our site currently does not respond to DNT signals in a uniform way, because there is no standard interpretation of those signals. Instead, we allow you to manage tracking through the methods described above. You can also simply decline non-essential cookies via our cookie banner and that will effectively opt you out of analytics/advertising tracking on our site.
For more detailed information, please see our separate Cookie Policy (if available on our site) which provides a comprehensive list of cookies and trackers in use. By using our Services with cookies enabled in your browser/app, you consent to our use of cookies as described (to the extent such consent is legally required). If you have questions about our use of cookies, you can contact us.
5. Disclosure of Your Personal Data (How and When We Share Information)
We treat your personal data with care and confidentiality. We do not sell your personal information to third parties. However, in the normal course of operating our Platform and providing our services, there are circumstances where we share your data with third parties -- either because it's necessary to fulfill our services, you have directed us to do so, or we have a legal or legitimate need. The categories of recipients of personal data include:
5.1 Service Providers and Partners
We use trusted third-party companies and individuals to help us operate the SailsSearch Platform and provide our services on our behalf. These third parties act as "data processors" or service providers under our instruction, and they only have access to the information necessary to perform their tasks. They are contractually obligated to protect your data and use it only for the purposes we specify. Our key service providers and partners include:
- Payment Processor (Stripe): We use Stripe (Stripe, Inc. and its affiliates) to process secure payments and subscription transactions. When you enter payment details, that information is transmitted directly to Stripe. Stripe handles the transaction and may store your card information (e.g., for recurring subscription billing) in accordance with industry security standards (PCI-DSS). We share with Stripe the necessary data to process payments (such as your name, email, order amount, and card details you provide). Stripe is prohibited from using this data for any purpose other than to carry out payment processing and related compliance (e.g., fraud monitoring, regulatory checks). (For more information, see Stripe's Privacy Policy.)
- Cloud Hosting and Infrastructure (Civo): Sails Search's servers and databases are hosted on Civo (a cloud infrastructure provider). That means the personal data you provide us (your account information, profiles, messages, etc.) is stored and processed on Civo's cloud servers. Civo may incidentally have access to the data as a hosting provider (for example, for backup management or technical support), but they are not allowed to use or disclose it except as needed to maintain our infrastructure. We rely on Civo's security measures as well as our own encryption and access controls to safeguard your data in the cloud. (For more information, see Civo's Privacy Policy.)
- Analytics and Usage Monitoring (Google Analytics): As mentioned, we use Google Analytics to collect website usage data. Google acts as a data processor for us, meaning the information collected via Google Analytics cookies (internet and device identifiers, usage info, etc.) is used on our behalf to analyze website traffic. Google may store this data on servers in various countries. We have configured Google Analytics to not share data with their other products unless you separately consent (for example, we typically do not enable Google Analytics Advertising Features unless noted). (See Section 4 for opt-out options.) (For more information, see Google Analytics' Privacy Policy.)
- Advertising Partners (Google Ads, Meta/Facebook): To reach new users and keep current users informed, we may utilize advertising platforms like Google Ads (including YouTube) and Meta Platforms (Facebook/Instagram). We may share some limited data with these partners for ad targeting and conversion tracking. For instance, we might upload a list of customer email addresses to Facebook to create a "custom audience" (only if we have appropriate permissions/consents to do so, and such lists are hashed so Facebook only uses them to match accounts). Or we might integrate Facebook Pixel and Google Ads tags on our site which send pseudonymous data (like a unique ID or cookie) to those platforms to let us track ad results. These partners do not get plaintext personal info like your name or password from such tracking -- but they will know that a user of your browser or device visited our site or performed certain actions. We ensure any such sharing is done in compliance with privacy laws (e.g., under GDPR, we treat this as part of our legitimate interest to advertise, done only after you've been given a chance to consent to tracking cookies). If you prefer not to have us use your data for targeted advertising, you can opt out of marketing cookies as described above, and you can opt out of these platforms' personalized ads as described in Section 4 (Cookie/Ad choices). (For more information, see Google Ads' Privacy Policy and Meta/Facebook's Privacy Policy.)
- Communication Tools: We may use services to send communications, such as an email service provider (for sending email newsletters, verification emails, etc.) or push notification services integrated into our apps (Apple Push Notification Service for iOS, Google Firebase Cloud Messaging for Android). These providers will process your contact data (email address or device push token) and message content as needed to deliver the communication. They are not allowed to use that information for other purposes.
- Customer Support Tools: If we use third-party platforms for customer support or chatbots, those tools may process data you provide in support tickets or chats. For instance, if we use an online helpdesk system, the information you submit (like your email and the details of a problem) would pass through that system. We would ensure any such provider keeps the data secure and confidential.
- Other Vendors: Occasionally, we might use other specialized vendors to assist with functions like identity verification, content moderation (e.g., automated filtering tools for chat), security (e.g., services that help detect fraudulent activity), or surveys (if we send out user surveys via a third-party survey tool). We will share the minimum data necessary and ensure these vendors are bound by privacy obligations.
A current list of our key sub-processors can be obtained by contacting us. We vet all service providers for strong privacy and security practices. If we change or add core service providers that will handle your personal data, we will update this Policy or notify users as needed.
5.2 Sharing with Other Users and Public Disclosure
Some of your information is shared with other users of the Platform by the nature of the service:
- Profile Information: When you create a profile on Sails Search, certain information in your profile will be visible to other registered users, and some elements (like a basic listing or name) might be visible to unregistered visitors if we allow public viewing of listings. For example, if you are a yacht owner listing a vessel, your listing details (boat description, location, availability) and your first name and profile photo might be visible to anyone browsing the site. Or if you are a crew member seeking a position, other members can see your sailing experience and any certifications you've chosen to list. We try to mark which fields are public vs. private when you fill out your profile. Your contact information (email, phone, address) is never disclosed to other users publicly by us without your consent. Other users may contact you through our internal messaging system without seeing your email or phone. Once you choose to communicate directly (off-platform), you might share your contact details at your discretion.
- Reviews and Ratings: If you submit a review or rating for another user (for example, rating a captain after a trip), that feedback will be published on the Platform and visible to others, attributed to your first name (and possibly general location or date of trip, etc.). Likewise, any reviews or ratings you receive from others will be displayed on your profile. Reviews are intended to be publicly viewable to foster trust in the community. Please be aware that once you post content publicly, we cannot control how other viewers might use or share that content (for example, someone could screenshot a review).
- User Chat and Forums: Communications you send privately via our chat are visible to the recipient(s). We do not post your private messages publicly. However, if our Platform offers any group forums or community boards, anything you post there would be visible to the participants of that forum (which may be all users, if it's a public forum). Always consider your own privacy and others' privacy when sharing information in any user-generated content area.
We urge you to exercise discretion when sharing personal information with other users. Use the Platform's communication tools to interact safely. Do not give out sensitive personal details to strangers. We also disclaim liability for the accuracy or use of information you choose to share with others -- we cannot control what recipients do with information you send them. If you plan to meet or transact with another user, ensure you do so safely and verify the necessary details independently.
5.3 Legal Requirements and Protection of Rights
We may disclose your personal data to third parties (such as law enforcement agencies, government authorities, or opposing litigants) if we determine that such disclosure is reasonably necessary to:
- Comply with a legal obligation or request: If we are served with a subpoena, court order, or other valid legal demand for information, we may be required to disclose data that we hold. We will evaluate the request to ensure it is legitimate and justifiable, and will only disclose the minimum amount of information necessary to comply. In some cases, we might notify you of such requests if allowed (for instance, if a government requests your data, we may let you know unless we are legally prohibited from doing so).
- Enforce our Terms and Policies: We may share information as needed to enforce or apply our Terms of Service or other agreements, including investigation of potential violations. For example, if required to investigate and address illegal activities (such as fraud, harassment, or threats made via our Platform), we might share data with security consultants or legal advisors.
- Protect Rights, Safety, and Property: We will disclose data if necessary to protect the rights, property, or safety of SailsSearch (Ivan Lebedynskyi), our users, or others. This includes exchanging information with other companies and organizations for the purposes of fraud detection and prevention, or addressing security or technical issues. For instance, if we identify someone posting illegal content or posing a serious risk to another user, we might report details to the appropriate authorities. If a user is involved in a dispute or injury during a sailing trip arranged through our Platform, we might provide relevant info to investigators or insurance companies evaluating the incident.
Such disclosures will be made in compliance with applicable laws. We will document any requests and our responses to them, ensuring we only provide what is required. Our commitment is to protect your privacy while also fulfilling our legal responsibilities and protecting our community.
5.4 Business Transfers
As SailsSearch grows and evolves, we may consider corporate transactions such as mergers, acquisitions, investments, or asset sales. If we undergo a business transition (for example, if Ivan Lebedynskyi forms a company to take over Sails Search, or if SailsSearch is acquired by or merged with another organization), your personal data may be among the assets transferred to or shared with the involved parties. In such an event:
- We will ensure that any successor entity or new owner is bound by terms substantially consistent with this Privacy Policy with respect to your personal information. They will be required to handle your data in the same spirit of privacy and security.
- We will notify users (for example, via email or a prominent notice on our website) of any such change in ownership or control of personal data, as well as any choices you may have as a result. For instance, if the new owner plans to materially change how your data is used, you would be given an opportunity to consent or opt out.
- If you do not wish to continue with the service under the new entity, you may request deletion of your data (subject to any legal requirements to retain it).
Please note, since SailsSearch is currently operated by an individual, a business transfer could involve transferring operations to a newly formed company owned by the founder, or selling the concept to another company. In any scenario, we remain committed to protecting your privacy through the transition.
5.5 Aggregate or De-Identified Information
We may share aggregated, anonymized, or de-identified information with third parties for various purposes, provided that such information cannot reasonably be used to identify you. For example, we could share statistics like "X% of our users are located in Europe" or "the average number of sailing trips per user is Y." This information will not contain personal data and is often used for industry analysis, research, or to showcase our user base in discussions with business partners. Since this data cannot identify any individual, it is not considered personal information and may be shared freely.
6. International Data Transfers
Because the Internet is a global environment, and Sails Search's users and service providers may be located around the world, your personal data may be transferred to and stored in countries other than your own. We want to be transparent about these international transfers and the safeguards we use to protect your data when it leaves your home country.
Location of Data Controller: SailsSearch is operated from Ukraine (by Ivan Lebedynskyi). Please be aware that if you are using our Services from outside Ukraine, data you provide will be transferred to Ukraine, where it will be processed. Ukraine's data protection laws may differ from those of your country (for example, if you are in the European Union, Ukraine is considered a "third country" without an adequacy decision from the EU Commission). However, we protect all personal data as described in this Policy, regardless of where it is stored or processed.
Service Provider Locations: Many of our third-party service providers (Section 5.1) operate in multiple jurisdictions. For example:
- Stripe is a global company (headquartered in the United States) -- if you are outside the U.S., your payment data might still be transferred to or through the U.S. for processing.
- Civo (our cloud host) may store data in data centers located in the European Union (e.g., Germany or UK), the United States, or other regions depending on how we configure our infrastructure. We strive to choose server locations strategically (for instance, we may host EU user data on EU servers). However, backups or failover might involve cross-border transfers (e.g., a backup copy stored in another region).
- Google and Facebook are U.S.-based companies, meaning analytics and advertising data typically flows to the U.S. (and possibly other locations where those companies have servers).
- Email or support services might route data through the U.S. or other regions (for instance, if we use an email delivery service based in the U.S.).
Safeguards for International Transfers: Whenever we transfer personal data out of your jurisdiction, we take steps to ensure appropriate protections are in place to safeguard your information in line with this Policy and applicable law. These measures include:
- Contractual Clauses: For transfers from the European Economic Area (EEA), UK, or Switzerland to countries not deemed to have adequate data protection (such as Ukraine or the U.S.), we rely on Standard Contractual Clauses (SCCs) or equivalent contractual protections approved by the European Commission (or UK ICO, as applicable). These are legal agreements between us and the recipient of the data, obligating them to protect the data to EU privacy standards. For example, our agreements with Stripe, Google, etc., include SCCs where needed.
- Consent and Necessity: In some cases, we may rely on your explicit consent to transfer data internationally (especially if the transfer is not otherwise covered by an adequacy mechanism or SCC). By using SailsSearch and providing us with data, you understand that it will be transferred to Ukraine and possibly other jurisdictions as necessary for the intended purposes. For EU users, we transfer data as necessary to perform our contract (provide the requested service -- e.g., you want to connect with a yacht owner in a different country, so data has to flow internationally) or as otherwise permitted by GDPR. Similarly, for Canadian users, data transfers to other countries are allowed as part of providing the service, but we emphasize that foreign governments may access data under their laws (PIPEDA requires notice that data in foreign jurisdictions may be accessible to law enforcement or national security authorities in those jurisdictions).
- Privacy Shield (Historical): While the EU-U.S. Privacy Shield framework was invalidated in 2020 for EU-U.S. transfers, some of our U.S. partners may still adhere to its principles or the newer EU-U.S. Data Privacy Framework (if/when approved). Regardless, we primarily rely on SCCs for compliance for now.
- Binding Corporate Rules & Certifications: Not directly applicable to SailsSearch (since we are not a large corporation with internal transfers), but some of our processors (like Google) may rely on additional mechanisms like binding corporate rules or approved certifications. We trust those processors to comply with the law and protect your data.
Access by Foreign Authorities: Please note that personal data stored or processed in a jurisdiction can be subject to the laws of that jurisdiction (for example, data stored in the U.S. might be lawfully accessed by U.S. authorities under certain conditions, data in Ukraine might be accessed by Ukrainian authorities, etc.). We may not be able to prevent or inform you of such access in all cases, but we will do our best to only partner with companies that have a track record of resisting overbroad government data requests and to be transparent where possible.
If you would like more information about our international data transfer practices, or if you need a copy of applicable transfer safeguards (such as the SCCs), you can contact us at the details provided below. We are committed to ensuring any cross-border data transfer complies with applicable data protection laws and that your rights remain protected.
7. Data Retention
We will retain your personal data for as long as necessary to fulfill the purposes we collected it for, including to provide you with the Services and to satisfy any legal, accounting, or reporting requirements. The exact duration we keep your information can vary depending on the type of data and the purpose of processing. Here is a general overview of our retention practices:
- Account Information: We keep the personal data associated with your account (like your profile, contact info, preferences, and content you have posted) for as long as your account is active. If you decide to delete your account or if your account is terminated, we will initiate the process to delete or anonymize your personal data. However, we may retain certain information after account deletion for legitimate reasons:
- Transaction Records: If you have completed transactions (for example, a subscription purchase or a booking), we may retain some data about those transactions for a certain period required by law (e.g., financial records for 7 years for tax/regulatory compliance in some jurisdictions).
- Backup and Archival: Your data might persist for a short period in our backups or archives (which are rotated and securely deleted periodically). We maintain backups to ensure we can recover from accidents, outages, or disasters, and those backups are not immediately purged when you delete data from our live systems. We will ensure that any personal data in backups is either deleted or securely isolated once it's no longer needed.
- Activity Logs: We may keep log files (recording actions like login attempts, changes made, messages sent) for a certain retention period even after account deletion for purposes like security (e.g., investigating fraud or abuse) and auditing. These logs typically do not include the full contents of communications, but metadata and system events. They are purged on a regular schedule as they become irrelevant.
- Enforcement and Disputes: If you or we delete your account while there is an unresolved issue, dispute, or investigation (for example, an open claim or a dispute with another user), we may retain the necessary information until the issue is resolved. Similarly, if we reasonably believe that you have violated our terms or engaged in unlawful activity, we may preserve relevant data as necessary for potential legal action, enforcement, or cooperation with authorities. Once those matters are resolved, we will delete the data if not needed further.
- User Communications: Content you have posted or sent to others (like messages or reviews) may remain visible to those other users or stored on our systems even after you delete your account or remove the data from your end. For instance, if you sent a message to another user, that user might still see the message in their inbox, and it might remain on our servers for that other user's use. Reviews you wrote might remain published (we can mark them as from a "former user" or anonymize if needed). We generally can't pull back content that was already shared with or copied by other users. However, we can disassociate such content from your identity upon your account deletion (so, for example, your name might no longer be shown next to old reviews).
- Marketing Data: If you have signed up for newsletters or given consent for marketing emails, we will retain your contact details for marketing purposes until you opt out or unsubscribe from marketing. Once you unsubscribe, we will stop sending you marketing communications, but we may keep your contact info on a "suppression list" to ensure we honor your opt-out (to avoid accidentally emailing you again).
- Cookies and Tracking Data: Cookie data is retained as per the cookie's defined lifespan. For example, some cookies (like Google Analytics) may persist for 24 months unless cleared, while others may last only for the session. We respect any deletion or preference signals from your browser; if you clear cookies, those are gone from your device (though our backend logs of events remain as per usual retention). Data derived from cookies that is stored on our side (like analytics records) is typically aggregated; raw analytics logs might be retained for a period (e.g., 14 months by Google Analytics by default, which we may adjust).
- Push Notifications Data: If you are using our mobile app, we maintain your device push token to send notifications as long as you have the app installed and haven't turned off notifications. If you log out or uninstall the app, we may purge the associated push token.
Once the retention period expires or the purpose for collecting the data has been achieved, we will either securely delete or anonymize your personal data, or if deletion or anonymization is not feasible (for example, if data is stored in long-term backups), then we will securely store and isolate the data and protect it from further use until deletion is possible.
Anonymization: In some cases, instead of fully deleting data, we may anonymize it so it can no longer be associated with you. For example, we might convert a detailed usage history into aggregated trends for internal analysis. When we anonymize data, we ensure that the information can no longer reasonably identify any individual.
If you have any specific questions about our data retention practices for a particular type of information, you can contact us for more details. We also handle data deletion requests under Your Rights (Section 9) -- for instance, if you request erasure of your data, we will follow those legal obligations and our internal deletion protocols.
8. Data Security
We take the security of your personal data very seriously. We implement a variety of technical and organizational safeguards designed to protect your information from unauthorized access, use, alteration, and destruction. However, please be aware that no method of transmitting data over the internet or storing data is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security. Below are some of the measures we take to secure your data and recommendations for what you can do:
8.1 Our Security Measures
- Encryption: We use encryption to protect data in transit and at rest. Our website is served over HTTPS (HyperText Transfer Protocol Secure), which means data transmitted between your browser/app and our servers is encrypted using TLS (Transport Layer Security). This helps prevent eavesdropping on the network. Sensitive fields (like passwords and payment details) are further encrypted or tokenized. For example, as noted, passwords are stored hashed (using strong cryptographic hash functions with salt) and payment information is handled by Stripe (which is PCI-DSS compliant).
- Access Controls: We limit access to personal data to those employees, contractors, and service providers who need to know that information to perform their duties. Ivan Lebedynskyi, as the owner-operator, along with any authorized team members or contractors, will have access only to the data necessary for administration and support. All personnel with such access are bound by confidentiality obligations. We also use authentication controls like passwords and (where possible) multi-factor authentication for our internal systems to reduce the chance of unauthorized internal access.
- Security Testing and Maintenance: We keep our software and infrastructure updated to protect against vulnerabilities. This includes applying security patches to our servers, dependencies, and libraries in a timely manner. We may perform periodic security audits, code reviews, and, if feasible, penetration testing (either internally or by engaging experts) to identify and fix potential security weaknesses.
- Network and System Security: Our servers are protected by firewalls and monitoring tools to detect and block unauthorized access attempts. We employ measures to prevent common web attacks (like SQL injection, XSS, CSRF) via secure coding practices and security tools. Data is segmented so that one user generally cannot access another user's data. We also back up data regularly and have disaster recovery plans in case of system failures. Backups are encrypted and stored in secure locations.
- Monitoring: We monitor our systems for suspicious activity and have alerting in place for potential breaches or anomalies. If we detect unusual patterns (such as an unusual number of failed logins, or large exports of data), we investigate promptly.
- Third-Party Security: We choose reputable third-party service providers with strong security track records. For example, Stripe is known for secure payment handling, and Civo's data centers have physical and electronic security measures. We have agreements in place that require service providers to implement appropriate security measures. We also try to ensure that any development of the Platform follows industry best practices for security.
8.2 User Responsibilities for Security
While we work hard on our end to safeguard your data, security is a shared responsibility. Here's what you can do to help protect your information:
- Choose a Strong Password: When creating an account, use a unique, complex password that is not easily guessable. Avoid using the same password on other services. We recommend a mix of letters (upper and lower case), numbers, and symbols.
- Protect Your Login Credentials: Do not share your password with anyone. SailsSearch will never ask you for your password via email or chat. Be cautious of phishing attempts -- always ensure that you are on our official website or app when logging in. If someone else has access to your login or account (for instance, if you are on a shared computer), remember to log out and close the browser.
- Update Devices and Software: Keep your computer, phone, and any browsers or apps updated with the latest security patches. Outdated software can have vulnerabilities that put your data at risk. Also use antivirus or security software if appropriate.
- Enable Security Features: If we introduce additional security features (like two-factor authentication for login, if available), we encourage you to use them. This adds an extra layer of protection by requiring a second verification (like a code sent to your phone) when logging in.
- Be Careful with Public Networks: When accessing SailsSearch on a public Wi-Fi network (e.g., at a café or airport), be aware that these networks may be insecure. Avoid conducting sensitive transactions on public Wi-Fi unless you use a VPN or other security measures. Ensure the URL is HTTPS to reduce risk of interception.
- Report Security Issues: If you suspect any unauthorized access to your account or notice any unusual activity (such as unfamiliar devices in your account session history, if provided, or strange emails purporting to be from Sails Search), please notify us immediately. We will work with you to secure your account and investigate if needed. Also, if you discover a vulnerability or security issue in our Platform, we encourage responsible disclosure. Contact us at our support or privacy email with details, and we will address the issue promptly.
8.3 Data Breach Procedures
Despite best efforts, if a data breach (security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data) were to occur, we have a response plan:
- We will contain and assess the breach immediately, taking steps to mitigate any damage (for example, shutting down unauthorized access, isolating affected systems, changing access credentials).
- We will investigate to understand the scope of data involved and the affected individuals.
- If the breach is likely to result in a high risk to your rights and freedoms (for example, if sensitive information or financial data was exposed), we will inform the affected users without undue delay and provide information on what happened and what measures we are taking. We will also provide recommendations for you to protect yourself (like resetting passwords or monitoring financial accounts, as relevant).
- We will fulfill any legal notification obligations. For instance, for EU users, we will report certain breaches to the relevant Data Protection Authority within 72 hours if required by GDPR. Similarly, for users in other regions, we'll comply with breach notification laws (e.g., various U.S. state laws, Canadian laws, etc.) as applicable.
- Post-incident, we will review and improve our security practices to prevent future incidents, addressing any root causes found.
In summary, while we cannot promise that breaches will never occur, we can assure you that we treat personal data security as a top priority and will act swiftly and transparently in the event of an incident.
9. Your Rights and Choices
You have rights regarding your personal data. SailsSearch is committed to respecting and facilitating your rights under applicable data protection laws (such as GDPR, CCPA, LGPD, PIPEDA, and others). Below, we outline the rights you have and how you can exercise them. Please note that these rights are not absolute and may be subject to certain exceptions or limitations (for example, we might not be able to delete all data if we are required to keep it for legal reasons, or we might decline a request if it jeopardizes others' privacy). We will explain any such limitations if we have to deny a request.
9.1 Right to Access Your Information
You have the right to request access to the personal data we hold about you, often called a Subject Access Request. This means you can ask us to confirm if we are processing your personal data and, if so, provide you with a copy of that data as well as details on how we use it.
- How to Access: You can request a copy of your information by contacting us (see Contact Us section). To help us fulfill your request, please specify what information or processing activities you are interested in. We may need to verify your identity (to ensure we don't give your data to someone else). Typically, we will provide the data in a structured, commonly used electronic format.
- Response Time: We will respond to access requests as soon as possible, and within the time frame required by law. Under GDPR, we aim for within 1 month; under CCPA, within 45 days (with possible extension by another 45 days if necessary). We will inform you if we need an extension or if for some reason we cannot fulfill your request (with reasons, subject to legal restrictions).
- What You'll Get: We will provide the personal data we have about you in our records. This may include data from your profile, account details, usage logs tied to you, communications, etc., as required. Note that certain data might not be included if it doesn't qualify as "personal data" (like purely anonymous data) or if it involves other individuals' data that can't be separated.
9.2 Right to Rectification (Correction)
It is important that the personal information we have is accurate and up-to-date. You have the right to request correction of any personal data that is inaccurate, and to have incomplete data completed.
- Self-Service: Many profile or account fields can be edited by you directly when you log into your account (e.g., you can update your contact info, profile details, etc.). We encourage you to keep your information current.
- Requesting Corrections: If you find information that you cannot change yourself or that you believe is incorrect in our systems (for example, an internal identifier, or old data that we still have), you can contact us with a request to correct or update it. We may ask for documentation or verification in some cases (e.g., proof of correct date of birth if it's critical). We will make the corrections as soon as practicable and let you know when done. If we for some reason cannot action a requested correction, we will explain why (e.g., if we believe the data is correct and there's a disagreement, or if the data in question was provided by a third party, etc.).
- Completing Data: If some data is incomplete, you have the right to provide supplementary information to complete it. For instance, if your profile missed an important detail and you want it reflected in our records, let us know.
9.3 Right to Deletion (Right to be Forgotten)
You have the right to request deletion of your personal data in certain circumstances, often known as the "right to be forgotten." We will honor deletion requests to the extent we are required to do so and as outlined below:
- When Can You Delete: You can request that we delete your personal data if:
- The data is no longer necessary for the purposes it was collected or processed (for example, if you no longer use our Services and we don't have a legal need to keep the data).
- You have withdrawn your consent (in cases where consent was the legal basis) and we have no other legal ground to continue processing.
- You have objected to processing based on legitimate interests (see 9.5 below) and we do not have an overriding legitimate ground to continue.
- We processed your data unlawfully or in violation of privacy laws.
- There is a legal obligation under applicable law for us to erase your data.
- How to Request Deletion: The easiest way to delete a lot of your data is by deleting your account via your account settings (if such an option is provided). This will initiate the process to remove your personal info from our active user database. If that is not available or you prefer, you can send us a deletion request by contacting us via email or mail (see Contact Us). Please clearly state that you want your personal data deleted and specify if there are particular data sets you're concerned about, if not the whole account.
- Scope of Deletion: Upon a valid request, we will erase your personal data from our systems (with the exceptions noted below). Your account will be deactivated and then permanently deleted in our next purge cycle. As noted in Section 7 (Data Retention), some information might not be immediately deleted: e.g., data in backups (which will be overwritten eventually), information we are required to keep for a bit longer for legal/tax/regulatory reasons, or information you shared that others have (like messages you sent). We will isolate such data and keep it securely until deletion is possible. Also, note that public content you have posted (like reviews) might be anonymized rather than completely removed (e.g., the text of a review may stay, but we can remove your name from it). We'll let you know specifically what we can delete and what we must retain when responding to your request.
- Confirmation: We will confirm to you once we have deleted the requested data (or the account).
- When Deletion May Be Denied or Delayed: In some cases, we may refuse the deletion request if an exception applies. For example, GDPR and other laws allow refusal if processing is necessary for freedom of expression, compliance with a legal obligation, or establishment/defense of legal claims. If that's the case, we will inform you of the reason. Under CCPA, you have a right to deletion subject to exemptions (e.g., we may retain data needed to complete a transaction, detect security incidents, or for internal uses aligned with your expectations). We will apply those accordingly for California residents.
- Reactivation: If your account is deleted, typically it's irreversible -- you would need to create a new account to use our service again. In some cases, if you contact us quickly after deletion, we might be able to still recover it (during a short grace period), but we cannot guarantee that.
9.4 Right to Restrict Processing
Under certain conditions (mainly under GDPR and similar laws), you have the right to request the restriction of processing of your personal data. "Restriction" means that while we will store your data, we will temporarily pause any other processing of it. You might exercise this right if, for example, you have contested the accuracy of your data and want us to verify it, or you have objected to processing (see 9.5) and we are considering that objection.
- When You Can Restrict: You can ask us to restrict processing if:
- You believe the personal data we have is inaccurate, and you want us to verify or correct it before continuing processing.
- The processing is unlawful but you do not want a full deletion (perhaps because you need us to keep the data for some reason).
- We no longer need the data for our purposes, but you need it for establishment, exercise, or defense of legal claims.
- You have objected to processing (9.5) and we are evaluating whether our legitimate grounds override yours.
- Effect of Restriction: If processing is restricted, we will mark the data and ensure it is only processed for limited purposes (storage, with your consent, for legal claims, or to protect rights of others) as allowed by law. For example, if you challenge the accuracy of some record, we may suspend using that record in any decision-making until it's verified.
- How to Request: Contact us and explain the circumstances and which data you want restricted. We may ask for clarification or the reason so we can properly evaluate the request.
- Notification: We will inform you when we have either complied with your restriction request or if we lift a restriction (e.g., after resolving your issue).
9.5 Right to Object to Processing
You have the right to object to our processing of your personal data in certain scenarios. This mainly applies to:
- Processing based on legitimate interests, and
- Processing for direct marketing purposes.
Legitimate Interests Objection: If we are processing your data on the basis of a legitimate interest (see Section 3) and you feel our processing impacts your rights or freedoms unfairly, you can object. When you object, we will review the reasons for your objection and the context of our processing. We will then either:
- Cease the processing in question, or
- Demonstrate to you compelling legitimate grounds for the processing that override your rights, or that the processing is needed for legal claims.
Practically, an example could be: You object to us using some of your data for analytics because you consider it intrusive. We will consider if we can accommodate your objection, perhaps by excluding your data from our analytics, versus our need to use it.
Direct Marketing Objection: If you object to processing your data for direct marketing, we will stop using your data for that purpose immediately. This is an absolute right in many jurisdictions (meaning we cannot refuse it). Direct marketing includes things like sending promotional emails or targeted advertising. The easiest way to exercise this right is:
- Unsubscribe from emails: Click the unsubscribe link in any marketing email. This automatically opts you out of further marketing emails.
- Opt-out in settings: If our app/website offers account settings to disable marketing communications or targeted ads, use those.
- Ad Preferences: As described, you can also adjust preferences on platforms like Google/Facebook to not see personalized ads from us.
- Or simply contact us and say you object to marketing -- we will remove you from all marketing lists.
Even if you opt out of direct marketing, you may still receive administrative or transactional communications from us (e.g., service announcements, billing info, etc., which are not promotional).
9.6 Right to Data Portability
The right to data portability allows you to obtain and reuse the personal data you have provided to us for your own purposes across different services. This right applies when:
- The data in question is personal data that you provided to us (actively and knowingly, or through your use of the service), and
- The processing is based on your consent or on a contract, and is carried out by automated means.
If you request data portability, we will provide you with your personal data in a structured, commonly used, machine-readable format (for example, a CSV or JSON file) that you can then use with other services if you wish. Where feasible and if you request, we may also directly transmit the data to another data controller (another company) at your direction, if it's technically achievable.
For instance, if you want to obtain a copy of all profile information and transaction history you gave us, to import into another platform, you can request this. Note that portability does not apply to data that is a result of our analysis or processing (like internal notes, or derived analytics) if it was not provided by you. It primarily covers raw data you gave, plus observed data like activity logs related to your use.
To exercise portability, contact us specifying which data you'd like in portable format. We will authenticate you and provide the file (typically electronically via email or secure download link).
9.7 Rights Relating to Automated Decision-Making
SailsSearch currently does not make any decisions about you that have a legal or similarly significant effect solely by automated means (i.e., without any human involvement) as defined under GDPR Article 22. For example, we do not have automated processes that approve or reject something with legal effect (such as automated credit approval or hiring decisions) without human review.
However, we do use algorithms in the service (for instance, matching you with suggested trips or crew based on profile data), and we may use automated filtering for moderation as described. These may affect your experience (e.g., what results you see), but they do not typically produce legal effects on you.
If you believe we are engaging in automated decision-making that significantly affects you, you have the right to:
- Request human intervention,
- Express your point of view, and
- Contest the decision.
We will then have a human review the automated decision and consider whether it was appropriate, providing you with an explanation.
9.8 California Privacy Rights (for California Residents)
If you are a resident of California, you have specific privacy rights under the CCPA/CPRA and other California laws:
- Right to Know (Access): You can request that we disclose to you (up to twice in a 12-month period) the following information covering the 12 months prior to your request:
- The categories of personal information we collected about you.
- The categories of sources from which the personal information was collected.
- The business or commercial purpose for collecting (or, if applicable, selling or sharing) the personal information.
- The categories of third parties to whom we disclosed personal information.
- The specific pieces of personal information we collected about you.
- If we disclosed your personal info for a business purpose: a list of disclosures identifying the personal information categories that each category of recipient obtained.
- (CPRA) If applicable, information about sensitive personal information collected, and whether we sold or shared any personal information (and if so, categories of PI and third parties --- however, SailsSearch does not sell your personal information, so in our case this would be not applicable other than confirming no sale).
We have largely provided the categories of data and purposes in this Privacy Policy (see Section 1 and 2), but you can request a formal report.
- Right to Delete: Largely the same as discussed in 9.3. California residents can request deletion of personal information we have collected from them, with similar exceptions (e.g., we may keep data necessary to complete a transaction, for security, legal compliance, etc.). We will explain any denial in terms of those exceptions.
- Right to Correct: Under CPRA (effective 2023), California residents have the right to request correction of inaccurate personal information we maintain about them, taking into account the nature of the personal information and the purposes of processing. This aligns with the rectification right in 9.2.
- Right to Opt-Out of Sale/Sharing: CCPA gives consumers the right to opt-out of the "sale" of personal information. "Sale" is broadly defined to include some data sharing. However, we do not sell personal information for monetary consideration. We also do not share personal information for cross-context behavioral advertising except as described (we might use cookies for advertising, which you can opt out of via cookie settings). If we ever engaged in selling or sharing personal info in the legal sense, we would implement a "Do Not Sell or Share My Personal Information" link. As of now, any advertising-related sharing we do can be controlled by cookie opt-outs (Section 4). If you have concerns, you can still formally notify us not to sell/share your data, and we will honor it (even though we don't do so beyond the described cookie/analytics usage).
- Right of Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we won't deny you services, charge you different prices, or provide a lesser quality of service just because you exercised your privacy rights. However, note that if the exercise of your rights means that we no longer have certain data, some features might not function (for example, if you ask us to delete all your data, you can't use the Platform since it requires some personal info). But we won't impose punitive effects.
- Shine the Light (California Civil Code § 1798.83): California's "Shine the Light" law allows residents to ask for information about personal data shared with third parties for those third parties' direct marketing purposes. We do not disclose personal data to third parties for their own direct marketing without your consent. If you want to make a Shine the Light inquiry, you can contact us as well.
Exercising California Rights: To exercise any of these rights, you (or your authorized agent) may contact us using the information in Contact Us. For verification, if you have an account, we may ask you to verify via login or confirmation of certain account details. If you don't have an account, we might ask for information like email, or other identifier we have on file, and perhaps a declaration that you are who you claim. If you use an agent, we may require proof of their authorization and also directly confirm with you (to prevent fraud).
We will respond to verifiable requests within the timeframe required by law (generally within 45 days, potentially extended by another 45 days with notice). The information provided will cover the 12-month period preceding the request, or as required by law. Some newer CPRA rights (like certain detail disclosures) might cover information collected beyond 12 months (we will comply as mandated).
9.9 Brazilian LGPD Rights
If you are in Brazil, LGPD grants you rights similar to GDPR. They include:
- Confirmation of Processing: The right to ask if we process your personal data. (We confirm we do if you use the service.)
- Access: Similar to the access right above.
- Correction: Correct incomplete, inaccurate, or out-of-date data.
- Anonymization, Blocking, or Deletion: You can request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in noncompliance with LGPD.
- Portability: Upon regulation by the authority, request the transfer of your data to another service provider.
- Information about sharing: Right to know with which public and private entities we have shared data (already generally covered by our Section 5, but you can request more detail).
- Right to revoke consent: If we rely on consent, you can withdraw it (covered above).
- Right to petition: You can lodge a complaint with Brazil's National Data Protection Authority (ANPD).
- Refusal of consent consequences: If something requires consent, you have the right to know you can refuse and what consequences there are. (We typically only ask consent for optional features like marketing or precise location; refusal might mean you don't get those features, but we won't bar you from the service broadly.)
We handle these requests via the same process described. Brazilian users can email us in English or Portuguese (or Ukrainian/Russian, given our location, but English/Portuguese likely). We will strive to respond promptly and within LGPD's timelines.
9.10 Canadian Users
Under PIPEDA (and comparable provincial laws), Canadian users have rights to access and correct personal information. We have covered those above. If you are in Quebec, the Act Respecting the Protection of Personal Information in the Private Sector also gives similar rights. We will accommodate to the best of our ability all such requests.
If you are unsatisfied, you may have the right to contact the Office of the Privacy Commissioner of Canada or your provincial Privacy Commissioner.
9.11 Exercising Your Rights / Contact for Requests
To exercise any of your rights described in this section, please reach out to us using the contact details provided in Section 12 (Contact Us) below. Please clearly state your request, which right you are invoking, and provide any relevant information that will help us process your request (for example, the specific data you want to access or delete). We may ask you to verify your identity before acting on a request, to ensure that these rights are exercised only by the rightful account holder or their authorized representative.
There is no fee for exercising your rights. However, if a request is unfounded or excessive (for instance, repetitive requests), we may either refuse to act or charge a reasonable fee as permitted by law. We will of course inform you of any such decision.
Finally, if you believe we have not addressed your privacy concerns adequately, you also have the right to lodge a complaint with a supervisory authority. For EU users, this would be the Data Protection Authority in your country of residence or where the issue occurred. For UK users, the ICO; for Canada, the Privacy Commissioner; for Brazil, the ANPD; for California, possibly the CA Attorney General's office. We would, however, appreciate the chance to address your concerns directly first.
10. Children's Privacy and Age Restrictions
Our Services are intended for adults only. You must be at least 18 years old to use Sails Search. We do not knowingly allow minors (persons under the age of 18) to register or use the Platform. We do not knowingly collect personal data from anyone under 18.
If you are under 18, please do not attempt to use our Services or send any personal information about yourself to us. If we learn that we have inadvertently collected personal information from a user under 18, we will take prompt steps to delete that information from our records.
In certain jurisdictions, the age of majority may be younger than 18 (for example, 16 in some parts of the EU for consent under GDPR, or 13 under U.S. COPPA for parental consent). However, Sails Search's policy is to restrict our platform to individuals 18 and over due to the nature of the services (sailing trips, possibly financial transactions, liability issues, etc.). We also explicitly exclude individuals under 16 in any case from providing personal data, in line with COPPA (Children's Online Privacy Protection Act in the U.S.) and similar laws.
Parental Responsibility: If you are a parent or guardian and you become aware that your minor child has created an account or otherwise provided us with personal information without your consent, please contact us immediately. We will work with you to remove the information and terminate the child's account.
No Child Users: We do not use children's personal data for any marketing or other purposes. Our onboarding flow attempts to verify age (for example, requiring date of birth) and we reserve the right to request proof of age if we suspect someone using the Platform is underage. Users who misrepresent their age to gain access will be in violation of our terms.
Teenagers 16-17: Even though our strict rule is 18+, if you are in a jurisdiction where you are considered an adult at 16 or 17, note that our service terms still contractually require you to be 18. We will treat anyone between 16-17 who signs up (circumventing our controls) as an unauthorized user and upon discovery we will suspend the account and delete data as appropriate. We emphasize again: only adults can use Sails Search.
By using the Platform, you represent that you meet the age requirement. We rely on this representation and do not verify age for every user, but we may take action if evidence arises to the contrary.
11. User Responsibilities and Disclaimer for User-Provided Content
SailsSearch is a platform that in part relies on user-provided information --- whether in profiles, listings, reviews, or chat communications. While we strive to foster a trustworthy community and we have measures (like verification of certain documents or moderation of content) in place, we largely rely on users to provide truthful and lawful information.
11.1 Accuracy and Legality of Information You Provide
When you provide personal data or any content on Sails Search, you are responsible for ensuring the information is correct, truthful, and complies with all applicable laws and our guidelines. This includes:
- Profile Details: Make sure that your profile information (identity, qualifications, etc.) is accurate and not misleading. Do not impersonate others or provide fake certificates.
- Content and Listings: Any descriptions, photos, or other content you post (such as a boat listing or a crew wanted ad) should be truthful and not violate any third-party rights (e.g., don't upload photos you don't have rights to, don't plagiarize descriptions).
- Chat Messages and Communications: Use the chat feature responsibly. Do not share illegal content or solicit anything unlawful. Do not harass others, use hate speech, or share obscene material. Remember that communications can be reported and we may review them as per our moderation policy.
- Sensitive Data: As mentioned, don't volunteer sensitive personal data about yourself or others that is not necessary. And never post personal data of others (like someone else's phone number, email, identification) without explicit permission -- doing so could violate privacy laws and our terms.
By providing content on our Platform, you confirm that you have the right to share that content and you give us the right to use it in connection with our service (as described in our Terms of Service). You also agree that the information you share can be viewed by others as described in this Policy (Section 5.2 on sharing with other users).
11.2 Founder/Operator Disclaimer
Disclaimer: While SailsSearch (Ivan Lebedynskyi) will make reasonable efforts to monitor and remove content that is clearly in violation of our policies or the law, we do not guarantee the truthfulness, completeness, or legality of user-provided data. The platform operator (and any founders or associates) hereby disclaims liability for any content posted by users that is inaccurate, misleading, defamatory, or illegal.
SailsSearch also specifically disclaims liability for:
- Any injuries, property damage, financial losses, or other adverse outcomes arising from the use of the Platform or in connection with interactions with other users.
- The accuracy or reliability of information provided by other users, including information about captain qualifications, yacht conditions, crew experience, or other material details.
- The quality, safety, or legality of any services or experiences offered through the Platform.
- Conflicts arising between users, even if those conflicts relate to the use of the Platform.
- Loss of data, system outages, communication failures, or other technical issues that may affect the use of the Platform.
- Any actions or inactions of third parties with whom a user may interact through the Platform.
To the maximum extent permitted by law, SailsSearch, its owner, employees, and partners are not liable to you or any third party for any direct, indirect, incidental, special, punitive, or consequential damages arising from the use of or inability to use the Platform.
In other words, users themselves are fully responsible for any data or content they contribute. If you rely on information provided by another user (for example, trusting someone's posted sailing credentials or a boat listing), you do so at your own risk. We encourage due diligence and, where possible, independent verification outside the platform (for instance, verifying a captain's license when you meet in person, etc.).
11.3 Moderation of User Content (Including Chat)
We have the right (but not the obligation) to monitor, screen, and moderate user-generated content, including profile details, postings, reviews, and chat messages, to ensure a safe environment and compliance with our policies and legal obligations. This may include automated filtering and human review as described earlier.
- Proactive Moderation: We may employ filters that flag certain keywords or patterns in chat (for example, to detect spam or exchange of contact info, which might be against platform rules if we require initial communication via the app). If flagged, such content might be reviewed by our team.
- Reactive Moderation: We also rely on user reports. If someone reports a chat message or a piece of content as inappropriate or violating terms, we may review the content and take action.
- Actions Taken: If content is found to violate our terms or this Privacy Policy (e.g., containing personal data that shouldn't be shared, harassment, hate speech, etc.), we may remove or edit the content, warn the user, or suspend/ban the user, depending on severity. For chat, we might delete specific offending messages or revoke a user's chat privileges for breaches.
- No Monitoring of Private Off-Platform Communications: Our moderation applies only to communications through our Platform. We do not monitor communications that occur outside of SailsSearch (e.g., if after connecting on our platform, you move to WhatsApp or email, that's outside our purview). However, please keep in mind our liability disclaimer --- if you take conversations off-platform, we can't assist in moderation or safety there.
11.4 No Liability for User Actions
SailsSearch serves as a venue to connect individuals for sailing-related activities. We cannot control what users do in real life or ensure the absolute safety or legality of their interactions. We disclaim responsibility for any harm, loss, or damage arising from user conduct. This includes:
- Financial loss or fraud caused by another user (e.g., a user failing to pay their share, or a scam listing). We urge you to use secure payment methods (like the Stripe integration) and not to send money outside of our approved methods.
- Personal injury or property damage that may occur during meet-ups or trips arranged through Sails Search. (We encourage users to have appropriate insurance and to follow all safety guidelines, but SailsSearch is not a party to actual charter contracts or sailing arrangements between users unless explicitly stated.)
- Misuse of data that one user obtains from another. For example, if you share your email with someone via chat and they spam you, or if someone you met through the platform violates your privacy or rights, we will of course take action on our platform (ban them if appropriate) but the platform operator is not liable for those user-to-user harms.
In summary, while we will do our best to enforce rules and facilitate a positive experience, users must take appropriate precautions and understand that they are engaging with others at their own risk. We provide tools and information (like user reviews and verification statuses) to help you make informed decisions.
If you have an issue with another user, you can report it to us and we will try to help (for instance, mediating a dispute or providing info to authorities if required by law). However, any legal claim or dispute that you may have arising from actions of another user will generally be between you and that user, not with SailsSearch or Ivan Lebedynskyi, unless we have breached our own obligations.
This section isn't meant to scare you -- only to clearly delineate that users hold the responsibility for the content they provide and their interactions, and Sails Search's role is primarily as a facilitator with limited liability under laws such as Section 230 of the U.S. Communications Decency Act (for user content) or similar provisions elsewhere.
11.5 User Acceptance of Responsibility
By using SailsSearch, you expressly agree that:
- You assume full responsibility for all actions and decisions taken based on information obtained through our Platform.
- You bear sole responsibility for any consequences arising from your use of the Platform, including financial losses, property damage, injuries, or other adverse outcomes.
- You accept all risks associated with using SailsSearch, including but not limited to: risks when booking yachts, communicating with other users, participating in regattas, or following advice presented on the Platform.
- You acknowledge that SailsSearch provides the Platform "as is" and "as available," without any warranties of fitness for a particular purpose.
- You understand that by continuing to use SailsSearch after accepting this Policy or after any changes to it, you accept all responsibility and agree to the terms set forth herein.
- You are responsible for verifying the accuracy and legality of any information provided by other users before relying on it.
- You will take appropriate safety precautions when engaging in sailing activities arranged through the Platform, including but not limited to checking weather conditions, ensuring proper safety equipment is available, and confirming the qualifications of captains or crew.
SailsSearch does not guarantee the outcomes of using the Platform and bears no responsibility for any conflicts, disputes, or negative consequences arising between Platform users or as a result of using services provided through the Platform.
11.6 Limitation of Financial Liability
To the maximum extent permitted by applicable law:
- The aggregate liability of SailsSearch (Ivan Lebedynskyi) to you for all claims related to the use or inability to use the Platform shall be limited to the amount you paid us for the use of SailsSearch in the 12 months preceding the claim, or €100 (one hundred euros), whichever is less.
- SailsSearch shall under no circumstances be liable for any indirect, incidental, special, exemplary, punitive, or consequential damages of any kind, including without limitation: loss of profits, data, goodwill, business interruption, computer failure or malfunction, even if SailsSearch has been advised of the possibility of such damages.
- No claims, actions, or proceedings arising out of or related to SailsSearch or this Privacy Policy may be brought by you more than one (1) year after the cause of such action arose.
The above limitations of liability will apply even if the above-stated remedies fail of their essential purpose.
11.7 Force Majeure
SailsSearch shall not be liable for any delay or failure to perform obligations directly or indirectly caused by circumstances beyond our reasonable control, including but not limited to:
- Natural disasters (floods, earthquakes, hurricanes, storms, etc.).
- Epidemics, pandemics, or other serious public health threats.
- Wars, terrorism, riots, or civil unrest.
- Governmental prohibitions, laws, or regulations.
- Failures in telecommunications, internet services, or hosting services.
- Other events beyond our reasonable control.
We will make reasonable efforts to minimize the impact of such events and resume performance of our obligations as soon as practically possible.
12. Subscription Services
SailsSearch may offer certain features or services on a subscription basis (e.g., a premium membership with advanced features, or a paid plan for professional skippers or yacht owners). This section explains how subscriptions are handled from a privacy perspective:
- Subscription Enrollment: If you choose to subscribe to a paid service, we will collect the necessary personal data to process your subscription. This typically includes your name, contact information, and payment details (processed by Stripe as noted). We might also assign your account a subscription status or tier internally. This information is used to grant you access to subscriber-only features and to manage billing.
- Auto-Renewal and Cancellation: Many subscriptions are auto-renewing (monthly or annually). We will use your payment data to charge you at each renewal period until you cancel. You will receive communications about your subscription, such as confirmation emails, renewal notices, or failed payment alerts. If you cancel, we might send a confirmation of cancellation and information on when your benefits expire. These communications are service-related, not promotional (unless we bundle them with an offer to rejoin, which would be optional).
- Third-Party App Stores: If the subscription is purchased via the Apple App Store or Google Play Store (using in-app purchase mechanisms), then the respective store's privacy policy and terms govern the financial transaction. We do not receive your raw payment info in that case (Apple/Google handle it). We might get information like whether the purchase was successful and the subscription term so we can activate your benefits. Be aware that Apple and Google may share some info with us (like a subscription ID, country, and maybe an email if you agreed) and they also have their own analytics on purchases. We adhere to their requirements for managing and protecting that data.
- Managing Subscription Data: Your subscription status (active/inactive, plan level, next billing date, etc.) is stored in our system. Support staff may access this to assist you. If you have an issue with billing, we may need to look at some of this data or verify with Stripe/Apple/Google.
- Refunds: If we process a refund, we'll use your info to the extent needed to record the refund and communicate with the payment provider.
- Usage of Subscriber Features: We may track how subscribers use premium features to ensure the feature is working and to gauge value (e.g., if a premium user has access to advanced search filters, we might see how often those are used). This helps us improve our offerings and is done under legitimate interest.
- End of Subscription: If your subscription lapses or you cancel, your account will revert to a free/basic tier. We retain your data as a user (as per normal retention), and keep a record that you were previously a subscriber (for accounting and to know eligibility for trials, etc.). If you want this data removed beyond normal retention, you'd follow account deletion steps. However, we likely need to keep some billing records for legal compliance for a certain time.
Importantly, subscription handling involves financial data which is sensitive. We rely on secure third parties and do not store full credit card info ourselves. Also, because subscriptions often involve recurring charges, we emphasize that you should keep your payment info up to date with Stripe/Apple/Google to avoid unintended lapses; from a privacy view, if your card expires, Stripe might update it via updater services from banks, which is beyond our control and done by Stripe in accordance with their privacy measures.
From a legal compliance standpoint, offering subscription services means we must comply with any relevant consumer protection laws (like offering clear cancellation methods -- Apple requires that we inform you that you can manage subscriptions via the App Store settings, for example; we will do so in our app UI rather than here). Privacy-wise, just know that any data specifically about your subscription is treated with the same care as other personal data.
We also comply with Apple's App Store and Google Play Store policies regarding subscriptions and data. For example, Apple's guidelines require us to have a privacy policy (this document) and to handle user data appropriately. They also require that certain features like account deletion are possible (which we provide via contacting support or through app if implemented). By adhering to this Privacy Policy, we ensure compliance with those store requirements.
13. Compliance with App Store & Google Play Policies
Our mobile applications must adhere to the privacy requirements set forth by the Apple App Store and Google Play Store. We want to explicitly state a few points to ensure transparency in line with those requirements:
- Data Usage Disclosure (App Privacy Details): On our App Store and Play Store listings, we provide a summary of what data is collected and how it's used (e.g., for app privacy "nutritional label" on iOS, and Data Safety section on Google Play). This Privacy Policy provides the full details of that data usage. We ensure that the information in this Policy is consistent with what we disclose on those platforms.
- Permissions: When you install our app, it may request certain device permissions (like access to camera, microphone, location, etc., as described in Section 1.2). We only request permissions that are necessary for the app's functionality, and we state the purpose (for example, the app may pop up a request like "SailsSearch would like to access your location to show you nearby sailing opportunities"). You have the choice to allow or deny each permission. If you change your mind, you can adjust permissions later in your device settings (under the SailsSearch app permissions). The app is designed to gracefully handle permission denials (though some features may be disabled). We do not access protected resources without your consent.
- No Excessive Collection: Apple and Google prohibit collecting data unnecessary for the app's functionality. We have outlined exactly what we collect (Section 1). We do not collect things like your phone's contacts, your SMS, or other data beyond what's described, unless we specifically ask and you consent (for example, if one day we add a "find friends" via contacts feature, it would be optional).
- No Sharing with Third Parties for Unexpected Reasons: We have disclosed our third-party sharing in Section 5. We do not send your data to any third party in a way that is not disclosed or that would violate Apple/Google policies (like selling it, or using it for something unrelated to the app's core purpose).
- Account Deletion: Both Apple and Google require that if a user wants to delete their account, they should have a way to do so. You can delete your account by contacting us at our support email or through the app/website interface (if provided). When we receive such a request, we will delete the account and personal data as described in Section 9.3. We may verify the request to ensure it's legitimate. Apple specifically requires that account deletion is an in-app option; if our current version of the app does not have a self-service delete button, we will implement it as soon as possible to meet that guideline. In the meantime, contacting support is an effective method.
- Data Security: We follow security guidelines from Apple and Google. This includes using secure methods for storing and transmitting data, implementing authentication mechanisms, securely managing user data, and promptly addressing vulnerabilities. We do not store sensitive data in insecure locations and apply industry-recommended encryption methods.
- Age Restrictions: As stated in Section 10, our app is intended for users 18 years and older. We do not knowingly collect data from minors and will delete such data if discovered. We comply with all relevant laws protecting children and adolescents.
- App Rating Policy: If our app requests ratings or reviews, we will use the native rating API provided by Apple/Google and will not manipulate this process or pressure users for positive ratings.
- Updates to Policy: If we update this Privacy Policy, we also update the App Store/Play Store listing info if needed to remain accurate. Apple and Google also require us to notify users of changes in how data is collected or used, especially if it's a material change. See Section 14 about changes to this Policy.
In summary, we align our practices with the expectations of these major platforms, which often go above and beyond basic legal requirements to ensure user clarity. By using our app, you can be confident that there are no hidden data practices outside what is documented here.
14. Links to Other Websites and Services
Our Services may contain links to third-party websites or services, such as external websites for sailing clubs, social media pages, or integrated third-party features (for example, a link to a Stripe checkout page, or an embedded Google Map for location selection). This Privacy Policy does not cover how those third-party sites/services process your data.
If you click on a link to an external site or service, you will be directed outside of our Platform, and any information you provide or actions you take on those external sites are governed by their own privacy policies and terms of use, not ours. For example, if you follow a link to a sailing school's website that was shared on our forum, any data collected on that site is subject to that site's privacy practices.
We are not responsible for the content, privacy practices, or data handling of third-party websites. We encourage you to review the privacy policy of every site you visit, especially before providing any personal information.
This includes social media features: if our app or site integrates with social media (like a "Share" button to Facebook or Twitter), and you use it, the interaction may allow the social media platform to collect information such as your IP address and which page you are visiting, and to set a cookie to enable the feature to function. Those interactions are governed by the privacy policy of the company providing them (Facebook, Twitter, etc.).
We do our best to only partner or integrate with reputable third parties, but we cannot control their policies. If you have any concerns about a link on our Services (such as if you suspect it is malicious or not what it claims to be), please notify us and avoid clicking it.
15. Additional Information for iOS Users (Apple App Store Requirements)
If you use our Services via an iOS application distributed through the Apple App Store, the following applies in accordance with Apple's privacy policies and App Tracking Transparency (ATT) framework:
- App Tracking Transparency (ATT): With your explicit permission, we may collect the Identifier for Advertisers (IDFA) from your iOS device to serve personalized ads or track app usage across other apps and websites. You will be asked to opt in when launching the app, and you can change your preferences in your iOS settings at any time. We respect your choice.
- Privacy "Nutrition Labels": As required by Apple, we have disclosed our data collection practices (e.g., user contact info, identifiers, usage data) in the App Store Privacy Label. These disclosures reflect the data types described in this Privacy Policy.
- Children and COPPA Compliance: Our Services are not directed to or intended for children under the age of 13. We do not knowingly collect personal data from users in this age group. If you believe we have collected data from a child under 13, please contact us immediately so we can remove it.
- Compliance with other Apple Requirements: We comply with all other Apple requirements, including but not limited to: handling user accounts and their data, processing payments (via StoreKit, if applicable), and interacting with ARKit, HealthKit, HomeKit, or other Apple frameworks (if used). We do not use Apple APIs in ways that are not approved by Apple.
- Subscription Model: If our app offers a subscription model through in-app purchases, these transactions are processed by Apple, and we comply with all Apple rules regarding subscriptions, including clear disclosure of price, duration, automatic renewal, and cancellation according to Apple guidelines. Users can always manage and cancel their subscriptions through their Apple ID settings.
This section supplements and does not replace the rest of this Privacy Policy. For any concerns specific to iOS use, please contact us using the details in the "Contact Us" section.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will not reduce your rights under this Privacy Policy without your consent. When we make changes, we will do the following:
- Effective Date Update: We will update the "Effective Date" at the top of this Policy to indicate when the changes take effect.
- Notification of Material Changes: If the changes are significant, we will provide a more prominent notice. This may include posting a notice on our website homepage or within the mobile app, sending you an email notification to the address associated with your account, or presenting an in-app alert. The notice will summarize the changes and, if required by law, we may ask for your consent to certain changes.
- Reviewing Changes: We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting your information. If you continue to use the SailsSearch Services after the updated Effective Date, it constitutes your acceptance of the revised Privacy Policy (to the extent permitted by law). If you do not agree to the changes, you should stop using the Services and may request deletion of your data.
For example, if in the future we introduce a new feature that involves new personal data processing (say, a feature that collects health info for insurance purposes on sailing trips --- just a hypothetical example), we would update the policy to describe that new data collection and use. We'd likely notify users in advance so they can make an informed decision about using that feature.
All changes will be posted on this page, and prior versions can be provided upon request. We keep an archive of previous Privacy Policy versions for regulatory compliance and will provide a copy if needed, or we might directly link an archive if changes are frequent.
By continuing to use SailsSearch after the Effective Date indicated at the beginning of this Policy, or after any notified updates, you explicitly agree to the terms of this Policy. You acknowledge that your consent is voluntary, informed, and unambiguous. If you do not agree with this Policy, you must stop using SailsSearch.
Use of SailsSearch implies your ongoing consent to the collection, use, and processing of your personal data in accordance with this Policy, as well as acknowledgment of all risks and responsibilities outlined in the Policy. You take responsibility for regularly checking this Policy for changes. Continued use after changes implies your consent to the updated terms.
17. Applicable Law and Jurisdiction
17.1 For European Users
If you are a user residing in the European Union or using our Services within the European Union:
- This Privacy Policy shall be governed by and construed in accordance with the laws of Spain, as well as applicable EU regulations, particularly the General Data Protection Regulation (GDPR).
- For matters related to privacy and data protection, the supervisory authority is the Spanish Data Protection Authority (Agencia Española de Protección de Datos).
- As an EU resident, you retain the right to lodge a complaint with your local data protection authority if you believe your data protection rights have been violated.
- If there is a conflict between this Privacy Policy and the GDPR or other applicable EU privacy legislation, the GDPR or other applicable legislation shall prevail.
17.2 For Non-European Users
If you are a user residing outside the European Union:
- This Privacy Policy shall be governed by and construed in accordance with the laws of Ukraine.
- The competent courts of Ukraine shall have exclusive jurisdiction over any dispute arising out of or in connection with this Privacy Policy.
17.3 International Operation
Regardless of your location, by using our Services, you acknowledge that SailsSearch is primarily operated from Ukraine. However, we strive to comply with applicable privacy laws in all regions where we operate, including the EU, the United States, Canada, and Brazil, as outlined in this Privacy Policy.
18. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please do not hesitate to contact us. We are here to help and address any issues you may have.
Data Controller: Ivan Lebedynskyi (as owner/operator of Sails Search)
Postal Address: 48 Chyhyrynska Street, apt. 16, Cherkasy, 18000, Ukraine
Email for Privacy Inquiries: privacy@sailssearch.com
Support Email: support@sailssearch.com
Website: https://sailssearch.com
We will endeavor to respond to your inquiries as quickly as possible, generally within a few business days. For formal data subject requests (as described in Section 9), please allow up to 30 days or the statutory period applicable in your jurisdiction.
Thank you for trusting SailsSearch with your personal data. We are committed to protecting your privacy and providing a safe and enjoyable platform for all your yachting and sailing adventures. Safe sailing!
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please do not hesitate to contact us. We are here to help