Privacy Policy

yachtscanr is operated by yachtscanr Ltd, a company registered in England & Wales (company number 17349090), with its registered office at Suite E, Astra Business Centre, Preston, PR2 5AP.

We pay the UK Information Commissioner's Office (ICO) data-protection fee.

We are the data controller for the personal data of people who request access and of our own account holders — for example a surveyor's name, email and professional membership. Where a surveyor enters personal data about their own clients into a survey (such as a client's name, contact details or address), the surveyor is the controller of that data and yachtscanr acts as their processor, handling it only to provide the service. The terms governing that processing are set out in Section 16 of our Terms of Service.

Contact: [email protected]

We collect the following categories of personal data:

Access requests. If you ask for an invitation we store what you send, email a copy to our support inbox, and email you a confirmation. We do not create an account until we invite you and you complete registration. You can ask us to delete a request at any time by writing to [email protected].

Under UK GDPR, we process your data on the following legal bases:

• Contract performance — providing the service once you have an account (survey management, report generation, your own invoicing). Deciding an invitation from an access request is processing at your request before a contract (UK GDPR Article 6(1)(b)).
• Legitimate interests — keeping accounts secure (signed-in devices and new-device alerts); running AI features you ask for. You can object at any time.
• Legal obligation — retaining transaction records as required by UK tax law.
• Consent — product news email if you tick the box when you create an account (see Section 12); contributing anonymised CPD data to industry benchmarks; and any other Settings → Privacy & Consent toggles that say they need consent. You may withdraw at any time.

The CPD tracking feature records your professional development activities, including activity title, provider, category, hours, points, and any uploaded completion certificates. This data is stored privately on your account and is never shared with third parties or professional bodies without your explicit action.

Industry benchmarks (consent-based). If you opt in via Settings → Privacy & Consent, your anonymised CPD data (hours by category and year; no names, providers, or certificates) may be aggregated to generate industry-wide benchmarks visible to other yachtscanr surveyors. No personally identifiable information is included in these aggregates. You can withdraw consent at any time and your data will be excluded from future benchmark calculations.

The legal basis for this processing is your explicit consent (UK GDPR Article 6(1)(a)). The date your consent was given or withdrawn is recorded on your account.

We use the following third-party service providers to operate the platform. Each receives only the minimum data necessary for the function it performs. Each provider name links to that company's own privacy policy — we encourage you to review how they handle data.

Each provider operates under its own privacy policy and terms and processes the data we supply under a data-processing agreement (DPA), acting on our documented instructions. For the AI providers that receive survey content: we have an executed DPA with OpenAI OpCo, LLC (including the UK Addendum to the EU Standard Contractual Clauses), and we use Anthropic on their Commercial Terms, which incorporate their DPA and UK Addendum, on the yachtscanr Ltd API organisation. We do not opt in to having either provider train models on that content. You can ask for confirmation of those arrangements at [email protected].

Sharing between users (marketplace). A commissioner marketplace is not part of this invitation period. If we later enable it, we will share only what is needed to connect the two sides (a surveyor's name, credentials, location and contact details to a commissioner they quote or work with, and request details to surveyors) and we will tell you before that starts. Until then we do not share your profile with commissioners.

We will never sell your personal data to any third party, and we never use it for advertising or share it with data brokers.

How we keep your data protected: we share only the minimum data necessary with each provider; we require a data-processing agreement with every provider; we host our primary database and core infrastructure in the UK/EU region; data is encrypted in transit (HTTPS/TLS); and access is limited to what is needed to run and support the service.

Some of the service providers listed above are based outside the UK, primarily in the United States (for example our AI, transcription and email providers — and, if we later take payment, Stripe). This means some personal data — including survey content, audio notes, or client details you enter — may be transferred to and processed in countries whose data-protection laws differ from those of the UK.

Whenever we transfer personal data outside the UK, we do so under one of the safeguards permitted by UK GDPR:

• Transfers to providers certified under the UK Extension to the EU–US Data Privacy Framework;
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
• Transfers to a country or sector recognised by the UK Government as providing an adequate level of protection.

For Anthropic and OpenAI, the safeguard we rely on is the UK Addendum to the EU Standard Contractual Clauses in each provider's DPA (OpenAI: executed with yachtscanr Ltd; Anthropic: incorporated in their Commercial Terms for our API account). Other overseas providers are bound by a DPA that permits them to process the data only on our documented instructions. You can request details of the specific safeguard applied to any transfer by emailing [email protected].

All survey data, media files (such as photos and audio), and account information are stored on secure, encrypted cloud server infrastructure using industry-standard database systems. All data transmitted between your device and our servers is protected using HTTPS/TLS encryption.

Account passwords are securely hashed using bcrypt prior to storage and are never stored in plain text. When you log in, we use session tokens (stored securely in browser cookies or local app storage) to maintain your authenticated session. These tokens automatically expire after 30 days or when you manually sign out. For more details, see Section 9.

We retain your data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except for limited categories of records we are required or entitled to retain for longer:

• Issued survey reports and their associated inspection records — including any GPS, weather snapshots and place name saved on that survey — are retained for 6 years from the date of issue, reflecting professional record-keeping standards (ISO 9001) and the limitation period for potential claims, after which they are deleted.
• Financial and transaction records are retained for 7 years, as required by UK tax law.

Draft (unissued) reports, photos and audio on those drafts, signed-in device records, AI chat history and your other account content are deleted as part of the 30-day account deletion. AI chat is limited to the last 20 turns per session.

Access requests. We keep a pending or invited request until we invite you, you register, you ask us to delete it, or 12 months have passed, whichever comes first. If we decline a request we delete it within 12 months, or sooner if you ask. Once you create an account the request is linked to that account and then follows account retention.

yachtscanr does not use advertising or tracking cookies. We do use a small number of strictly necessary stores on your device:

• Sign-in cookie (ys_token) — an httpOnly cookie set when you sign in, so the browser can stay signed in without exposing the token to page scripts. It lasts 30 days or until you sign out. It is essential to using the signed-in product; it is not set until you sign in.
• Local storage — a copy of the sign-in token for the web and native apps, your theme and other preferences, and a record that you have seen the cookie notice. This stays on the device.
• IndexedDB — on iOS, Android and Windows the app caches survey data for offline use. It lives on the device and syncs to our servers when connectivity returns.

Because these stores are strictly necessary to run the service (or live only on your device), we do not ask for cookie consent beyond telling you they exist. The notice on public pages links here.

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your account and associated data
• Restriction — ask us to limit how we process your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email [email protected]. We will respond within 30 days.

yachtscanr uses AI to assist you — for example drafting report text, suggesting notes, and estimating market value. These features are tools that support your professional judgement; you review, edit and decide everything. We do not make decisions that produce legal or similarly significant effects about you solely by automated means, and we do not carry out automated profiling of you.

Almost every email we send is a service message you need — email verification, invitations, new-device alerts, survey and invoice reminders, receipts, and notices about changes to the platform or these policies. Those go out because they are part of running the account or handling an access request.

Product news (occasional email when something useful ships on yachtscanr itself — not third-party marketing, and never your survey data) is an optional choice. When you create an account, we present a clearly labelled checkbox, unticked by default. You can choose to opt in, change your preferences in Settings at any time, or unsubscribe from any such email in one click. Opting out does not affect service messages.

We maintain appropriate measures to protect your data and to detect and respond to security incidents. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where required, and we will inform you without undue delay where the breach is likely to result in a high risk to you.

yachtscanr is a professional tool for marine surveyors, including those in training. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

We may update this policy as the platform evolves. Material changes will be notified by email to registered users.