Privacy Policy

Boatfront Ltd ("Boatfront", "we", "us", "our") is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) in the United Kingdom, registration number ZC228222.

Contact: hello@boatfront.com

We collect the following categories of personal data:

• Account information: name, email address, password (stored as a cryptographic hash), and preferred currency.
• Profile information: if you register as a broker, your business name, location, phone number, and website.
• Listing content: vessel descriptions, specifications, photographs, and location information you submit.
• Communications: enquiry messages sent to sellers through the platform.
• Payment information: billing details processed via Stripe. We do not store card numbers — Stripe holds this data under their own privacy policy.
• Usage data: pages visited, search queries, listing and article views (recorded with a fingerprint: a keyed hash of your IP address and browser that changes every day, so it cannot follow you from one day to the next), and browser/device type.
• Third-party analytics: we use Google Analytics 4 (loaded only after you accept) and Vercel Web Analytics (cookieless, aggregated). See our Cookie Policy for the specific cookies and storage used.
• IP addresses: we record the IP address from which your account was created and from which you submit forms (enquiries, password resets, verification re-sends). This is used solely to detect and prevent spam, fraud, and abuse, and to enforce rate limits. Raw IPs are retained for 90 days and then anonymised — see Section 7.
• Cookies and similar tracking technologies: see our Cookie Policy.

We process your personal data on the following legal bases under UK GDPR:

• Contract: to create and manage your account, process listing submissions, and facilitate transactions.
• Legitimate interests: to improve the Service, detect fraud, prevent misuse, and send service-related communications. We have assessed these interests against your rights and consider them proportionate.
• Legal obligation: where we are required by law to process or retain data (e.g., financial records for tax purposes).
• Consent: where we ask for your permission before processing — for example, sending marketing communications.

We use your personal data to:

• Create and administer your account.
• Publish and manage boat listings.
• Process payments and maintain financial records.
• Facilitate communication between buyers and sellers.
• Provide customer support.
• Detect and prevent fraud, spam, and other misuse.
• Improve the Service through analytics and user research.
• Send transactional emails (account verification, enquiry notifications, listing status updates).
• Send marketing communications where you have opted in, or where we have a legitimate interest in doing so for similar services (you can opt out at any time).
• Comply with legal and regulatory obligations.

We do not sell your personal data. We share it only in the following circumstances:

• Service providers: we share data with companies that help us run the Service, acting on our instructions under data processing terms: Stripe (payments), Algolia (search), Cloudflare (content delivery and media storage), Mapbox (maps, when you open an interactive map), Neon (database hosting), Vercel (hosting, Web Analytics, Speed Insights and bot protection), Sentry (error monitoring, and session replay only with your consent), Google (sign-in with Google if you choose it, and Analytics only after you accept analytics cookies), Resend (email), and Anthropic through Vercel's AI Gateway (reading manufacturers' published pages for the Yacht Guide; no personal data is sent).
• Sellers and brokers: when you send an enquiry, your name, email address, phone number (if you give one) and message go to the seller or broker of that boat so they can reply. They are responsible for their own copy, as a separate controller. When you place a listing, buyers see the name you sell under (a private seller's first name and initial), not your email address or phone number; you see theirs when they enquire.
• Legal requirements: we may disclose data if required by law, court order, or to protect the rights and safety of Boatfront, its users, or the public.
• Business transfers: if Boatfront is acquired, merged, or its assets transferred, your data may be transferred as part of that transaction. We will notify you before this occurs.

Some of our service providers (including Stripe, Algolia, Cloudflare, and Vercel) may process data outside the UK or EEA. Where this occurs, we ensure that appropriate safeguards are in place — such as UK adequacy regulations, Standard Contractual Clauses, or the UK International Data Transfer Agreement — to protect your data to a standard equivalent to UK GDPR.

We retain your personal data for as long as necessary to provide the Service and fulfil the purposes described in this policy. Specifically:

• Account data is kept for the life of your account. When you close your account we keep it for 90 days in case you change your mind, then remove your personal details; what must stay (billing records, and anything you published) stays attributed to "Deleted user".
• Unverified accounts (where the verification email is never confirmed) are deleted automatically 7 days after sign-up.
• Enquiries, and sellers' notes on them, are anonymised 24 months after the last message.
• Newsletter and launch sign-ups that never became an account are anonymised 24 months after our last contact.
• Support requests are anonymised 24 months after they are resolved.
• Unused sign-in, verification and password-reset links are deleted when they expire.
• When a listing is removed, its photos and floorplans are deleted after 12 months, and its description and exact location after 7 years; its billing record stays.
• Listing and article view records keep their fingerprint for 90 days. Google Analytics, used only with your consent, keeps data for at most 14 months.
• IP addresses associated with sign-ups, enquiries, and security-sensitive actions are retained in raw form for 90 days for fraud and abuse prevention. After 90 days they are anonymised (the last octet is zeroed for IPv4; the lower portion is zeroed for IPv6) so the row can no longer identify an individual.
• Financial transaction records are retained for 6 years as required by HMRC.

Under UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): ask us to delete your data in certain circumstances.
• Right to restriction: ask us to restrict how we use your data while a complaint is investigated.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: we do not use solely automated processes to make decisions that significantly affect you.

To exercise any of these rights, contact us at hello@boatfront.com. We will respond within one calendar month. We may need to verify your identity before processing your request.

We use cookies and similar technologies to operate and improve the Service. For full details, see our Cookie Policy.

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the Service. The "last updated" date at the top of this page reflects when the policy was last revised.

If you are unhappy with how we handle your personal data, please contact us first at hello@boatfront.com — we will do our best to resolve any concern promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF