Privacy Policy

The data controller is M&P Generation 3.0 Limited, the company operating the platform The Boat Platform, accessible via the website theboatplatform.com.

• Registered office: 77 Camden Street Lower, Dublin, Dublin 2, D02 XE80, Ireland
• Registration number: IE04265511TH
• Email: info@theboatplatform.com

Depending on how the platform is used, we process the following categories of data:

• Registration and account data: name, email address, telephone number, and company name if applicable for "Agency" accounts.
• Listing data: descriptions, photos, prices, contact details provided by the user.
• Payment data: for paid plans, payment is processed directly by Stripe. We do not store complete card details on our servers: we only receive from Stripe the information necessary to manage the order and subscription.
• Browsing and technical data: IP address, browser and device type (user agent), pages visited, referral source. This data is received by our servers and infrastructure providers to provide the service, ensure its security, and prevent abuse. The IP address is also used on our servers solely to derive the country of origin. As described in the following section and in the Cookie Policy, the IP address and user agent are not transmitted to the analytics service.
• Images of the identity document and face, processed only upon voluntary request of the user for profile verification. The comparison constitutes processing of biometric data (Art. 9 GDPR) and is carried out on the basis of explicit consent collected prior to upload. The images are automatically deleted upon completion of verification, regardless of the outcome. If automatic deletion fails due to a technical error, the system alerts us and removal is carried out manually. In any case, you can write to us at info@theboatplatform.com to request confirmation.
• Contact details of nautical sector operators (e.g. charter companies, rental operators, tour organisers) processed for B2B direct marketing purposes: these are professional contact details, predominantly generic company inboxes (e.g. info@, bookings@), collected from public and professional sources such as operators' websites and publicly accessible industry directories or platforms.

• Provision of the service, account management, and publication of listings: performance of the contract (Art. 6.1.b GDPR).
• Management of payments and subscriptions for paid plans: performance of the contract (Art. 6.1.b GDPR).
• Sending service communications (registration confirmation, payment confirmation, listing notifications): performance of the contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR).
• Security, prevention of abuse, and technical monitoring of the service: legitimate interest in keeping the platform operational and secure (Art. 6.1.f GDPR).
• Statistical analysis of public page usage: events are collected without cookies, without browser scripts, and without any individual identifiers, and data that would allow a device to be recognised (IP address and user agent) is not transmitted to the analytics service. Events are minimised and used solely to derive aggregate statistics, without profiling. Details of the measures adopted are in the Cookie Policy.
• Logging of service events relating to the account (registration, publication of a listing, payment outcomes, access errors): performance of the contract and legitimate interest in identifying malfunctions that prevent users from using the service (Art. 6.1.b and 6.1.f GDPR).
• Compliance verification of listings prior to publication, via an automated process: performance of the contract and legitimate interest (Art. 6.1.b and 6.1.f GDPR). The user may request a review of the decision by writing to info@theboatplatform.com.
• Compliance with legal obligations (e.g. tax, accounting): legal obligation (Art. 6.1.c GDPR).
• Sending commercial communications by email to nautical sector operators to propose joining the platform as partners (B2B direct marketing): legitimate interest of the controller in promoting its service to potentially interested professional operators (Art. 6.1.f GDPR). The data subject may object at any time, free of charge, by replying STOP to any communication or by writing to info@theboatplatform.com: the contact details will no longer be used for direct marketing purposes and will be kept solely in a suppression list, necessary to comply with the objection.

To provide the service, we rely on third-party suppliers who process personal data on our behalf, in their capacity as data processors, based on specific data processing agreements (DPAs). The main ones are:

• Supabase: database, authentication, and storage of account and listing data.
• Vercel: website hosting and distribution (technical logs include the IP address).
• Stripe: payment processing for paid plans.
• Resend: sending transactional emails (confirmations and service notifications).
• PostHog: statistical analysis of website usage, on European infrastructure. Events relating to public pages are transmitted minimised and free of individual identifiers; events relating to registered accounts are associated with an internal user identifier.
• Upstash: management of request rate limits (rate limiting) for security purposes.
• Sentry: monitoring of application errors and critical events.
• Google: only if the user chooses to sign in via "Sign in with Google".
• Artificial intelligence system providers: listing compliance verification, profile verification upon user request, search and listing creation assistance features, production of editorial content, machine translation of blog articles at the reader's request.

Certain platform features make use of artificial intelligence systems for the purposes indicated in section 4. Human intervention is provided for in these features, and decisions concerning the user may be subject to review upon request. The data processed is limited to what is necessary for each individual purpose.

In particular, if you use natural language search, the text you enter is transmitted in full to the artificial intelligence system provider solely to extract the search criteria and return results to you. We encourage you not to enter personal data in that field. A copy of the text, subjected to an automated filter that removes recognisable contact details, is included in usage statistics: details are in the Cookie Policy.

Under the contractual terms agreed with the suppliers, transmitted data is not used for training their models.

Some suppliers may process data outside the European Union. In such cases, the transfer takes place in compliance with the GDPR, on the basis of adequacy decisions or Standard Contractual Clauses approved by the European Commission.

Account and listing data is retained for as long as the account is active. If the account is deleted, the associated data is deleted, except for data we must retain to comply with legal obligations (e.g. tax and accounting data relating to payments).

Public page statistics do not contain individual identifiers and are retained for the time necessary for historical traffic trend analysis, in accordance with the retention applied by the analytics service used.

Service events associated with a registered account are retained with the analytics service for the duration set by that service. In the event of account deletion, if you also wish these events to be removed, you can request this by writing to info@theboatplatform.com and we will act on it.

Technical logs from infrastructure providers, which include the IP address, are retained for the periods specified by the respective services for security and diagnostic purposes.

Contact details of operators collected for B2B direct marketing purposes are retained for a maximum of 12 months from collection or from the last relevant contact, unless objected to or deleted earlier. In the event of an objection (STOP), the contact detail is removed from active lists and retained solely in a suppression list, limited to the contact detail and the date of objection, for the time necessary to respect and document the objection itself.

Pursuant to Articles 15-22 of the GDPR, you have the right to: access your data, rectify it, obtain its erasure, restrict its processing, object to its processing, and request data portability. You may exercise these rights by writing to info@theboatplatform.com. To delete your account, you can also submit a request directly from your personal area.

You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

The website exclusively uses strictly necessary cookies required for its operation, set only after you sign in to your account. Usage statistics do not employ cookies or other tracking tools that access your device. For details, please consult the Cookie Policy.

To exercise your rights or for any questions about privacy, contact us at: info@theboatplatform.com