Privacy Policy

Boatfront Ltd ("Boatfront", "we", "us", "our") is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) in the United Kingdom.

Contact: hello@boatfront.com

We collect the following categories of personal data:

• Account information: name, email address, password (stored as a cryptographic hash), and preferred currency.
• Profile information: if you register as a broker, your business name, location, phone number, and website.
• Listing content: vessel descriptions, specifications, photographs, and location information you submit.
• Communications: enquiry messages sent to sellers through the platform.
• Payment information: billing details processed via Stripe. We do not store card numbers — Stripe holds this data under their own privacy policy.
• Usage data: pages visited, search queries, listing views (recorded with a anonymised fingerprint — we do not store raw IP addresses), and browser/device type.
• Cookies and similar tracking technologies: see our Cookie Policy.

We process your personal data on the following legal bases under UK GDPR:

• Contract: to create and manage your account, process listing submissions, and facilitate transactions.
• Legitimate interests: to improve the Service, detect fraud, prevent misuse, and send service-related communications. We have assessed these interests against your rights and consider them proportionate.
• Legal obligation: where we are required by law to process or retain data (e.g., financial records for tax purposes).
• Consent: where we ask for your permission before processing — for example, sending marketing communications.

We use your personal data to:

• Create and administer your account.
• Publish and manage boat listings.
• Process payments and maintain financial records.
• Facilitate communication between buyers and sellers.
• Provide customer support.
• Detect and prevent fraud, spam, and other misuse.
• Improve the Service through analytics and user research.
• Send transactional emails (account verification, enquiry notifications, listing status updates).
• Send marketing communications where you have opted in, or where we have a legitimate interest in doing so for similar services (you can opt out at any time).
• Comply with legal and regulatory obligations.

We do not sell your personal data. We share it only in the following circumstances:

• Service providers: we share data with trusted third parties who help us operate the Service. These include Stripe (payments), Algolia (search), Cloudflare (content delivery and media storage), Mapbox (mapping), Neon/PostgreSQL (database hosting), and Vercel (platform hosting). All are bound by data processing agreements.
• Other users: when you submit a listing, your contact information may be shared with prospective buyers who send an enquiry through the platform.
• Legal requirements: we may disclose data if required by law, court order, or to protect the rights and safety of Boatfront, its users, or the public.
• Business transfers: if Boatfront is acquired, merged, or its assets transferred, your data may be transferred as part of that transaction. We will notify you before this occurs.

Some of our service providers (including Stripe, Algolia, Cloudflare, and Vercel) may process data outside the UK or EEA. Where this occurs, we ensure that appropriate safeguards are in place — such as UK adequacy regulations, Standard Contractual Clauses, or the UK International Data Transfer Agreement — to protect your data to a standard equivalent to UK GDPR.

We retain your personal data for as long as necessary to provide the Service and fulfil the purposes described in this policy. Specifically:

• Account data is retained for the life of your account and deleted within 90 days of account closure, unless we are legally required to retain it longer.
• Listing data is retained for 7 years after the listing expires or is deleted, for financial and legal record-keeping purposes.
• Usage and analytics data is retained for 13 months.
• Financial transaction records are retained for 6 years as required by HMRC.

Under UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): ask us to delete your data in certain circumstances.
• Right to restriction: ask us to restrict how we use your data while a complaint is investigated.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: we do not use solely automated processes to make decisions that significantly affect you.

To exercise any of these rights, contact us at hello@boatfront.com. We will respond within one calendar month. We may need to verify your identity before processing your request.

We use cookies and similar technologies to operate and improve the Service. For full details, see our Cookie Policy.

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the Service. The "last updated" date at the top of this page reflects when the policy was last revised.

If you are unhappy with how we handle your personal data, please contact us first at hello@boatfront.com — we will do our best to resolve any concern promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF