Privacy Policy
Short version: We use your data to run a free yacht crew jobs board. Your profile is private by default: employers see it when you apply to their job, or when you choose to appear in crew search. We do not sell data, show ads or use trackers. You can delete your account at any time.
1. Who we are
MY Yacht Crew (my-yachtcrew.com) is run by MY Yacht, based in Italy. MY Yacht is the data controller for the personal data described in this policy.
Contact for anything about your data: enquiries@my-yacht.app
2. What data we collect
- Account: email address, password (stored only in hashed form), name and phone number. We use the phone number to call you once and check your account before we approve it.
- Crew profile: photo, main role, location, nationality, languages, availability, salary and contract wishes, about me, hobbies, LinkedIn and Instagram links, work rights (EU, US B1/B2, Australian visa), yacht experience, certificates with expiry dates, references and your CV. Only your name is required; everything else is up to you.
- Bio answers: smoking, vaping and visible tattoos. These questions are optional. If you leave them unanswered, nothing is shown.
- Applications: the jobs you apply to, your cover letter and the status the employer sets.
- Job alerts: departments, keywords and how often you want emails.
- Employers: company or yacht name, contact details, the job posts you write and notes from our verification call.
- Technical data: IP address, browser type and error logs, kept by our hosting providers for security.
We do not collect payment details, and we do not use advertising or analytics trackers.
Medical certificates. If you add a medical certificate such as ENG1, we store its name, its expiry date and, if you upload it, the file. This can reveal health information, so we process it only with your explicit consent, which you give by adding it. You can withdraw consent at any time by deleting the certificate.
3. Why we use it (legal basis)
- Your account, profile and applications: to provide the service you signed up for (contract, GDPR Art. 6(1)(b)).
- Crew search visibility, bio answers and job alert emails: your consent (Art. 6(1)(a)). You can withdraw it at any time in your account; this does not affect what happened before.
- Medical certificates: your explicit consent (Art. 9(2)(a)).
- Checking new accounts and employers, security and preventing misuse: our legitimate interests (Art. 6(1)(f)).
4. Who can see your data
- Employers you apply to see your profile, CV, certificates, references, bio answers and cover letter for that job.
- Crew search: your profile is private by default. If you switch on “Show my profile to verified employers”, employers we have approved can find you and see your name, photo, role, location, nationality, languages, experience, certificates, work rights, bio answers, CV and email address, and can contact you. Switch it off at any time in your account and you leave the search straight away.
- Employers are responsible too: an employer who receives your application or contacts you uses your data for their own recruitment and must protect it under data protection law.
- Job posts you publish as an employer are public.
- We never sell your data or pass it to marketers or recruitment agencies.
5. References
References you add (name, role, yacht, contact) are shown to employers you apply to. Please ask your referees first. A referee can ask us to remove their details at any time.
6. Service providers and transfers
These providers process data for us under data processing agreements:
- Supabase — database, file storage and sign-in (EU region).
- Cloudflare — website hosting and protection against attacks.
- Resend — sending our emails.
- Anthropic — AI job search, AI-written job descriptions and the AI match summary an employer can request. Only the text needed for that task is sent.
- Google — only if you choose to sign in with Google.
Some of these providers are based in the USA or may access data from there. These transfers rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
7. AI features
Employers can ask for an AI summary of how a candidate’s profile matches their job. It is advice only: a person always makes the decision. We make no automated decisions that have legal or similarly significant effects on you.
8. How long we keep your data
- Your account and profile: until you delete your account.
- Accounts with no sign-in for 24 months are deleted after an email warning.
- Access requests we turn down are deleted after 6 months.
- Job posts close after 30 days, stay in the employer’s archive for 12 months and are then deleted.
- Applications to a closed job are deleted 90 days after the job closes.
- Server and security logs are kept for up to 30 days.
- Deleted data leaves our database backups within 30 days.
9. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the data we hold about you
- Rectification — correct your data (you can edit your profile at any time)
- Erasure — delete your account and data (Account → Profile → Delete account)
- Restriction — ask us to pause using your data
- Portability — receive your data in a machine-readable format
- Objection — object to use based on our legitimate interests
- Withdraw consent — at any time, for anything based on consent
To use any of these rights, email us. We reply within one month; for complex requests we may need two more months and will tell you if so.
You can also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in the EU country where you live or work.
10. Storage in your browser
We do not use cookies for tracking. Your browser’s local storage keeps your sign-in session, your language choice and, during Google sign-in, a temporary marker. They are needed for the features you use, so no consent banner is required. Fonts are served from our own site, so no data goes to font providers.
11. Security
All data is sent over HTTPS. CVs, photos and certificates are kept in private storage and opened only through short-lived links. Database rules make sure each person can see only the data they are allowed to see. We review security regularly.
12. Age
MY Yacht Crew is for adults: you must be 18 or older to create an account. If you think someone under 18 has given us data, contact us and we will delete it.
13. Changes to this policy
We will tell registered users by email before material changes take effect. Where we rely on your consent, we will ask for it again.
14. Contact
For any privacy question or request:
- Email: enquiries@my-yacht.app
- Subject: Privacy Request