GDPR (EU/EEA) UK GDPR CCPA / CPRA LGPD POPIA PDPA (Thailand) KVKK (Turkey) nDSG (Switzerland)
ChurchHill Holding GmbH is the data controller within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable national data protection laws. For users in California: ChurchHill Holding GmbH is the “business” under the CCPA. For users in Brazil: the “controlador” under the LGPD.
Contact: ChurchHill Holding GmbH, Marktplatz 17, A-3470 Kirchberg am Wagram, Austria — FN 506575p, Landesgericht St. Pölten — VAT ATU74067635 — Managing Director: Ing. Sebastian Günther — planung@ep-kolar.at
App: Yachtlantis — yachtlantis.app · Country: Austria (EU Member State)
This privacy policy applies to the Yachtlantis web application (Progressive Web App), future native mobile applications, and all related services. It applies to users worldwide, including but not limited to:
User-provided boat information: name, manufacturer, model, year built, registration number, MMSI, home port, berth coordinates, engine data, tank capacities, anchor chain length, rode type.
Yachtlantis does NOT track your location in the background. GPS data is only collected when you explicitly:
GPS polling during Anchor Watch occurs every 2 minutes while the feature is active. You can revoke location permission at any time in your browser/device settings.
When you connect Victron VRM, energy data is retrieved: battery voltage, state of charge, solar yield, inverter status. VRM credentials are stored exclusively in your browser's local storage and are never transmitted to our servers.
Weather data is fetched via the Open-Meteo Marine API and Windy.com. Only your boat's home port coordinates are transmitted — no personal data.
When the Anchor Watch or trip view shows nearby vessels, AIS data is received via the aisstream.io WebSocket API. Only a geographic bounding box around your anchor or trip position is transmitted. AIS data is public maritime safety information broadcast by vessels.
Trip-encounter storage (third-party MMSIs): When you record a trip, the MMSI numbers, vessel names and positions of other passing vessels broadcast on AIS may be persisted in the ais_encounters database table. This is required to power the trip-replay feature, which lets you review which vessels were nearby during your voyage. These records are retained for a maximum of 90 days and then automatically purged by a scheduled pg_cron cleanup job.
MMSI numbers identify a vessel, not a natural person, but where a vessel is uniquely associated with an individual the data may qualify as personal data under GDPR Art. 4(1). Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) — preserving an accurate maritime traffic picture for your voyage record. You can opt out of this storage at any time by disabling AIS in Settings → AIS; with AIS disabled, no ais_encounters rows are written.
Automatically collected: IP address (anonymized), browser type, device type, access times. Used exclusively for technical operation and error resolution.
Yachtlantis does not sell or share your personal information with third parties for advertising. We do not use personal data for profiling or automated decision-making. California residents have the right to know, delete, and opt-out (see Section 8).
Processing is based on: consent (Art. 7, I), contract execution (Art. 7, V), and legitimate interest (Art. 7, IX). Brazilian users have rights under Art. 18 LGPD (see Section 8).
Processing is based on consent and contractual necessity under Sections 24-26 PDPA. Thai users have rights under Section 30 PDPA (see Section 8).
| Provider | Role | Location | DPA |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Frankfurt, Germany (EU) | Yes |
| Vercel Inc. | Web hosting and content delivery | EU Edge Network | Yes |
| Open-Meteo | Weather and marine data | No personal data transmitted | No |
| Windy.com (Windyty SE) | Embedded weather maps | No personal data transmitted | No |
| Victron Energy BV | VRM Portal — energy/battery data (optional) | Credentials stored locally only | No |
| aisstream.io | AIS vessel tracking (Anchor Watch) | No personal data transmitted | No |
| OpenStreetMap / OpenSeaMap | Map tiles for Anchor Watch | No personal data transmitted | No |
| Apple / Google | Payment processing via App Store (planned) | Apple: Ireland (EU), Google: EU/US | Yes |
| RevenueCat Inc. | Subscription receipt validation (App Store / Play Store) | USA (EU-US Data Privacy Framework certified) | Yes |
Data Processing Agreements (DPA/AVV) per Art. 28 GDPR are in place with Supabase and Vercel. All providers maintain EU Standard Contractual Clauses (SCCs) for any third-country transfers.
Your data is primarily stored in Frankfurt, Germany (EU) on Supabase servers. Some processing may occur on Vercel's EU edge network. For transfers outside the EU/EEA:
For UK users: transfers are governed by the UK International Data Transfer Agreement (IDTA). For Swiss users: transfers comply with the Swiss-US Data Privacy Framework.
ais_encounters, then auto-purged by pg_cron. Disable AIS in Settings to opt out.Users in South Africa (POPIA), Thailand (PDPA), Turkey (KVKK), and all other countries enjoy equivalent rights as described above. We apply GDPR-standard rights globally as our minimum baseline.
To exercise any of these rights, contact: planung@ep-kolar.at
You have the right to lodge a complaint with a data protection authority (Art. 77 GDPR):
Yachtlantis uses no tracking cookies, no third-party analytics (no Google Analytics, no Facebook Pixel, no advertising trackers), and no third-party font CDNs. All webfonts (Outfit, JetBrains Mono) are self-hosted and bundled with the application — your IP address is never transmitted to Google Fonts (fonts.googleapis.com / fonts.gstatic.com) or any other font provider, in compliance with LG München I, 3 O 17493/20 (Jan 2022) and Schrems II.
We store only technically necessary data in your browser's Local Storage:
This data is essential for app operation (GDPR Art. 6(1)(f), ePrivacy Directive Art. 5(3) exemption for strictly necessary storage).
In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay (Art. 34 GDPR). For CCPA: California residents will be notified per Civil Code § 1798.82.
Yachtlantis is not directed at persons under 16 years of age. We do not knowingly collect personal data from children under 16 (GDPR Art. 8) or under 13 (COPPA, USA). If we discover that data from a child has been collected, it will be deleted immediately.
Yachtlantis does not use automated decision-making or profiling as defined in Art. 22 GDPR. No AI or algorithms make decisions about you. All data processing serves solely the purpose of providing the app's features as described.
Yachtlantis does not sell your personal information to any third party. We do not share personal data for cross-context behavioral advertising. There is no “opt-out” needed because we never sell or share data in the first place.
We may update this privacy policy to reflect changes in legal requirements or app features. The current version is always available within the app. For material changes, you will be asked to review and accept the updated policy upon your next login. Your continued use of Yachtlantis after accepting the updated policy constitutes your agreement to the changes.
Yachtlantis is provided “as is” and “as available” without warranties of any kind, either express or implied. To the fullest extent permitted by applicable law:
This limitation applies to the maximum extent permitted under applicable law, including but not limited to Austrian law (§§ 1295ff ABGB), German law (§§ 280ff BGB), EU consumer protection directives, and the laws of any other jurisdiction from which the app is accessed.
By using Yachtlantis, you agree to the following terms:
By creating an account and using Yachtlantis, you confirm that you have read, understood, and agree to this Privacy Policy, the Limitation of Liability, and the Terms of Use. You may withdraw your consent at any time by deleting your account (Profile → Delete Account) or by contacting planung@ep-kolar.at. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
ChurchHill Holding GmbH, Marktplatz 17, A-3470 Kirchberg am Wagram, Austria — planung@ep-kolar.at