Privacy policy
What data we process, why, with whom, for how long, and your rights.
Version of 14 September 2026.
This page is a translation provided to help you read it. Only the French version is legally binding. Read the French version
1. Data controller
Hullteam, Jérôme Robinet, 987 route du Bladet, 47800 Lavergne. For any question about your data: contact@hullteam.com.
2. The data we process
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, password (hashed), display name, optional phone number | To log you in, write to you, and identify you to the people you share with | Performance of the contract |
| Boat: name, model, registration, engines, hours, equipment | To keep the log | Performance of the contract |
| Log: jobs, dates, amounts, professionals, fingerprints | To keep the log, calculate proof levels, seal and timestamp | Performance of the contract |
| Uploaded documents: invoices, receipts, photos, reports, manuals | To store them, read them to suggest an entry, and attach them to jobs | Performance of the contract |
| Conversations with your boat: your questions and the assistant’s answers | To let you pick up a conversation again and keep the thread from one message to the next; only you can see them | Performance of the contract |
| Ship’s registration document (French registration card or francisation deed) | To check that the boat is yours, a condition of the “verified” badge | Performance of the contract; kept in your safe, never published |
| Contact details of the professionals you give us (email or number) | To send them a confirmation request on your behalf | Legitimate interest (the professional can refuse in one click) |
| Introduction to a broker: your name, email, phone, message, budget and area (buyer); your name and your boat’s details (owner entrusting the sale) | To present your request to the brokerage concerned; it only receives your contact details if it accepts the introduction; then to follow up the commission due to Hullteam if a sale results | Performance of your request; legitimate interest for following up the commission |
| Survey request: your name, your email, the boat, the port and your message | To pass it on to the surveyor you chose on the surveyors map; if they do not yet receive requests through Hullteam, to keep it on hold for up to 5 days, then suggest other surveyors to you | Performance of your request |
| Payments: amount, date, Stripe identifiers, last digits of the card (held by Stripe) | To take payment, give you a receipt, and keep the accounts | Contract and legal obligation |
| Technical log: IP addresses, timestamps, errors | Security, troubleshooting | Legitimate interest |
| Audience measurement: pages viewed, referrer, device type — without cookies or individual identifiers | To know which pages are useful | Legitimate interest (exempt from consent) |
3. What others see
- The people you give access to a boat see what their role allows (co-owner, crew member, reader).
- A share link or a sale file shows anyone who has the link what you chose to include: the boat’s details, the log, the documents you ticked, your display name. Never your email address, your phone number, or your proof of ownership.
- A professional who receives a confirmation request sees the boat and the jobs concerned, not your contact details.
- A brokerage to which a request is presented first sees a summary without your contact details (first name, plans, budget, area, boat); it only receives your name, email and phone number if it accepts the introduction, within 48 hours.
- A marine surveyor you write to receives your name, your email and your message, and replies to you directly. While your request is on hold, they only know that a request is waiting for them (the boat and the port), without your contact details.
- The public fingerprint verification page only shows fingerprints, dates and timestamp tokens.
4. Our processors
We do not sell or rent your data. It is processed by the following providers, each bound by contract to use it only to provide the service to us:
| Provider | Role | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (Paris) |
| Vercel | Hosting of the application, cookieless audience measurement | United States, under the European Commission’s standard contractual clauses |
| Brevo | Sending transactional emails and text messages | France |
| Stripe | Card payment | Ireland and United States (Stripe is PCI-DSS certified; we never see your card) |
| Anthropic | Analysis of documents and answers to questions by artificial intelligence | United States, under standard contractual clauses; the content sent is not used to train models |
| OpenAI | Searching your documents: passages from your documents and the question you ask are sent to it to be converted into numerical representations, which are the only thing we then keep. Also used to read aloud the videos published by Hullteam. | United States, under standard contractual clauses; the content sent is not used to train models and is deleted from their systems within 30 days |
| FreeTSA (or a qualified timestamping service that succeeds it) | Timestamping of sealed fingerprints | Only receives fingerprints, never personal data |
| Recherche d’entreprises API (French State) | Checking that the businesses issuing invoices exist | France; only receives the SIRET number or the business name |
| Sentry | Reporting of technical errors | European Union (Germany) |
5. For how long
- Your account, your log and your documents: for as long as your account exists. After deletion, the boats of which you were the sole owner are deleted, and their files purged within 30 days.
- A log transferred to a buyer belongs to them: it stays with them, with the jobs and documents you chose to pass on.
- Your conversations with your boat: until you delete them (each one is deleted in one click in the chat panel), and at most for as long as your account exists.
- Introductions to brokers: the protection period (twelve months) plus twenty-four months, the time needed to record a sale and the commission arising from it.
- Payments: ten years (accounting obligation), with no link to your identity once your account is deleted.
- Quote requests: three years after the last activity; your contact details, messages and questions are then erased.
- Survey requests: your name and message are erased after 5 days if the request was not passed on to the surveyor, and after twelve months otherwise.
- Technical logs, including the log of calls to artificial intelligence: twelve months. The content of the emails we sent you: twelve months.
- Published fingerprints and timestamp tokens: without limit — they contain no personal data and guarantee the files already issued.
6. Cookies
Hullteam only sets the cookies strictly necessary for the service to work: those that keep you logged in. No advertising cookies, no third-party trackers, no audience measurement cookies — audience measurement is done without cookies and without individual identifiers, which exempts it from a consent banner under the guidelines of the CNIL (the French data protection authority). Stripe may set its own cookies on its payment page, under its own responsibility.
7. Your rights
You can access your data, correct it, have it erased, ask for a copy (portability), object to processing based on our legitimate interest, or restrict its use. Most of these actions can be done directly in the application (boat details, My account, account deletion); the copy of your data can be downloaded from My account, under “My data”. For anything else, write to contact@hullteam.com; we reply within one month. You can also refer the matter to the CNIL, the French data protection authority (cnil.fr).
8. Security
Passwords are hashed, exchanges are encrypted, files are stored in a private space accessible through signed, time-limited links, and every access to the database is filtered by row-level rules. Sealed jobs are chained and timestamped by a third party, which makes any rewriting detectable. No system is infallible: in the event of an incident affecting your data, we will inform you within the legal time limits.
9. Minors
The service is intended for adults.
10. Changes
This policy may change along with the service. The version in force is dated at the top of the page; any substantial change will be announced to you by email.