Privacy Policy

This Privacy Policy explains what personal information Floatplan collects when you use floatplanhq.com and the Floatplan app, how we use it, who we share it with, and the rights you have. Please read it alongside our Terms of Service. We have written this in plain language on purpose. If anything is unclear, contact us at hello@floatplanhq.com.

Who we are

Floatplan is operated by Floatplanhq(“Floatplan”, “we”, “us”, “our”), based in British Columbia, Canada. For privacy questions or to exercise your rights, contact our Privacy Officer:

• Email: hello@floatplanhq.com
• Mail: 201–1540 Burnaby St, Vancouver, BC V6G 1W9, Canada

We are the organization responsible for your personal information (the “data controller” under GDPR, and the organization accountable under Canada’s PIPEDA and Quebec’s Law 25).

Who this policy covers

This policy applies to everyone who uses Floatplan, wherever you are. Depending on where you live, specific laws give you specific rights — Canada’s PIPEDA, Quebec’s Law 25, the EU and UK GDPR, and California’s CCPA/CPRA. The sections below set out a single standard that meets all of them, plus region-specific rights where they apply.

Information we collect

• Account details— your name and email address when you create an account.
• Trip content you create— boats, routes, provisioning, expenses, messages, polls, ideas and notes that you and your crew add to a trip.
• Information about your crew— when you add a crew member to a trip you may include their name, role, travel and flight details, and contact information such as a phone number and email address (so the crew can be reached and costs split). You share this with us so we can provide the service. You are responsible for ensuring you are entitled to share it, and for letting your crew know their information appears in Floatplan.
• Sailing résumé details (optional)— if you use the résumé/charter feature, the profile you build may include your full name, date of birth, mailing address, phone number, sailing experience notes and a list of crew you have sailed with. You choose what to enter, and it is visible only to you unless you export or share it.
• Feedback you send— if you use the in-app “Something missing?” feedback button, we store your message along with your account email, the page you were on, and your browser’s user-agent string to help us reproduce and fix issues.
• Waitlist— if you join our waitlist, we store your email address and which page you signed up from.
• Usage and device data— basic analytics about how the site and app are used: pages viewed, referring source, approximate location (derived from IP address, not precise GPS), and device and browser type.

We do not intentionally collect sensitive categories of personal information (such as health, racial or ethnic origin, or precise geolocation). Please do not enter sensitive information into free-text fields.

How we use your information, and our legal basis

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded our use is reasonable and proportionate. You can object to this — see Your rights below.

Cookies and analytics

We use Google Analytics 4 to understand site traffic and improve the product. It sets cookies and processes usage data on our behalf.

• Non-essential and analytics cookies are set only after you agree through our cookie banner. You can change your choice at any time using the Cookie settings link (also in our footer).
• We honor the Global Privacy Control (GPC)browser signal as a valid opt-out of “sale” and “sharing” where applicable law recognizes it — if your browser sends GPC, analytics stays off unless you opt in.
• We have configured Google Analytics so that we do not sell or share your personal information for cross-context behavioral advertising (advertising storage and personalization are disabled), and Google processes the data as our service provider.

You can also use browser controls or Google’s own opt-out tools to limit analytics tracking.

Service providers we share data with

We rely on a small number of trusted providers to run Floatplan. Each is bound by contract or its own terms to protect your data and use it only to deliver its service.

• Supabase — authentication and database; stores your account and trip data.
• Vercel — hosts the site and processes requests to serve it.
• Anthropic — powers the AI Skipper. Your question and a short trip summary (boats, crew names/roles and dates, route and provisioning progress) are sent to generate an answer. We never send passwords, crew contact details, or other crews’ data. Under Anthropic’s commercial terms it does not use this to train its models.
• Google Analytics — usage analytics, as described above (only after consent).
• Google Fonts — serves the fonts used across the site; receives your IP address to deliver them.
• Map providers — OpenStreetMap, Esri and OpenSeaMap supply chart and satellite map tiles, loaded with the Leaflet library from a content-delivery network (Cloudflare). These receive your IP address and the map area you view; we send no account or trip data to them.
• Open-Meteo — weather and marine forecasts for a fixed British Virgin Islands location; no personal data is sent.
• Jitsi (8x8) — if your crew starts an in-app video call, the meeting runs on Jitsi’s service, which receives your IP address and anything you share on the call.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or sale of assets — in which case we will notify you and this policy will continue to apply.

International data transfers

Floatplan is operated from Canada, and some of our service providers process data in the United States and other countries. This means your personal information may be transferred outside your home country, including outside Canada, the EU, the UK, and the EEA. When we transfer personal information internationally, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), and we take steps to ensure your information receives a comparable level of protection. You can ask us for more detail at hello@floatplanhq.com.

Data retention

We keep your account and trip data for as long as your account is active. If you ask us to delete your account, we delete or anonymize your personal information within a reasonable period, except where we must keep certain records to meet legal, accounting, or security obligations. Backups are purged on a rolling schedule.

How we protect your information

We use reasonable technical and organizational measures to protect your personal information, including encryption in transit, access controls, and trusted infrastructure providers. No system is perfectly secure, so we cannot guarantee absolute security. If a data breach affects your personal information and is likely to create a risk to you, we will notify you and the relevant regulators as required by applicable law (including PIPEDA, Law 25, and GDPR).

Automated processing and the AI Skipper

The AI Skipper is an automated assistant. It provides suggestions and informationto help you plan — it does not make decisions that produce legal or similarly significant effects about you, and a human (you) always decides what to do with its output. We do not engage in solely automated decision-making of the kind restricted by GDPR Article 22 or Quebec’s Law 25.

Your rights

You can access, correct, export, or delete your information at any time by contacting us at hello@floatplanhq.com. You can also withdraw consent where we rely on it, and object to processing based on our legitimate interests. We will respond within the timeframe required by applicable law (generally 30 to 45 days). We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

If you are in the EU or UK (GDPR), you have the right to access, rectify, erase, restrict, and object to processing; the right to data portability; the right to withdraw consent; and the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

If you are in Canada (PIPEDA) or Quebec (Law 25), you have the right to access and correct your information, to withdraw consent, and to data portability. You may complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d’accès à l’information (CAI).

If you are in California (CCPA/CPRA), you have the right to know what personal information we collect and how we use it; to delete it; to correct it; to opt out of any “sale” or “sharing” (we do neither); to limit use of sensitive personal information (we do not use it for purposes that trigger this right); and to be free from discrimination for exercising these rights. You may use an authorized agent to make a request on your behalf.

Children

Floatplan is not directed to children. We do not knowingly collect personal information from children under 16 in the EU/UK or under 13 in Canada and the US. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the product grows. Material changes will be reflected by the “last updated” date above, and we will give you additional notice where required by law. Your continued use of Floatplan after a change means you accept the updated policy.

Contact

Questions or requests: hello@floatplanhq.com, or by mail at 201–1540 Burnaby St, Vancouver, BC V6G 1W9, Canada.