Privacy Policy

Docksy Global Ltd (“Docksy”, “we”, “us”) operates the Docksy platform at docksy.xyz (the “Platform”). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Platform.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and other applicable data protection laws. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

The data controller for personal data collected through the Platform is Docksy Global Ltd. For any privacy-related enquiries, you may contact us at marketplace@docksy.xyz.

We collect the following categories of personal data:

Account and identity data

• Full name, email address, and profile photo (provided during registration or imported from your authentication provider such as Google).
• Phone number, if you choose to provide it.
• Account role (Owner, Renter, or both).

Identity verification data

• Where you complete identity verification, your identity document and a selfie are captured and checked by Stripe Identity. Docksy does not receive or store the document image itself. We receive only the outcome of the check, the verified date of birth used to confirm you are 18 or over, and a verification status on your profile.
• If you intend to skipper a vessel yourself, any boating licence or certificate of competence you upload, together with its issuing authority, reference number, and expiry date, so our team can review it against the requirements of the listing.

Safety and experience data

• Completion and result of the on-platform safety training module, and the experience level you set on your profile, both of which determine which vessels you are permitted to book.

Support conversations

• Messages and any images you send to our in-app assistant (“Skip”), and any support case created from them. See section 6 for how these are processed.

Vessel and listing data (Owners)

• Vessel details: name, type, brand, model, year, capacity, location, description, and pricing.
• Vessel photos and documents (registration, insurance, certifications) uploaded to the Platform.

Booking and transaction data

• Booking request details: dates, number of guests, messages exchanged between parties.
• Rental agreement data: financial terms, signatures, document hashes, and agreement status.
• Payment information: transaction amounts, payment status, and payout details. Payment card numbers are processed and stored exclusively by our payment provider (Stripe) and are never stored on Docksy servers.

Condition documentation

• Pre-trip and post-trip vessel photos uploaded through the Platform for damage documentation purposes.

Technical and usage data

• IP address (recorded during agreement signing for audit purposes; partially masked in the agreement document).
• Browser type, device type, operating system, and screen resolution.
• Pages visited, referral source, and session duration.

We use your personal data for the following purposes:

• Providing the Platform: creating and managing your account, displaying listings, facilitating communication between Owners and Renters, and processing bookings and agreements.
• Payment processing: processing rental payments, calculating platform fees, and facilitating Owner payouts through our payment provider.
• Contract execution: generating rental agreements, recording digital signatures, and maintaining document integrity through cryptographic hashing.
• Dispute resolution: reviewing condition photos, messages, and agreement data in the event of a dispute between parties.
• Communication: sending transactional emails (booking confirmations, agreement notifications, payment receipts) and responding to support enquiries.
• Safety and security: detecting and preventing fraud, enforcing our Terms of Service, and protecting the rights and safety of our users.
• Platform improvement: analysing usage patterns (in aggregate and anonymised form) to improve the Platform’s features, performance, and user experience.
• Legal compliance: complying with applicable laws, regulations, and legal processes.

We process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)): processing necessary to fulfil our obligations under the Terms of Service and to facilitate rental agreements between users.
• Legitimate interests (Article 6(1)(f)): processing necessary for fraud prevention, platform security, service improvement, and dispute resolution, where these interests are not overridden by your data protection rights.
• Legal obligation (Article 6(1)(c)): processing required to comply with applicable laws, such as tax reporting or responding to lawful requests from authorities.
• Consent (Article 6(1)(a)): where we rely on your consent (for example, for marketing communications), you may withdraw consent at any time by contacting us or using the relevant opt-out mechanism.

We share your personal data only in the following circumstances:

• Between rental parties: when you enter into a booking or rental agreement, certain information (name, email, agreement details) is shared with the other party as necessary to complete the transaction.
• Payment provider (Stripe): payment and transaction data is shared with Stripe for the purpose of processing payments. Stripe operates as an independent data controller for payment data. See Stripe’s Privacy Policy for details.
• Infrastructure providers: we use Supabase for database and authentication services, and Vercel for hosting and privacy-friendly, cookieless usage analytics. These providers process data on our behalf under data processing agreements.
• Identity verification (Stripe Identity): where you verify your identity, your identity document and selfie are submitted directly to Stripe, which performs the check and returns only the result and your verified date of birth to us. Stripe acts as an independent data controller for identity data.
• Website analytics (Google): Google Analytics 4 receives anonymised information about the pages you view and the actions you take, along with technical identifiers such as an approximate IP address. We never send your name, email address, messages, account identifier, or any booking, agreement, or payment identifier to Google. Until you accept analytics it runs in a cookieless mode: nothing is stored on your device, no identifier persists between visits, and Google receives only an anonymous count of the page being viewed. Accepting allows a cookie to be set so that repeat visits can be recognised. Declining keeps it cookieless. Advertising and personalisation signals are switched off permanently in both cases, and cannot be enabled by accepting.
• Email delivery (Resend): transactional emails (booking, agreement, payment, and support notifications) are sent through Resend, which processes recipient names and email addresses on our behalf.
• Maps (Mapbox): when you view the marketplace map, your approximate location and technical request data are processed by Mapbox to render map tiles.
• Abuse prevention (Upstash): we use Upstash to rate-limit requests and prevent abuse, which involves processing your account identifier and IP address.
• AI support assistant (Anthropic): when you use our in-app support assistant (“Skip”), the messages and any images you send, together with relevant context about your bookings and agreements, are processed by Anthropic to generate responses. This data is not used to train Anthropic’s models. Do not share data in the assistant that you do not wish to be processed for this purpose.
• Legal requirements: we may disclose data where required by law, regulation, legal process, or enforceable governmental request.
• Business transfers: in the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity with prior notice to affected users.

We do not sell your personal data to third parties. We do not share your data with third-party advertisers.

We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy:

• Account data: retained for as long as your account is active and for 12 months after account deletion to allow for dispute resolution and legal obligations.
• Rental agreements and signatures: retained for 7 years after the rental end date for legal and regulatory compliance.
• Payment records: retained for 7 years in accordance with financial record-keeping requirements.
• Messages: retained for the lifetime of the associated booking request or agreement, plus 12 months.
• Condition photos: retained for 12 months after the rental end date, after which they are automatically deleted unless a dispute is pending.
• Technical logs: retained for up to 90 days for security and debugging purposes.

Under applicable data protection law (including the GDPR), you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of inaccurate or incomplete data.
• Right to erasure: you may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction: you may request that we restrict the processing of your data in certain circumstances.
• Right to data portability: you may request a machine-readable copy of the data you have provided to us.
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact us at marketplace@docksy.xyz. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Essential cookies keep you signed in, protect forms against cross-site request forgery, and remember display preferences such as dark mode. They are strictly necessary for the Platform to function and do not require consent.

Analytics is optional. Nothing in the optional group is loaded, and no analytics cookie is created, unless you accept it. Declining leaves the Platform fully functional.

We also use Vercel Analytics for anonymised, aggregated performance data such as page load times. It sets no cookies and identifies no one, so it runs regardless of your analytics choice.

Neither cookie above is set unless you accept analytics. Before that, and if you decline, Google Analytics still counts the page you are on but stores nothing on your device and cannot recognise you on a later visit.

We do not use Google Analytics for advertising, cross-site tracking, behavioural profiling, or audience building, and we do not share analytics data with advertisers. Where a booking is completed or refunded, we report the confirmed amount to Google Analytics from our servers so that revenue is counted once and accurately. That report carries the same anonymous identifier your browser already holds and no Docksy account identifier.

Manage analytics preferences

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers.
• Encryption at rest for database storage.
• Access control policies ensuring users can only access data they are authorised to view.
• Cryptographic verification to ensure agreement documents cannot be altered after signing.
• Access controls limiting employee access to personal data on a need-to-know basis.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your data may be processed in countries outside your country of residence, including the United States, where several of our providers operate (including Supabase, Vercel, Stripe, Resend, Mapbox, Upstash, Anthropic, and, where you have accepted analytics, Google). Where data is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify registered users by email or through the Platform. The “Last updated” date at the top of this page indicates when this policy was last revised.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at marketplace@docksy.xyz.