Privacy Policy

Placeholder pending legal review. This text is structured to match how YachtStock works today. It is not yet counsel-approved wording.

1. Who is responsible

YachtStock is the data controller for personal data processed through this website. Data is stored in the European Union.

2. What we collect

• Account data — email address, display name, password hash (managed by our authentication provider), company name if you give one, and whether you signed in with Google or Apple.
• Contributor profile data — bio, location, profile photo, payout details (Wise account name and email) and the signed contributor agreement, including the IP address and time of signature.
• Order data — items purchased, licence type, price, VAT country, order number and download history. Card details are handled by our payment processor and never reach our servers.
• Content and metadata — the photos and videos contributors upload, the metadata they enter, model releases, and file fingerprints (SHA-256 hashes) used to detect duplicates.
• Usage data — pages viewed, searches (query text and result count), assets viewed and favourited, cookie consent choices, IP address and browser type.
• Support and legal correspondence — content reports, buyout requests and emails you send us.

3. Why we process it

• To run the marketplace: accounts, uploads, review, purchases, delivery and re-downloads (performance of a contract).
• To pay contributors and keep financial records (legal obligation).
• To review submitted content, including automated technical checks and an AI relevance check on a thumbnail (legitimate interest in keeping the library on-topic and lawful).
• To send transactional email: order confirmations, download links, expiry reminders, review outcomes, sale notifications and, if you opt in, follow and brand alerts.
• To understand what buyers search for and cannot find, so contributors know what to shoot (legitimate interest; search logs are not linked to marketing).
• To comply with rights claims and legal requests.

4. Third-party services

We share data only with processors needed to run the service:

• Supabase (EU) — database and authentication.
• Cloudflare — file storage (R2) and image delivery.
• Mux — video encoding and streaming previews.
• Algolia — search index of live asset metadata (no personal data beyond contributor display names).
• Resend — transactional email.
• Fungies.io — payment processing and VAT as merchant of record.
• Wise — contributor payouts.
• Anthropic — receives a thumbnail image of submitted content for the automated relevance check; no personal account data is sent.
• Vercel — hosting.

5. Cookies

See the Cookie Policy. Essential cookies are always set; analytics and marketing cookies only with your consent.

6. How long we keep data

Account data for as long as your account exists. Order, licence and payout records for as long as tax law requires (typically 7–10 years). Content reports and legal correspondence for the life of the claim plus limitation periods. Search logs are aggregated after 12 months.

7. Your rights (GDPR)

You can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent at any time. You can also complain to your local data protection authority.

Right to deletion. Request account deletion from your account or by email. We soft-delete the account immediately, then purge personal data after the retention periods above. Licences already granted to buyers survive deletion; your name is removed from public pages.

8. Security

Data is encrypted in transit, stored in the EU, and protected by row-level access controls. Download links are signed and expire after 48 hours.

9. Contact

Placeholder: data protection contact address to be confirmed. Until then, use the reply-to address on any YachtStock email.