Privacy
policy.

YachtCV ("we", "us", "our") is the operator of www.yachtcv.app, a phone-first CV tool for yacht crew. We are based in France and act as the data controller for the personal data described in this policy.

For any privacy question or to exercise your rights, contact us at support@yachtcv.app.

Account data: email address, password hash, and authentication metadata when you sign up or sign in.

CV content: identity, contact details, sea service, licences, references, languages, visas, medicals, photos, and any other fields you choose to enter. Sensitive items such as passport numbers, date of birth, phone, and references are private by default.

Usage data: aggregated and pseudonymised analytics about how the public CV is viewed (salted IP hash, user agent, referrer, country, timestamp). We do not log raw IP addresses.

Payment data: when you subscribe, payment information is collected directly by Stripe. We never receive or store full card numbers.

To provide the service: store and render your CV, generate share links and PDFs, and authenticate you across devices.

To process payments and manage subscriptions through Stripe.

To send transactional emails (sign-in links, password resets, billing receipts, important service updates).

To improve the product through aggregate, non-identifying analytics.

Performance of a contract — to operate the account, builder, and sharing features you sign up for.

Legitimate interest — to keep the service secure and improve it through aggregate analytics.

Consent — for any optional cookies or marketing communications you opt in to.

Legal obligation — to retain billing records as required by tax law.

Supabase (database, authentication, storage) — hosted in the EU.

Vercel (application hosting, PDF rendering, web analytics) — primary region EU-West.

Stripe (payment processing) — for subscription billing.

We do not sell your personal data. We do not share CV content with recruiters, agencies, or third parties unless you publish your CV publicly via your share link or QR code.

Account and CV data: kept while your account is active. You can delete your CV at any time from the dashboard. Deleting the account erases CV content within 30 days.

Billing records: retained for the period required by French tax law (typically 10 years).

Analytics events: retained for 24 months in aggregate form.

Under GDPR you have the right to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent at any time.

To exercise any of these rights, email support@yachtcv.app. We will respond within one month.

You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (www.cnil.fr).

All traffic is encrypted in transit (HTTPS, HSTS). Data at rest is encrypted by our infrastructure providers. Database access is restricted by row-level security policies, and anonymous visitors can only read the public fields you have explicitly chosen to expose.

We may update this policy as the product evolves. Material changes will be communicated by email and reflected in the "Last updated" date below.