Privacy Policy

Account, trip organisation and shared expenses

For your account, we process the contact and sign-in information you provide, your account ID and language preferences. The app displays insurance policies, documents and messages associated with you. Session information and cached trip content may also be stored on your device.

Trip organisation uses your entries about boats, trips, crew, routes and lists. Shared expenses include amounts, expenses and income, dates, descriptions, participants, allocations and settlement entries. Shared content is available to authorised participants in the relevant trip. These data support organising and settling your trip expenses.

We process data needed for the app functions and policy services you request to perform our agreement with you or take steps before a contract (Article 6(1)(b) GDPR). Security and general support enquiries rely on our legitimate interest in secure operation and answering your request (Article 6(1)(f) GDPR). Legally required records rely on Article 6(1)(c) GDPR.

Insurance calculator and signing

Depending on the product, the embedded calculator processes your name, email address, telephone number, postal address, date of birth, details of other insured people, travel, boat, charter deposit and trip price, as well as your selected cover and declarations. An application and its signing involve the related documents, signature and evidence such as the time, stated place and confirmation method. Confirmation emails and SMS codes support this process.

Form data and a pending application may remain temporarily in the embedded web view’s session storage. The information is used for your requested quote, application and its documentation. Marketing consent is handled separately.

Claims and your own health data

A claim uses the associated policy, claim type, date and place of the event, description, contact details and selected photos or PDF files. You may add a telephone number. You can describe the location yourself or use your current location. A claim draft may be saved on your device and discarded there.

The following information about the consent flow applies once it is enabled for your app. Until it is available, do not send health data through the app. In the enabled flow, check the description and every attachment before sending, regardless of the selected claim type. Choosing “No health data” is a declaration about the content, not consent to process health data.

Your own health data may only be sent through the app with separate, explicit consent for NauticAssure GmbH to review and handle that specific claim internally. The legal bases are Articles 6(1)(a) and 9(2)(a) GDPR. In the enabled flow, the notice before transfer refers to the displayed policy, details and attachments. Its version, scope and time are recorded as evidence. Changes to relevant content or the consent text require a new decision.

Access for this purpose is limited to authorised staff and technical processors acting on instructions. This consent does not authorise requests to doctors or forwarding to insurers or other independent controllers. Any necessary further disclosure must be addressed separately with its recipient, purpose, scope and legal basis. Health data and claim content are not intended for newsletters or marketing analysis.

In the enabled flow, you can withdraw health-data consent in the claim draft or the submitted claim in the app. Independently of this feature, you can send a withdrawal request to service@nauticassure.com; do not attach medical documents. Withdrawal ends future processing based on that consent; it does not affect the lawfulness of earlier processing. Any further retention requires a separate legal basis. Missing necessary evidence may affect the insurer’s assessment of a claim. General app access remains independent of this consent.

Do not upload another person’s health data here. Use the insurer’s appropriate secure claim channel stated in your policy documents. If the consent flow is unavailable in the app, or you need help finding the right route, first contact our support without medical details or attachments. A general agreement by the person uploading does not establish a legal basis for another person’s health data.

Location, maps, weather and notifications

Location data support the functions you use, such as maps, routes, anchor watch, weather and selecting a claim location. Enabled functions such as anchor watch may also require location processing in the background. You control permissions in your device settings; the relevant features may be limited without the necessary permission.

Weather requests send the selected coordinates; place searches also send search terms and language. Weather alerts use the selected point, duration and alert rules. If you allow push notifications, a technical device token is registered with the platform and app identifier to deliver notifications. These data serve the functions you request.

Services, recipients and international processing

The app uses Xano for backend interfaces and the account, trip and insurance data stored there. Our current Xano instance is configured in Germany (Frankfurt). Vercel delivers the embedded calculator. SendGrid is integrated for application and signing emails, and Twilio for SMS confirmation codes. Native push notifications use the respective operating system’s delivery service.

Maps are loaded from CARTO, OpenSeaMap or Esri, depending on the view. Weather and place searches use Open-Meteo; address lookup may also use the operating system’s geocoding service. Other external content includes the Unsplash sign-in image and Google Fonts and FlagCDN in the calculator. Policy messages may contain external content.

When external content is requested, the provider necessarily receives connection data such as the IP address and information about the requested resource. Map requests identify the requested area; weather requests include the selected coordinates. This does not automatically give those providers access to your complete account or claim documents.

Some providers, including Xano, Vercel and Twilio, are based in the United States. Using these services may involve processing outside the EU or EEA. The Xano region Frankfurt therefore does not mean that all app data are processed exclusively in Germany. You can request information about the recipients and safeguards applicable to your international transfers using the contact below.

Newsletter and opening measurement

If you consent to the newsletter, we use your name and email address for our newsletter and store both with Twilio SendGrid. We also measure newsletter openings to evaluate delivery and engagement. This relies on your voluntary consent (Article 6(1)(a) GDPR).

The email contains a small invisible image. Loading it can allow SendGrid to record an opening event associated with the message and recipient, including the time and technical request data. Automatic loading by an email application can also cause an event; it does not reliably prove that you read the content.

You can withdraw newsletter consent at any time for the future, including by emailing service@nauticassure.com. Further marketing stops after withdrawal. A minimal consent record or suppression entry may remain for the specific purposes of respecting your withdrawal and evidencing past processing. Withdrawal does not affect the lawfulness of earlier processing.

Support, account deletion and retention

When you contact support, we process your message and the contact and case information needed to handle it. You can request account deletion from “Delete account” in your profile. The app prepares an email to service@nauticassure.com; you must send it yourself. Alternatively, email that address directly and specify your app account’s email address.

Our service team processes your deletion request within seven calendar days and confirms completion. Opening or sending the prepared email does not automatically delete your account. Appropriate identity checks protect your account. We remove the app account and associated data that are no longer needed and can be deleted. Records that must remain under statutory retention duties or a separate necessary legal basis are excepted. Deleting your app account does not cancel insurance policies.

For shared trips and expenses, other participants’ rights are taken into account. Only necessary shared content may be retained. Keeping data as anonymous requires that reasonable means can no longer identify a person, including through free text, attachments and combinations of route, date and crew. Replacing a username or removing an account ID alone is insufficient.

Policy, advisory and claim records are retained only as needed for the relevant service, handling, a legal duty or specific necessary legal claims. The starting point and duration depend on the document category and remaining purpose. A general tax-record period does not justify retaining an entire medical file. Medical attachments must be deleted when their purpose ends unless a separate basis requires continued retention.

Backups and necessary evidence may follow a separate deletion cycle. The account processing period does not mean that all statutory archives and backups disappear within seven days. The completion information identifies retained records, the reason and their scheduled deletion. Website log periods are not a universal period for every app service.