In short: Sail Atlas is a brand of HeyAtlas.ai LLC, a company established in the United States. We process your personal data so you can manage your Crew App account, crew profile, availability calendar and your work with charter companies. Your data is stored on servers in Germany (Frankfurt); it is never sold or used for advertising. You decide what appears on your public profile and in the crew pool. Questions and requests: info@sailatlas.app.
1. About this notice
This Privacy Notice explains how HeyAtlas.ai LLC (“Sail Atlas”, “we”, “us”), a company established in New Jersey, United States, collects, uses, shares and protects your personal data through the Sail Atlas Crew App, on mobile and on the web.
It applies to all Crew App users, wherever they live. Depending on where you are, you may have additional rights:
- European Economic Area (EEA) and United Kingdom: this notice provides the information required by Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
- Türkiye: this notice is the privacy notice (aydınlatma metni) required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
- United States: the rights granted by the privacy laws of your state of residence.
Region-specific rights are set out in section 11.
The notice covers yacht, gulet and boat crew (skippers, chefs, hosts, deckhands and others) who sign up to and use the Crew App. Separate notices apply to people added to a charter company’s booking through a passenger or crew list link, to Customer App users and to visitors of our website.
2. Data controller and roles
Data controller: HeyAtlas.ai LLC, doing business as Sail Atlas Address: 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States Email: info@sailatlas.app
Two different roles apply in the Crew App:
- Where Sail Atlas is the controller: your Crew App account, your crew profile, your public profile (showcase), the crew pool (directory) open to charter companies, your availability calendar and notes, your job applications, in-app messaging, notifications and the security of the app.
- Where a charter company is the controller: when a charter company you work with assigns you to its bookings, adds your profile to its own crew records, reviews your application or records payments and earnings for you, those records belong to that company. For that processing the charter company is a separate controller and Sail Atlas acts only as its processor, on its behalf and on its instructions. You can send requests about those records directly to the company; if you write to us, we will help you reach it.
3. Personal data we process
| Category | Data |
|---|---|
| Identity | First name, last name, date of birth, gender, nationality |
| Contact | Email address, phone numbers, city and country of residence |
| Account and security | Your password (stored as an irreversible hash), email verification code, session tokens, time zone and language, sign-in and activity records, IP address |
| Professional profile | Crew roles, languages and levels, boat types and sailing regions you have experience with, cuisines, years and summary of experience, routes sailed, boats, clients and crews you worked with, bio, smoking status, work preferences (charter length, day charters, notice period, start days and note) |
| Certificates and documents | Certificate name, number, issue and expiry dates, front and back images; other attachments you upload |
| Images | Profile photo, gallery photos and captions, showcase background image |
| Calendar and availability | Availability blocks and options, block notes, date-specific calendar notes, calendar subscription (ICS) link; if you connect Google Calendar, your Google access token and the IDs of events created |
| Charter work | Availability and booking requests you receive, job applications and application messages, bookings you are assigned to (booking number, boat, route, dates, number of guests, role), earnings entered by charter companies, ratings and reviews you receive |
| Messaging | In-app messages with charter companies |
| Device and usage | Device name and platform, app version, an installation-specific device ID, push notification token, notification preferences, app-open records (also recorded before you sign in), error and performance records |
| Marketing preference | Your marketing consent and the date you gave it |
Only your email address, first name, last name and password are required to sign up. Everything else is added by you if you want a richer profile.
Data about other people. The Crew App shows you the name, email, phone number, company, route and note of people who send you availability requests through your showcase, and the name, rating and comment of people who leave a review through your review link. You may use this information only for the charter work concerned.
Sensitive data. The Crew App does not ask for special category (sensitive) data such as racial or ethnic origin, religion, political opinions or biometric data. Your smoking status and any medical certificates you choose to upload (for example a seafarer medical certificate or ENG1) may count as health data, so we process them only with the consent you give in the Explicit Consent text. The Crew App sign-up and profile flows do not ask for passport or national ID numbers.
Location and device permissions. The Crew App does not collect your location. The photo library and camera are used only when you choose or take a picture, and the notification permission only to send you notifications.
4. How we collect data
We collect personal data electronically through the Crew App mobile and web apps: from you; automatically from your device while you use the app; from the charter companies you work with (assignment, request, earnings and review records); from third parties who send you requests or leave reviews; and from Google if you connect Google Calendar.
5. How we use your data
We use your data for the purposes below. For users in the EEA, the United Kingdom and Türkiye, the table shows the legal basis for each purpose.
| Purpose | GDPR legal basis | KVKK legal basis |
|---|---|---|
| Creating your account, verifying your email address and signing you in | Performance of a contract (Art. 6(1)(b)) | Establishment and performance of a contract (Art. 5(2)(c)) |
| Storing and displaying your crew profile, certificates, gallery and work preferences | Art. 6(1)(b) | Art. 5(2)(c) |
| Publishing your showcase and listing you in the charter companies’ crew pool | Art. 6(1)(b) | Art. 5(2)(c); for information you choose to publish, data made public by you (Art. 5(2)(d)) |
| Availability calendar, options and notes, calendar subscription and (if you connect it) Google Calendar sync | Art. 6(1)(b) | Art. 5(2)(c) |
| Managing requests, bookings, job listings and applications from charter companies; showing your bookings, earnings and reviews | Art. 6(1)(b) | Art. 5(2)(c) |
| In-app messaging and service notifications (push and email) | Art. 6(1)(b) | Art. 5(2)(c) |
| Keeping the service secure, preventing abuse and fraud, monitoring errors and performance, answering support requests | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 5(2)(f)) |
| Meeting legal obligations, answering requests from competent authorities, keeping proof of notices and consents | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 5(2)(ç)) |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) | Art. 5(2)(e) |
| Usage analytics and session recording (Microsoft Clarity, Sentry Session Replay) | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)) |
| Processing information that may count as health data | Explicit consent (Art. 9(2)(a)) | Explicit consent (Art. 6(2)) |
| Sending news, offers and newsletters | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)) |
Processing based on your consent is optional; you can use the Crew App without giving it. You can object at any time to processing based on legitimate interests.
6. Who we share your data with
We do not sell or rent your personal data, and we do not use or share it for advertising. We share it only in the situations below, and only as far as the purpose requires.
Your showcase (public)
Your showcase is a public page that anyone with the link can view without signing in. It can be embedded in other websites, may appear in link previews (name, role and short intro) and may be indexed by search engines.
- Always visible: first and last name, role(s), profile photo.
- Visible unless you hide them (on by default): email and phone, city and country of residence, bio, experience (routes, clients and crews worked with, experience summary and years, sailing regions), certificates (name, number, dates and the document images you upload), languages and levels, boat types, gallery, work preferences and note, ratings and reviews (with the reviewer’s name), availability ranges.
- Never shown: date of birth, your block and calendar notes, booking details, your earnings.
You can change the visibility of each section at any time in the showcase settings in the app.
Charter companies
- Crew pool: while your pool visibility is on (on by default), charter companies using Sail Atlas can see your directory card (name, location, photo, roles, languages, boat types, years of experience, sailing regions, smoking status) and, on the detail page, the same information as your showcase.
- Adding you to their crew records: while your “findable by other companies” setting is on (on by default), a charter company using the Sail Atlas Dashboard can find you and add you to its own crew records. Your first and last name, email and phone numbers, gender, date of birth, nationality, residence, smoking status, bio and roles are then copied into that company’s records and you are notified by email. After the copy, that company is the controller of its record.
- Job applications: when you apply to a listing, the company sees your email address, phone number, directory card, professional profile summary and your application message, regardless of your showcase settings.
- Requests, assignments and messages: when you accept a request, are assigned to a booking or message a company, that company sees the information and messages needed for that work.
Guests of charter companies
When a charter company offers you to its guest as an option (through a crew selection link or a digital offer), the guest sees only your name, profile photo, languages and limited professional information: nationality, roles, boat types, certificate names, experience summary and years, sailing regions, cuisine and service details, routes sailed, boats and clients worked with. Your contact details, date of birth, certificate numbers and document images are not shared with the guest on that selection screen. When you are assigned to a booking, the guests of that booking see you in the Customer App as the booking’s crew, with the information held in the charter company’s record.
Our service providers
We work with the following providers to deliver the service, under contractual confidentiality and security obligations. They process your data only on our behalf and on our instructions.
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services (AWS) | Servers, database, file storage and email delivery (Amazon SES) | Germany (Frankfurt) |
| Expo (650 Industries, Inc.) | Delivery of mobile notifications; notifications reach your device through Apple (APNs) and Google (FCM) | United States |
| Sentry (Functional Software, Inc.) | Error and performance monitoring; with your consent, session replay | EU (Germany) |
| Microsoft Corporation (Clarity) | Usage analytics and session recording, only with your consent | United States |
| Google LLC | Only if you connect Google Calendar: creating events in your calendar for requests you accept | United States |
| OpenAI, L.L.C. and Anthropic, PBC | The AI assistant (Atlas AI) charter companies use inside Sail Atlas; these providers do not use data sent through their APIs to train their models | United States |
| Laravel Holdings Inc. (Forge, Envoyer) | Server management and software deployment | United States |
| Cloudflare, Inc. | Domain name (DNS) and network security | Global |
Other recipients
- Competent public authorities and courts: where we are legally required, and only as far as requested.
- Our legal, financial and audit advisers: under confidentiality obligations.
- Parties to a merger, acquisition or sale of assets: limited by the safeguards in this notice.
- Authorised Sail Atlas staff: may access your account and messaging records for support, security and abuse prevention, and only as far as needed.
7. Where your data is processed and international transfers
Sail Atlas is a company established in the United States. Your data is stored on Amazon Web Services servers in Germany (Frankfurt), and some of our service providers are in the United States. Your data is therefore processed outside the country where you live.
- EEA and United Kingdom: transfers outside the EEA or the UK rely on adequacy decisions (including the EU-U.S. Data Privacy Framework and its UK Extension for certified U.S. providers) or on the European Commission’s Standard Contractual Clauses (SCCs).
- Türkiye: in the Crew App we collect your data directly from you. Under the Turkish Personal Data Protection Authority’s guide on transfers abroad, a controller established abroad obtaining data directly from the person concerned is not a transfer abroad under Article 9 of the KVKK; your data is nonetheless processed in line with the KVKK and the safeguards in this notice. Where we process data as a processor for a charter company established in Türkiye, we put the safeguards required by Article 9 of the KVKK in place together with that company.
8. How long we keep your data
We keep your data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention |
|---|---|
| Account, profile, certificate, gallery and calendar data | While your account is open; deleted or anonymised within 30 days after you delete your account |
| Showcase, pool listing and review link | Taken offline as soon as you delete your account |
| Email verification codes | Valid for 10 minutes; unused codes deleted within 24 hours |
| Session tokens | Invalidated when you sign out, and within 30 days at the latest |
| Device and notification records | Devices unused for 180 days are deactivated; deleted when you delete your account |
| App-open records | 12 months |
| Server and application logs | 14 days |
| Error and performance records (Sentry) | Up to 90 days |
| Security and activity records | 12 months |
| Your messages with charter companies | Remain in the other party’s conversation history even after you delete your account, subject to that party’s retention |
| Data copied into a charter company’s own records | Subject to that charter company’s retention policy |
| Marketing consent and opt-out records | 3 years after the consent ends |
| Records of notices and consents | During your account and afterwards for the limitation period for potential legal claims |
9. How we protect your data
- Your password is stored as an irreversible hash (bcrypt) and never in plain text.
- The identity and contact details in your crew profile (such as date of birth, nationality and phone number) and the content of your messages are encrypted in the database with AES-256; your profile photo, certificates and attachments are encrypted file by file.
- All traffic between the app and our servers is encrypted with TLS; in the mobile app, your session tokens are kept in your device’s secure storage.
- Access is limited by authorisation; each charter company can access only its own records.
- Our systems are continuously monitored and regularly reviewed for security.
10. Children
The Crew App is intended for professionals aged 18 or over, and we do not knowingly collect data from children. If we learn that an account belongs to someone under 18, we will close it and delete the data.
11. Your rights
Wherever you live, we will handle your requests to access, correct or delete your data, to stop marketing messages and to withdraw any consent you have given. Depending on where you are, you have the additional rights below.
EEA and United Kingdom
Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests. You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before you withdrew it. You can lodge a complaint with the data protection supervisory authority in the country where you live or work.
Türkiye
Under Article 11 of the KVKK you have the right to learn whether your data is processed and request information about it, learn the purpose of processing and whether data is used accordingly, know the third parties in Türkiye or abroad to whom it is transferred, request correction of incomplete or inaccurate data, request deletion or destruction under Article 7 and that third parties to whom data was transferred be notified of this, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing. We conclude your request free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (KVKK Kurulu).
United States
If the privacy laws of your state give you the right to access, correct, delete or obtain a copy of your personal information, you can exercise these rights as described in section 12. We do not sell your personal information, share it for targeted advertising or use your sensitive personal information for purposes other than those described in this notice. We will not discriminate against you for exercising your rights. If we deny your request, you can appeal the decision.
Sail Atlas does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
12. How to make a request
You can send requests about your rights:
- by email to info@sailatlas.app from the email address registered to your Crew App account, or
- by post to our address above.
Please include your name, the email address on your account and the subject of your request. We may ask for additional information to verify your identity. Where the law allows, we also accept requests from an authorised agent acting on your behalf.
We respond within 30 days. If we need more time because of the complexity of a request, we will tell you why, to the extent the law allows.
You can do some of this directly in the app: edit your profile, change the visibility of showcase sections, pool visibility and whether other companies can find you, manage your notification preferences, disconnect Google Calendar and delete your account.
13. Changes to this notice
We may update this notice when our services or the law change. The current version and its effective date are always shown at the top of this page. We will tell you about material changes in the app or by email and ask for your consent again where required.