In short: Sail Atlas is a brand of HeyAtlas.ai LLC, a company established in the United States. The Customer App lets you follow your charter booking in one place, fill in the passenger list, prepare for check-in and message your charter company. Sail Atlas is responsible for your app account; the charter company you booked with is responsible for what you share in the context of your booking (passenger list, passport and ID details, messages, check-in records), and Sail Atlas processes that information on the company’s behalf. Your data is stored on servers in Germany (Frankfurt); it is never sold or used for advertising.
1. About this notice
This Privacy Notice explains how HeyAtlas.ai LLC (“Sail Atlas”, “we”, “us”), a company established in New Jersey, United States, collects, uses, shares and protects your personal data through the Sail Atlas Customer App.
It applies to all Customer App users, wherever they live. Depending on where you are, you may have additional rights:
- European Economic Area (EEA) and United Kingdom: this notice provides the information required by Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
- Türkiye: this notice is the privacy notice (aydınlatma metni) required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
- United States: the rights granted by the privacy laws of your state of residence.
Region-specific rights are set out in section 11.
The notice covers charter guests who sign up to the Customer App or sign in as a guest with their booking number and last name, and people whose details are added to a passenger list through the app. Separate notices apply to Crew App users and to visitors of our website.
2. Data controller and roles
Data controller: HeyAtlas.ai LLC, doing business as Sail Atlas Address: 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States Email: info@sailatlas.app
Two different roles apply in the Customer App:
- Where Sail Atlas is the controller: your Customer App account (sign-up, sign-in, password actions), linking bookings to your account, device and notification records, and the security and improvement of the app.
- Where the charter company is the controller: everything you share in the context of your booking or that the charter company sends you: booking details, the passenger and crew list, ID and passport details and document images, skipper licences, pre-check and check-in/check-out records, issue reports, provisioning lists, extra requests, crew selections, reviews and your messages with the charter company. For this processing the charter company you booked with is the controller and Sail Atlas is its processor, acting on its behalf and on its instructions. The charter company’s own privacy notice also applies; you can send requests directly to the company or ask us to pass them on.
You can link bookings from more than one charter company to the same account. Each company sees only the data relating to its own bookings.
3. Personal data we process
| Category | Data |
|---|---|
| Account | First and last name, email address, phone number (optional), your password (stored as an irreversible hash), language and time zone, password reset code, session tokens |
| Booking link | Booking number, start date and your last name for matching, QR code content, the person you select as yourself among the people on the booking, link records (date, platform, app version) |
| Passenger list (crew list) | For you and the people you travel with: first and last name, email address, phone number, date of birth, gender, nationality, ID number, passport number and ID/passport images; for the skipper, licence number and licence images; role on the list (skipper or passenger) |
| Trip and operations | Pre-check answers, notes and photos; issue reports (text, photos, video, audio files, PDF); provisioning (shopping) list; extra requests; your crew selections; your booking and crew reviews |
| Messaging | In-app messages with the charter company and their attachments |
| Device and usage | Device name, platform, app version, device ID, push notification token, app-open records (also recorded before you sign in), IP address and request records, error and performance records |
| Marketing preference | Your marketing consent and its date; your per-channel consent and opt-out records held by charter companies |
Only your name, email address and password are required to sign up. If you sign in as a guest with your booking number and last name, no account is created and your session is linked directly to your record on the booking.
Data about other people. When you add the people you travel with to the passenger list, you confirm that you have told them about this notice and the charter company’s notice and that you are entitled to share their details. You may add the details of anyone under 18 only as their parent or guardian or with their permission.
Sensitive data. The Customer App does not ask for special category (sensitive) data such as health, religion or biometric data. Please do not share such information in your messages, notes or issue reports unless necessary; if you do, it is used only to handle your request.
Location and device permissions. The Customer App does not collect your location. The camera is used only when you scan a QR code or take a photo, the photo library and files only when you choose a file, and the notification permission only to send you notifications.
4. How we collect data
We collect personal data electronically through the Customer App: from you; automatically from your device while you use the app; from the charter company you booked with (booking, passenger and crew details, documents); and from other guests who add you to a passenger list.
5. How we use your data
We use your data for the purposes below. For users in the EEA, the United Kingdom and Türkiye, the table shows the legal basis for each purpose.
| Purpose | Controller | GDPR legal basis | KVKK legal basis |
|---|---|---|---|
| Creating your account, signing you in and handling password actions | Sail Atlas | Performance of a contract (Art. 6(1)(b)) | Establishment and performance of a contract (Art. 5(2)(c)) |
| Linking bookings to your account and keeping link records | Sail Atlas | Art. 6(1)(b); legitimate interests for the records (Art. 6(1)(f)) | Art. 5(2)(c); legitimate interests for the records (Art. 5(2)(f)) |
| Showing you booking, boat, base, document and guide information | Charter company | Art. 6(1)(b) | Art. 5(2)(c) |
| Collecting the passenger list, ID and passport details and licences and passing them to the charter company; filling in the form with optional document scanning | Charter company | Art. 6(1)(b); legal obligation for passenger and crew reporting duties (Art. 6(1)(c)) | Art. 5(2)(c); legal obligation for passenger and crew reporting duties (Art. 5(2)(ç)) |
| Pre-check, check-in/check-out, issue reports, provisioning, extras, crew selection and reviews | Charter company | Art. 6(1)(b) | Art. 5(2)(c) |
| Messaging with the charter company and service notifications | Charter company and Sail Atlas | Art. 6(1)(b) | Art. 5(2)(c) |
| Keeping the service secure, preventing abuse, monitoring errors and performance, answering support requests | Sail Atlas | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 5(2)(f)) |
| Meeting legal obligations, answering requests from competent authorities, keeping proof of consents | Sail Atlas | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 5(2)(ç)) |
| Establishing, exercising or defending legal claims | Sail Atlas | Art. 6(1)(f) | Art. 5(2)(e) |
| Usage analytics and session recording (Microsoft Clarity, Sentry Session Replay) | Sail Atlas | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)) |
| Sending offers, news and campaigns | Sail Atlas and charter company | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)) |
Processing based on your consent is optional; you can use the Customer App without giving it. Document scanning is also optional; you can type your details in instead. You can object at any time to processing based on legitimate interests.
6. Who we share your data with
We do not sell or rent your personal data, and we do not use or share it for advertising. We share it only in the situations below, and only as far as the purpose requires.
The charter company
When you link a booking to your account, the charter company sees your name and email address, the platform you used and when you linked it, everything you share in the context of the booking and your messages. If you gave marketing consent, it is passed to that company when you link the booking.
Under its own responsibility, the charter company may send the passenger list to port, coast guard and immigration authorities and to official systems such as the Greek e-Charterparty, and your booking details (the charterer’s first and last name and email address) to charter booking platforms such as Booking Manager (MMK) and NauSYS.
Other guests and the crew
- Other Customer App users linked to the same booking can view the booking’s passenger list, including the ID details on it.
- The crew assigned to your booking see the booking holder’s name, the booking dates, the route and the number of guests in the Crew App.
Service providers
We work with the following providers to deliver the service, under contractual confidentiality and security obligations. They process data only on behalf of, and on the instructions of, Sail Atlas or the charter company.
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services (AWS) | Servers, database, search, file storage and email delivery (Amazon SES) | Germany (Frankfurt) |
| Expo (650 Industries, Inc.) | Delivery of mobile notifications; notifications reach your device through Apple (APNs) and Google (FCM). Message notifications include a short preview of the message | United States |
| Sentry (Functional Software, Inc.) | Error and performance monitoring; with your consent, session replay | EU (Germany) |
| Microsoft Corporation (Clarity) | Usage analytics and session recording, only with your consent | United States |
| Base64.ai | Only if you use document scanning: automatic reading of the ID or passport image; the scanned image is not stored separately by Sail Atlas | United States |
| Twilio Inc. | WhatsApp and SMS messages the charter company sends you and, with your consent, its campaigns | United States |
| Intuit Inc. (Mailchimp) and Google LLC (Gmail) | Sending email campaigns, if the charter company chooses to use them | United States |
| OpenAI, L.L.C. and Anthropic, PBC | The AI assistant and message translation (Atlas AI) charter companies use inside Sail Atlas; these providers do not use data sent through their APIs to train their models | United States |
| Laravel Holdings Inc. (Forge, Envoyer) | Server management and software deployment | United States |
| Cloudflare, Inc. | Domain name (DNS) and network security | Global |
Other recipients
- Competent public authorities and courts: where we are legally required, and only as far as requested.
- Our legal, financial and audit advisers: under confidentiality obligations.
- Parties to a merger, acquisition or sale of assets: limited by the safeguards in this notice.
- Authorised Sail Atlas staff: may access your account and booking links for support, security and abuse prevention, only as far as needed, and may link a booking to your account or remove a link at your request.
7. Where your data is processed and international transfers
Sail Atlas is a company established in the United States. Your data is stored on Amazon Web Services servers in Germany (Frankfurt), and some of our service providers are in the United States. Your data is therefore processed outside the country where you live.
- EEA and United Kingdom: transfers outside the EEA or the UK rely on adequacy decisions (including the EU-U.S. Data Privacy Framework and its UK Extension for certified U.S. providers) or on the European Commission’s Standard Contractual Clauses (SCCs). Data we process for charter companies in the EEA is protected under our data processing agreement with them.
- Türkiye: we collect your account data directly from you. Under the Turkish Personal Data Protection Authority’s guide on transfers abroad, a controller established abroad obtaining data directly from the person concerned is not a transfer abroad under Article 9 of the KVKK; your data is nonetheless processed in line with the KVKK and the safeguards in this notice. If the charter company you booked with is established in Türkiye, the safeguards required by Article 9 of the KVKK for passing booking data to us are put in place through our contract with that company.
8. How long we keep your data
We keep your data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention |
|---|---|
| Account data | While your account is open; deleted or anonymised within 30 days after you delete your account |
| Booking data (passenger list, documents, check-in records, messages, reviews) | Subject to the charter company’s retention policy and legal obligations. Sail Atlas keeps this data on the company’s behalf until the company deletes it or our service relationship with the company ends. Deleting your account does not delete these records; it removes their link to your account |
| Booking link records | Up to 2 years after the link is removed |
| Document scanning | The scanned image is not stored separately by Sail Atlas; the details read are used only to fill in the form and are added to the passenger list when you save it |
| QR link codes | Valid for 14 days |
| Password reset codes | Valid for 10 minutes |
| Session tokens | Access token 1 hour (2 hours with “remember me”), refresh token 30 days |
| In-app notifications | Read notifications 7 days, all notifications up to 1 month |
| Device and notification records | Devices unused for 180 days are deactivated; deleted when you delete your account |
| App-open records | 12 months |
| Server and application logs | 14 days |
| Error and performance records (Sentry) | Up to 90 days |
| Security and activity records | 12 months |
| Marketing consent and opt-out records | 3 years after the consent ends |
| Records of notices and consents | During your account and afterwards for the limitation period for potential legal claims |
9. How we protect your data
- Your password is stored as an irreversible hash (bcrypt) and never in plain text.
- Identity, contact, ID number and passport details on bookings are encrypted in the database with AES-256; ID, passport and licence images are encrypted file by file.
- All traffic between the app and our servers is encrypted with TLS; session tokens are short-lived and specific to the app.
- Each charter company can access only the data of its own bookings; access is limited by authorisation.
- Our systems are continuously monitored and regularly reviewed for security.
10. Children
Only people aged 18 or over may create a Customer App account, and we do not knowingly collect data from children. Children’s details may be added to a passenger list only by, or with the permission of, their parent or guardian. If we learn that an account belongs to someone under 18, we will close it.
11. Your rights
Wherever you live, we will handle your requests to access, correct or delete your data, to stop marketing messages and to withdraw any consent you have given. For booking data, you exercise your rights primarily against the charter company; we pass any such request we receive to the company without delay and help it respond. Depending on where you are, you have the additional rights below.
EEA and United Kingdom
Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests. You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before you withdrew it. You can lodge a complaint with the data protection supervisory authority in the country where you live or work.
Türkiye
Under Article 11 of the KVKK you have the right to learn whether your data is processed and request information about it, learn the purpose of processing and whether data is used accordingly, know the third parties in Türkiye or abroad to whom it is transferred, request correction of incomplete or inaccurate data, request deletion or destruction under Article 7 and that third parties to whom data was transferred be notified of this, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing. We conclude your request free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (KVKK Kurulu).
United States
If the privacy laws of your state give you the right to access, correct, delete or obtain a copy of your personal information, you can exercise these rights as described in section 12. We do not sell your personal information, share it for targeted advertising or use your sensitive personal information (such as passport numbers) for purposes other than those described in this notice. We will not discriminate against you for exercising your rights. If we deny your request, you can appeal the decision.
Sail Atlas does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
12. How to make a request
You can send requests about your rights:
- by email to info@sailatlas.app from the email address registered to your Customer App account, or
- by post to our address above.
Please include your name, the email address on your account and the subject of your request; for booking-related requests, adding your booking number and the charter company’s name speeds things up. We may ask for additional information to verify your identity. Where the law allows, we also accept requests from an authorised agent acting on your behalf.
We respond within 30 days. If we need more time because of the complexity of a request, we will tell you why, to the extent the law allows.
You can do some of this directly in the app: remove booking links, manage notification permissions in your device settings and delete your account from your profile page. You can unsubscribe from email campaigns with the link in every message.
13. Changes to this notice
We may update this notice when our services or the law change. The current version and its effective date are always shown at the top of this page. We will tell you about material changes in the app or by email and ask for your consent again where required.