In short: Your employer, the charter company, uses Atlas Dashboard and Atlas Operations to run its bookings, boats and operations. Your employer decides what happens to your work data (tasks, check-ins, photos, signatures, voice notes, messages, activity). Sail Atlas processes that data only for your employer and on its instructions. Sail Atlas decides only about the security of your sign-in, support, abuse prevention, error monitoring and, if you agree, usage analytics. Data is stored on servers in Germany (Frankfurt). It is never sold or used for advertising. Questions about your work data: ask your employer. Questions about this notice: info@sailatlas.app.
1. About this notice
This Privacy Notice explains how personal data of charter company staff is processed in Atlas Dashboard (the web application at dashboard.sailatlas.app) and Atlas Operations (the mobile app for charter company staff). The platform is provided by HeyAtlas.ai LLC (“Sail Atlas”, “we”, “us”), a company established in New Jersey, United States.
It applies to employees, contractors and other people who use Atlas Dashboard or Atlas Operations through an account given to them by a charter company that subscribes to Atlas (your “employer”). It also applies to versions of Atlas Operations published under a charter company’s own brand.
Depending on where you are, you may have additional rights:
- European Economic Area (EEA) and United Kingdom: this notice provides the information required by Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR for the processing for which Sail Atlas is responsible.
- Türkiye: for that processing, this notice is the privacy notice (aydınlatma metni) required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
- United States: the rights granted by the privacy laws of your state of residence.
Region-specific rights are set out in section 11.
This notice does not replace your employer’s notice. Your employer is responsible, under employment and data protection law, for telling you how it uses your work data, for example whether it uses task, time or activity records to evaluate work. This notice describes how the platform works and what Sail Atlas does.
Separate notices apply to guests and passengers of charter companies, to Crew App users, to Atlas Owner users and to visitors of our website.
2. Data controller and roles
Sail Atlas: HeyAtlas.ai LLC, doing business as Sail Atlas Address: 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States Email: info@sailatlas.app
Two different roles apply:
- Where your employer is the controller (Sail Atlas is its processor): your employer creates your account, decides your role, permissions and the boats you can access, and decides what work you record in Atlas. Everything you create or record as part of your work belongs to your employer: tasks and projects, check-in and check-out checklists, readings, damage and issue reports, maintenance logs, expenses and receipts, stock movements, photos, videos and files, signatures, voice notes, inbox and team messages, Atlas AI conversations, and the activity log of your changes in bookings and other records. For this processing Sail Atlas acts only as your employer’s processor (KVKK: veri işleyen), on its behalf and on its documented instructions under our data processing agreement with it. Your employer decides the purposes and the legal basis.
- Where Sail Atlas is the controller: the security of your sign-in (password, two-factor authentication, sessions and sign-in records), preventing fraud and abuse of the platform, error and performance monitoring, app-open records, support requests you send to us, usage analytics and session recording if you consent to them, and our own legal obligations.
3. Personal data we process
| Category | Data |
|---|---|
| Account and profile | Name, work email address, phone number, profile photo (if added), time zone, language, company and team, role and permissions, the boats and bases you can access, whether Atlas AI is enabled for you |
| Sign-in and security | Password (stored as an irreversible hash), two-factor authentication settings (if you turn it on in Atlas Dashboard), session and refresh tokens, browser sessions (IP address and browser type), sign-in and password reset records |
| Activity in the workspace | Activity log of what you create, change or delete in the workspace and when; notifications you receive |
| Tasks and projects | Tasks assigned to you or created by you, their status, comments, attachments and voice notes; time spent and labour cost recorded on tasks |
| Bookings and operations | Check-in, check-out and final checklists you complete, fuel, water, engine and generator readings, extras delivered, damage and issue reports, diver notes, repairs, maintenance logs, expenses and receipts, APA (advance provisioning allowance) entries and receipts, stock operations and scanned barcodes |
| Photos, videos and files | Photos and videos you take or upload, and files you attach |
| Signatures | Your signature and the signatory name when you sign a checklist for the company; signatures you save in the app for reuse (kept only on your device) |
| Messages | Messages you send and receive in the inbox (with guests by WhatsApp, SMS, email or the Customer App) and in internal team conversations; your name as sender or assigned agent |
| Atlas AI | Questions you ask and the answers, voice recordings you send to Atlas AI and their transcripts, photos you submit to draft boat guides, texts you translate |
| Device and usage | Installation-specific device ID, device name, platform and operating-system version, app version, push notification token, notification preferences, app-open records (also recorded before you sign in) |
| Error, performance and analytics | Error reports, performance traces and IP address; if you consent: Sentry Session Replay, Microsoft Clarity usage analytics and session recordings, and Google Analytics in Atlas Dashboard |
Data about other people. In your work you see and record personal data of guests, passengers, crew, boat owners and colleagues, for example names, contact details, passenger and crew lists and the passport or ID details your employer collects. That data belongs to your employer. Use it only for your work and as your employer instructs.
Sensitive data. Atlas does not ask for special category (sensitive) data about you. Please do not record health or other sensitive information about yourself or others in notes, messages or photos unless your employer instructs you to and the law allows it.
Device permissions in Atlas Operations.
| Permission | Used for |
|---|---|
| Camera | Taking photos and videos for bookings, tasks, checklists, damage reports and expenses; scanning stock barcodes (the barcode is read on your device and only its value is sent) |
| Photos | Choosing existing photos to attach |
| Microphone | Recording voice notes and audio messages, and speaking to Atlas AI; only while you are recording |
| Notifications | Sending you task, booking and message notifications |
Atlas Operations does not collect your device’s location. A guest may share a location in a message; that location is part of the conversation.
Offline mode. If you use offline mode, booking data, checklists and images are kept on your device so you can work without a connection. Work done offline is queued and sent when you are back online. Cached data, queued work, downloaded documents and saved signatures are removed from the device when you sign out.
4. How we collect data
We collect personal data electronically: from your employer (when it creates your account and assigns your role, boats and tasks); from you when you use Atlas Dashboard or Atlas Operations; automatically from your device or browser; from colleagues who assign you work, message you or record work involving you; from guests and other people who message your employer; and from integrations your employer connects (for example booking systems or messaging channels).
5. How we use your data
For your employer (Sail Atlas as processor). We process your work data to provide Atlas Dashboard and Atlas Operations to your employer: to show you your tasks and bookings, record your work, deliver messages and notifications, run Atlas AI, generate reports and sync data offline. Your employer decides the purposes and the legal basis for this processing. For staff in the EEA and the UK this is typically the performance of the employment or service contract, legal obligations or your employer’s legitimate interests (GDPR Art. 6(1)(b), (c) or (f)); in Türkiye typically KVKK Art. 5(2)(c), (ç) or (f). See your employer’s own notice.
For our own purposes (Sail Atlas as controller). For users in the EEA, the United Kingdom and Türkiye, the table shows the legal basis for each purpose.
| Purpose | GDPR legal basis | KVKK legal basis |
|---|---|---|
| Securing your sign-in: password, two-factor authentication, password reset, sessions | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 5(2)(f)) |
| Keeping the platform secure, preventing fraud and abuse, keeping server logs and app-open records | Art. 6(1)(f) | Art. 5(2)(f) |
| Error and performance monitoring (Sentry, without session replay) | Art. 6(1)(f) | Art. 5(2)(f) |
| Answering support requests you send to us | Art. 6(1)(f) | Art. 5(2)(f) |
| Service messages about the platform (for example maintenance or important changes) | Art. 6(1)(f) | Art. 5(2)(f) |
| Meeting legal obligations, answering requests from competent authorities, keeping proof of notices and consents | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 5(2)(ç)) |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) | Art. 5(2)(e) |
| Usage analytics and session recording (Microsoft Clarity, Sentry Session Replay, Google Analytics in Atlas Dashboard) | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)) |
Our legitimate interest is to run a secure, reliable platform for the charter companies that use it. You can object at any time to processing based on legitimate interests.
Analytics only with your consent. Microsoft Clarity, Sentry Session Replay and Google Analytics run only if you agree. Session replay masks all text and images on the screen. Your employer does not see whether you agreed, and saying no has no effect on your work or your use of the apps. You can change your choice at any time in the app settings.
We do not use your data for advertising and we do not make decisions about you based solely on automated processing. Any evaluation of your work is made by your employer, not by Sail Atlas.
6. Who we share your data with
We do not sell or rent your personal data, and we do not use or share it for advertising. We share it only in the situations below, and only as far as the purpose requires.
Your employer and colleagues
Your employer’s administrators and colleagues see your data in the workspace according to their roles and permissions: for example your name and contact details, tasks assigned to you, time recorded, checklists you completed, photos, signatures, messages and the activity log of your changes. Your employer sets these permissions.
Guests, boat owners and other people your employer works with
- Guests: when you message a guest, the guest sees your name and your messages. When you sign a check-in or check-out checklist for the company, your signature and the signatory name appear on the checklist document your employer gives the guest.
- Boat owners: if your employer uses Atlas Owner, the owner of a boat sees the name of the person who carried out a maintenance job in the boat’s maintenance history.
- Integrations your employer connects (for example booking systems such as BookingManager/MMK or NauSYS, WhatsApp and SMS, Gmail, Mailchimp or payment providers): data is sent to them on your employer’s instructions. They act for your employer, not for Sail Atlas.
Our service providers
We work with the following providers to deliver the platform, under contractual confidentiality and security obligations. They process data only on our behalf and on our instructions.
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services (AWS) | Servers, database, file storage, email delivery (Amazon SES) and translation (AWS Translate) | Germany (Frankfurt) |
| Laravel Holdings Inc. (Forge, Envoyer) | Server management and software deployment | United States |
| Cloudflare, Inc. | Domain name (DNS) and network security | Global |
| Sentry (Functional Software, Inc.) | Error and performance monitoring; with your consent, session replay | EU (Germany) |
| Microsoft Corporation (Clarity) | Usage analytics and session recording, only with your consent | United States |
| Google LLC | Google Analytics in Atlas Dashboard, only with your consent; Firebase Cloud Messaging for Android notifications; Google Cloud Translation; Gmail, only if your employer connects it | United States |
| Expo (650 Industries, Inc.) | Delivery of mobile notifications; notifications reach your device through Apple (APNs) and Google (FCM) | United States |
| OpenAI, L.L.C. and Anthropic, PBC | Atlas AI, voice transcription and translation; these providers do not use data sent through their APIs to train their models | United States |
| Twilio Inc. | Sending and receiving WhatsApp and SMS messages in the inbox, if your employer uses these channels | United States |
| Base64.ai | Reading passport and ID images when your employer scans guest documents | United States |
Other recipients
- Competent public authorities and courts: where we are legally required, and only as far as requested.
- Our legal, financial and audit advisers: under confidentiality obligations.
- Parties to a merger, acquisition or sale of assets: limited by the safeguards in this notice.
- Authorised Sail Atlas staff: a small number of authorised Sail Atlas staff can access your employer’s workspace and your account, only to provide support your employer or you request, to keep the platform secure and to investigate abuse, and only as far as needed. This access is recorded.
7. Where your data is processed and international transfers
Sail Atlas is a company established in the United States. Data is stored on Amazon Web Services servers in Germany (Frankfurt), and some of our service providers are in the United States. Your data is therefore processed outside the country where you live.
- EEA and United Kingdom: transfers outside the EEA or the UK rely on adequacy decisions (including the EU-U.S. Data Privacy Framework and its UK Extension for certified U.S. providers) or on the European Commission’s Standard Contractual Clauses (SCCs). For work data, these safeguards are part of our data processing agreement with your employer.
- Türkiye: where your employer is established in Türkiye, the transfer of work data to Sail Atlas abroad is made by your employer as controller; your employer and Sail Atlas put the safeguards required by Article 9 of the KVKK in place, such as the standard contract published by the Personal Data Protection Board. Data that Sail Atlas collects directly from your device for its own purposes is processed in line with the KVKK and the safeguards in this notice.
8. How long we keep your data
We keep data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention |
|---|---|
| Work data (tasks, checklists, photos, signatures, voice notes, messages, reports and other records) | As your employer decides, while its subscription is active; your employer can delete records. After the subscription ends, your employer can export its data for 30 days; it is then deleted within 90 days, including backups |
| Your account after your employer removes your access | You can no longer sign in straight away. Records you created stay in your employer’s workspace as its records. Your account data is deleted or anonymised as your employer instructs, and at the latest when its data is deleted |
| Atlas AI conversations and voice recordings | Until you or your employer delete the conversation; recordings that were never sent are deleted after 1 day |
| Data on your device (offline cache, queued work, saved signatures) | Removed when you sign out |
| Device and notification records | Devices unused for 180 days are deactivated |
| App-open records | 12 months |
| Server and application logs | 14 days |
| Error and performance records (Sentry) | Up to 90 days |
| Security and activity records | 12 months |
| Records of notices and consents | During your account and afterwards for the limitation period for potential legal claims |
9. How we protect your data
- Your password is stored as an irreversible hash (bcrypt) and never in plain text. You can turn on two-factor authentication in Atlas Dashboard.
- All traffic between the apps and our servers is encrypted with TLS.
- Access is limited by role, permissions and boat access; each charter company can access only its own workspace.
- Session replay, where you consent to it, masks all text and images on the screen.
- When you sign out of Atlas Operations, the data stored on the device for your session is removed.
- Our systems are continuously monitored and regularly reviewed for security.
10. Children
Atlas Dashboard and Atlas Operations are work tools intended for people aged 18 or over. Employers must not give accounts to children. If we learn that an account belongs to someone under 18, we will inform the employer so it can close the account.
11. Your rights
Work data: your employer is the controller, so please send requests about your work data to your employer first. If you write to us about work data, we will pass your request to your employer without undue delay and help it respond.
Data for which Sail Atlas is the controller: wherever you live, we will handle your requests to access, correct or delete your data and to withdraw any consent you have given. Depending on where you are, you have the additional rights below.
EEA and United Kingdom
Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests. You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before you withdrew it. You can lodge a complaint with the data protection supervisory authority in the country where you live or work.
Türkiye
Under Article 11 of the KVKK you have the right to learn whether your data is processed and request information about it, learn the purpose of processing and whether data is used accordingly, know the third parties in Türkiye or abroad to whom it is transferred, request correction of incomplete or inaccurate data, request deletion or destruction under Article 7 and that third parties to whom data was transferred be notified of this, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing. Requests about work data are answered by your employer as controller. We conclude requests addressed to us free of charge within 30 days. If you are not satisfied with the answer, you can complain to the Personal Data Protection Board (KVKK Kurulu).
United States
If the privacy laws of your state give you the right to access, correct, delete or obtain a copy of your personal information, you can exercise these rights as described in section 12. We do not sell your personal information, share it for targeted advertising or use your sensitive personal information for purposes other than those described in this notice. We will not discriminate against you for exercising your rights. If we deny your request, you can appeal the decision.
12. How to make a request
For your work data, contact your employer.
For data for which Sail Atlas is the controller, you can send requests:
- by email to info@sailatlas.app from the email address registered to your Atlas account, or
- by post to our address above.
Please include your name, the email address on your account, the name of your employer and the subject of your request. We may ask for additional information to verify your identity. Where the law allows, we also accept requests from an authorised agent acting on your behalf. For requests under the KVKK you can also apply in writing, by registered electronic mail (KEP), with a secure electronic or mobile signature, or from the email address registered with us.
We respond within 30 days. If we need more time because of the complexity of a request, we will tell you why, to the extent the law allows.
You can do some of this directly in the apps: update your profile in Atlas Dashboard, turn on two-factor authentication, change your language and notification settings, delete saved signatures, delete Atlas AI conversations and sign out to remove data from your device. Your account itself is managed by your employer: ask your employer to close it.
13. Changes to this notice
We may update this notice when our services or the law change. The current version and its effective date are always shown at the top of this page. We will tell you about material changes in the apps or by email and ask for your consent again where required.