BoatDay
BoatDay
Draft. This document is pre-release boilerplate pending legal review and may change before BoatDay's public launch. Questions: hello@boatday.com.

Privacy Policy

Draft · last updated June 10, 2026

1. Who we are

BoatDay, Inc. (Marina del Rey, California) operates a marketplace for boat rentals, charters, and on-the-water experiences. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to the website, the mobile apps, and our communications.

2. What we collect

  • Account data — name, email, phone, password (stored as a salted hash), profile photo, and your role (renter, host, operator team member).
  • Identity verification — we use Persona to verify government ID and likeness where required. Persona processes your ID documents; we store the verification outcome, not the document images.
  • Boating credentials — license or safety-certificate details you submit for rentals that require them.
  • Payments — processed by Stripe. We store payment metadata (amounts, status, last-4) but never full card numbers. Hosts and operators provide payout details directly to Stripe Connect.
  • Bookings, messages, and reviews — trip details, in-product conversations, photos you upload, claims and their evidence, and passenger manifest details operators are legally required to keep for charters.
  • Device and usage data — IP address, device type, and product events used for security (bot-checks, session management) and to improve the Service.

3. How we use it

  • Running the marketplace: bookings, payments, messaging, payouts.
  • Safety and compliance: identity checks, license verification, passenger manifests, moderation of reports and blocks.
  • Notifications you control: booking updates and messages by email, SMS, and (on mobile) push. Manage these in Settings → Notifications, or via the unsubscribe link in any email.
  • Fraud prevention, debugging, and service improvement.

4. Who we share it with

  • Other users, as needed for a booking — a host or operator sees the name, profile, and trip details of who booked; renters see host/operator profile information. We never sell your data.
  • Processors — Stripe (payments and payouts), Persona (identity verification), our cloud and content-delivery providers (hosting, image storage and delivery), and our email/SMS delivery providers. Each processes data only to provide their service to us.
  • Legal — when required by law, to enforce our Terms, or to protect users (for example, U.S. Coast Guard manifest requirements for charters).

5. Retention

  • Booking and transaction records are kept for 7 years after the booking (and survive account deletion) for legal, tax, and safety compliance — including charter passenger manifests retained per 46 CFR § 26.03.
  • Messages and reviews are kept while your account is active and as needed for moderation or disputes.
  • Sessions slide with use and expire after 30 days of inactivity; you can revoke sessions any time in Settings → Login & security.

6. Your choices and rights

  • Access/export — email privacy@boatday.com for a copy of your personal data; we respond within 30 days.
  • Correction — edit your profile and settings in-product.
  • Deletion — delete your account from Settings → Privacy & data. Records we must keep (Section 5) are retained; everything else is removed.
  • Notifications — opt out per channel in Settings → Notifications.
  • Depending on where you live you may have additional rights (e.g. under the CCPA or GDPR), including the right to complain to a supervisory authority. [COUNSEL: region-specific rights sections.]

7. Cookies and similar tech

We use a session cookie to keep you signed in on the web, a preference cookie for things like your active operator workspace and theme, and bot-protection tokens (Cloudflare Turnstile on web). We do not run third-party advertising trackers.

8. Security

Passwords are hashed with a modern memory-hard algorithm; session tokens are stored hashed; traffic is encrypted in transit. No system is perfectly secure — if we learn of a breach affecting your data we will notify you as required by law.

9. Children

The Service is not directed to children under 18 and we do not knowingly collect their data. Passenger manifests may include minors attending a charter with an adult, supplied by the booking adult.

10. Changes

We may update this policy. For material changes we will give notice in-product or by email before the change takes effect.

11. Contact

Privacy questions and requests: privacy@boatday.com.