Privacy notice
Tideline helps boat and vessel operators run trips, keep passenger manifests, manage documents and handle charters. This notice explains what we collect, why, where it is kept and your rights.
What we collect
Account: your name, phone number, language and time zone. Passengers: name and number of seats; a phone number and next-of-kin number only when the operator or regulator needs them. Crew: name, role, phone and certificates. Trips: departure and arrival times, safety checks and, while a trip is running, the vessel’s position. Payments: amounts and references; card and bank details are handled by the payment provider, and we keep only the last 4 digits of payout accounts. Documents you upload, and messages you send to our WhatsApp assistant.
Why we use it
To provide the service you or your operator signed up for (contract); to keep passengers safe and meet maritime rules: passenger manifests are collected for passenger safety (legal obligation and vital interests); to prevent fraud and abuse and improve the service (legitimate interests); and, only if you agree, to send you offers (consent, which you can withdraw at any time).
Who we share it with
Your operator or charter counterparty, as the service needs. Service providers who process data for us under contract (see the processor list), and authorities where the law requires. We do not sell personal data. AI features receive only the minimum data needed, and a person checks AI output before it counts.
Where it is kept
Data is stored with our database host in the region shown below, and some providers process it in other countries (see the processor list). Transfers outside your country are made only under a lawful basis, such as adequate protection or contractual safeguards.
How long we keep it
Passenger manifests and trip positions: 24 months, then names and numbers are removed and positions deleted. Documents: while the account is active, then for a set period. Payment and invoice records: as long as tax and accounting law requires. Audit records of safety decisions are kept without personal details.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to some uses, and withdraw consent. Signed in, go to Settings → Privacy; we answer within 30 days. Deletion can’t remove records the law requires us to keep, but your details are taken out of them. You can also complain to your data protection authority (in Nigeria, the Nigeria Data Protection Commission).
Security
Encrypted connections everywhere, encryption at rest, private file storage with short-lived links, strict access rules per company, and an audit trail of changes. Staff access to passenger data needs a recorded reason.
Database hosting: Supabase, eu-west-1 (Ireland) - staging