Last updated: [DATE] · Applies to: the founding phase
1. Who we are
burgee is operated by Benjamin Haugh, trading as Burgee Marine, of [TRADING ADDRESS]. [On incorporation, replace with the company and its registered number.]
For privacy questions, or to exercise any right in §9, contact [CONTACT EMAIL].
[ICO REGISTRATION — add the registration number once obtained.]
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk), or to your local supervisory authority if you are in the EU/EEA.
2. Our role
For captain account data — your name, email, login — we are the controller: we decide what to do with it.
For the Vessel's records — crew, guests, owner, schedule, documents — the captain and the Vessel's owning entity decide what goes in and why, and we hold and process it for them.
Unresolved and flagged for legal review: the burgee agent acts with a degree of independence — it decides which suppliers to approach, composes outreach, and gathers candidate contacts. That may make us a controller for part of this processing rather than only a processor. This notice will be corrected once that is settled, and a data processing agreement added if one is required.
3. What we hold
Your account: name, email address, password (hashed, never stored in plain text), login and session records, and an audit log of significant actions.
The Vessel: identity and registration details, public registered owner and manager details, schedule (periods, charters, voyages, transport windows), systems, certificates and documents, and the Vessel's position where you have enabled position tracking.
Crew (entered by the captain): names, roles, dates of birth, nationality, contact details, home addresses, next of kin, passport and visa details, certificates, embark/disembark dates and rotations, and employer details.
Charter guests: names, roles aboard, and stay dates.
Suppliers and contacts: business contact details, categories, locations, and the vouches captains give them.
Messages: your conversations with the agent, and the emails and WhatsApp messages the agent exchanges with suppliers on your behalf.
We deliberately do not store ultimate beneficial ownership information.
Sensitive data
Some fields can hold health information — crew medical notes, and the description, symptoms and outcome of incident reports. During the founding phase we ask captains not to enter it, and the founding-captain agreement says so. If it reaches us anyway, tell us and we will delete it.
Encryption
Passport numbers, dates and places of birth, home addresses, personal phone numbers and email addresses, next-of-kin details, medical notes, discharge book numbers, visa numbers and incident content are encrypted at rest at the application layer. Searching encrypted fields uses a blind index, so we can find a record without keeping a plain-text copy alongside it.
4. Why we hold it, and on what basis
| What | Why | Basis |
|---|---|---|
| Account data | To let you in and keep the account secure | Contract |
| Vessel and crew records | To provide the product you asked for | Contract; and for crew and guests, the captain's/owner's own basis as their employer or host |
| Agent actions on your behalf | To source quotes and answer questions from your records | Contract |
| Directory contacts and vouches | To run the directory, which is the product's core | Legitimate interests — a curated professional directory that captains and suppliers both benefit from |
| Candidate supplier contacts | To have something to show when a captain searches (see §6) | Legitimate interests |
| Security logs, rate limiting | To keep the service safe | Legitimate interests |
We do not rely on consent for the above, so you cannot withdraw consent as a way of stopping it — but you can object, close the account, and ask us to delete (§9).
5. A person may read your records during the founding phase
burgee is currently a concierge product. Ben personally reviews the agent's work — draft supplier emails, parsed replies, moderation items — before or shortly after captains see it. That means a human at burgee may read material in your Vessel's records in the course of that review.
We think that is the right way to run an early product where an AI is doing real work, but you should know it is happening. It is why we ask you to keep crew medical detail out (§3).
6. Supplier contacts we gather ourselves
To stop the directory being empty when a captain searches, we gather supplier business contact details from public sources into a private staging area.
These are never shown as trusted directory entries. They stay invisible until a captain who has actually used that supplier vouches for them. Unvouched candidates expire.
If you are a supplier and want to know what we hold about you, or want it removed, contact [CONTACT EMAIL] and we will deal with it.
Flagged for legal review: this is personal data obtained from sources other than the individual, which engages Article 14 of the UK GDPR. Whether a notification exemption applies has not been assessed.
7. Who else sees it
Suppliers. When the agent sources a quote it emails suppliers in your name and identifies the Vessel and what you need. That is the product working. Nothing is sent until you approve it.
Our service providers. Listed in full, with what each one receives, in the sub-processor annex. In summary: hosting and database, file storage, email and WhatsApp delivery, and an AI provider that processes message and document content to extract structured information.
AI processing. We send message content, supplier replies and uploaded document text to Anthropic's Claude API to extract structured information. Your data is not used to train AI models.
Nobody else. We do not sell personal data, we do not share it with advertisers, and there is no advertising in burgee.
We may disclose data if the law requires it, or to protect someone's safety.
8. How long we keep it
While your account is open we keep the Vessel's records so the product works.
[RETENTION PERIODS — not yet set. This is a genuine open decision, not an oversight: crew records interact with flag-state and employment record-keeping requirements that vary by registry, and several categories carry statutory minimums. Retention will be set with legal input before public launch and this section completed.]
On request we will delete your account and the Vessel's records, subject to anything we must keep by law. Directory vouches and supplier entries remain, as the founding-captain agreement explains, because the directory outlives individual captains.
9. Your rights
You can ask us to: give you a copy of your data; correct it; delete it; restrict or stop certain processing; or send it to another provider. You can object to processing we do on legitimate interests. You will not be charged and we will respond within one month.
Crew members, guests and suppliers have these rights too. If you are crew and your captain entered your data, you can come to us directly at [CONTACT EMAIL] — we will help, and we will usually need to involve your captain or the vessel as the party who decides what happens to those records.
burgee does not make automated decisions that produce legal effects about you. The agent drafts and suggests; a person always approves.
10. Where your data is
Our infrastructure providers may process data outside the UK and EEA (principally in the United States). Where that happens we rely on the providers' standard contractual clauses or an adequacy decision. [Confirm the mechanism for each provider in the annex.]
11. Children
burgee is for professional use by maritime crew and is not intended for anyone under 18.
12. Changes
We will post changes here and, if they matter, tell you directly.
Draft 1 · 2026-07-29 · unreviewed