Last Updated: 11 November 2026

WaterTightVM (referred to as "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the WaterTightVM mobile application, website, and related API services (collectively, the "Services").

This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR).

1. Important Information and Who We Are

Data Controller & Processor

Depending on how you interact with our Services, we act as either a Data Controller or a Data Processor:

  • Data Processor: When you are a crew member (seafarer) uploading certificates at the direction of a maritime employer or vessel operator. In this scenario, your employer is the Data Controller, and we process your data on their behalf under a Data Processing Agreement (DPA). As the Data Controller, the employer or vessel operator is responsible for managing administrative access permissions and ensuring that their personnel who utilize the Services are suitably trained on data security and privacy compliance.
  • Data Controller: When you register an administrative account on behalf of a company, visit our website, or when we determine the purposes and means of processing direct user logins.

Contact Details

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk), or your local European Data Protection Authority. We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us first.

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:

  • Identity Data: First name, last name, date of birth, place of birth, nationality, gender, and identity document details (e.g. passport or discharge book scans).
  • Contact Data: Email address, telephone number, next of kin contact details, and physical address.
  • Professional & Employment Data: Vessel assignments, crew ranks, group assignments, certificates, licenses, and training requests.
  • Special Category Data (Health Data): We collect and process medical fitness certificates (e.g. ENG1 certificates). These documents contain statements regarding physical fitness for maritime work, colour-blindness checks, and any operational restrictions or limitations.
  • Financial & Transaction Data: Payment billing addresses and transaction histories (card details are processed directly by our payment processor, Stripe; we do not store raw credit card numbers on our servers).
  • Technical Data: Internet protocol (IP) address, login data, device type, operating system, and platform.
  • Usage & Analytics Data: Pseudonymous interaction data, page views, session counts, clicks, and device specifications collected via Google Analytics on the marketing website and in the web application, only after you give consent.

3. How We Use Your Personal Data and Lawful Bases

We will only use your personal data when the law allows us to. Under the UK/EU GDPR, we rely on the following lawful bases for processing your data:

General Personal Data (Article 6 GDPR)

  1. Performance of a Contract: Necessary to verify your certificates and provide the database services to you or your employer.
  2. Legitimate Interests: Necessary for our legitimate interests (for example ensuring security, preventing fraud, maintaining audit logs, and reading embedded text from documents where that feature is used), provided your interests and fundamental rights do not override those interests.
  3. Consent: Where you have given clear, explicit consent for us to process your data for a specific purpose.
  4. Billing & Accounting Obligations: Processing payments, issuing invoices, and, where a customer enables it, synchronising payroll records with third-party accounting software (for example Xero).
  5. Legitimate Interests / Consent for Analytics: Tracking and analysing usage patterns to monitor, maintain, and optimise application performance, reliability, and usability (subject to user consent).

Special Category/Health Data (Article 9 GDPR)

Because we process medical fitness certificates, we process special category data under the following conditions:

  • Article 9(2)(b) (Employment & Social Security): The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or the data subject in the field of employment and social security and social protection law (i.e. verifying that seafarers are medically fit to serve at sea under international maritime laws like MLC 2006).
  • Article 9(2)(a) (Explicit Consent): Where we request and you provide explicit consent to process your medical certificate to extract and display your fitness status on the platform.

4. How We Secure and Store Your Data

  • Encryption: We enforce HTTPS/TLS encryption in transit. Sensitive crew profile fields in the database (such as names, contact details, dates of birth, addresses, next-of-kin, and identity document details) are encrypted at the application level using AES-256-GCM. Uploaded files are stored in secure object storage and accessed through signed, time-limited URLs. Google Cloud also encrypts data at rest.
  • Data Hosting Location: All active production databases and backups are hosted on Google Cloud Platform within the EU (Belgium - europe-west1 region).
  • Backups: Production database backups are managed Google Cloud SQL backups, held in the same EU region and encrypted at rest by Google Cloud.

5. Disclosures and Cross-Border Transfers

We do not sell your personal data. We share your data only with third-party service providers (processors) who perform services on our behalf:

  • Hosting & Cloud Providers: Google Cloud Platform (EU-hosted) for hosting, storage, logging, and database backups. WaterTightVM does not use Google Cloud Vision. Documents and photos are not sent to Google for optical character recognition. Embedded PDF and Word text can be read on the WaterTightVM server. A file with no embedded text is entered by hand.
  • Communication Providers: Namecheap Private Email, for transactional email such as account, security, and notification messages.
  • Payment Processor: Stripe (for secure subscription billing and payment processing).
  • Accounting & Payroll Integration: Xero, only where a customer enables that integration (for synchronising crew payroll, timesheets, and accounting data).
  • Web & App Analytics: Google Analytics (GA4) on the marketing website and in the web application, only after you give consent. If you also accept advertising cookies on the marketing website, we may enable Google Ads conversion and remarketing signals. We do not use social-media logins, and we do not use Google Analytics Advertising Features such as Display Network impressions reporting or abandoned-cart advertising in the WaterTightVM application.
  • Optional AI models: External AI is off by default. If a company administrator enables an external model, prompts for the support assistant, training drafts, invoice lines, MCA provider lists, or supplier quote emails can be sent to the provider selected in WaterTightVM. The software can call OpenAI, Anthropic, or Google's Gemini API, or a private endpoint that is not available in the current production setup. See section 5A. We have not confirmed each vendor's no-training or retention terms.

WaterTightVM hosts and stores its production application, databases, and backups in the EU (Belgium). We do not host the service or keep primary customer storage in the United States.

Some sub-processors may process limited personal data outside the UK or EEA. In particular:

  • Stripe may process billing and payment data in the United States and other locations.
  • Google Analytics may process analytics data in the United States, only after you give consent.
  • If a company administrator enables an external AI model, the selected provider may process those prompts in the country or countries where that provider operates.
  • Xero, where a customer enables that integration, may process payroll and accounting data in New Zealand and other locations.

These transfers do not change the location of WaterTightVM's own hosting and primary storage. Where a transfer is not covered by an adequacy decision, it is protected by the Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into our Data Processing Agreement.

5A. Artificial intelligence

This section describes the software. It is not legal advice.

  • Support assistant. On the web, Help is being updated so the assistant tells you that you are interacting with an AI system before a conversation and at the start of each one. Until that update is released, the assistant chat is not shown in Help. The model runs only when an administrator has enabled it. Otherwise the assistant path returns written help text.
  • Training courses. A draft written by a model is labelled AI-generated in the product and on the course PDF once the transparency update is released. A person publishes the course. Until that update, stored drafts do not carry the AI-generated fields.
  • Certificate images. Certificate scanning is off. The upload used to add your own certificate does not scan the file. You enter the name and dates. WaterTightVM does not send the image or PDF to Google Cloud Vision. Embedded PDF and Word text can still be read on the server. That local read is not a chat model, and it is not Vertex AI.
  • Invoices, public training-provider lists, and supplier quote emails. The product can suggest text. A person reviews it before it is applied.
  • Production logging. When an external model is used, AI audit logging is enabled in the production service.
  • Decisions. These features do not, by themselves, decide that someone is medically fit, hired, or allowed to sail.

The provider named by an administrator, and that provider's retention terms, still need to be confirmed.

6. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including legal, regulatory, tax, accounting, and reporting requirements. Default retention periods for different record types are set out in our internal Data Retention Matrix and may be configured by employer customers within permitted legal floors.

6.1 Two categories of data

It is important to understand that the Services hold two distinct categories of information:

Category Examples Who typically controls it
Personal certificate vault Login account, profile, uploaded certificates, CV, covering letter, personal files in your vault WaterTightVM (and/or you)
Employer operational records Incidents, deck/engine logbooks, jobs completed, safety records, crew assignments, messages held in company systems Your maritime employer or vessel operator

These categories are treated differently when you exercise your privacy rights.

6.2 Deleting your personal certificate vault

You may export or delete your personal certificate vault at any time:

  • Mobile app: Settings → export or delete account
  • Company dashboard: User menu → Privacy & data → download export or delete account
  • Email: hello@watertight.app (we respond within 30 calendar days)

When you delete your vault account, we permanently remove your login, profile, certificates, and personal files stored for the vault from our active systems. The link between your vault and any employer crew record is cleared; we do not delete the employer’s operational history.

6.3 Employer operational records are not changed by vault deletion

When you delete your certificate vault account, employer operational records are not modified. For example, incident reports, logbook entries, safety records, and records of work you performed for an employer remain so that the employer can meet maritime compliance obligations and maintain an accurate operational history.

This approach is consistent with UK/EU GDPR. The right to erasure (Article 17) is not absolute. Processing may continue where necessary for:

  • Compliance with a legal obligation (e.g. ISM Code, MLC 2006, flag-state and industry record-keeping requirements)
  • The establishment, exercise, or defence of legal claims (e.g. litigation or investigations arising years after an event)
  • Other Article 17(3) grounds where applicable

Operational records may therefore retain your name and involvement in specific events where retention is legally required or justified. If you request erasure of employer-held operational data, we will review the request and may refuse erasure (in whole or in part) where a lawful retention ground applies, and explain our reasons in writing.

6.4 Who to contact about operational data

For access, correction, or erasure requests relating to employer operational records (incidents, logbooks, employment history on a vessel), your maritime employer or vessel operator is usually the data controller. Contact them in the first instance. We will assist where we act as their processor and where the request relates to data we hold on their behalf.

Contact hello@watertight.app for vault data and platform-level requests; we will direct you to your employer where appropriate.

6.5 Operational anonymisation (exceptional cases only)

In rare circumstances, and only after identity verification and a documented legal review, we may anonymise identifying details in operational records (for example replacing a name with a generic label) where erasure is requested, no lawful retention ground applies, and the employer as controller agrees. This is not performed when you delete your certificate vault account and is not our default response to erasure requests. Compliance and legal-defence needs normally require operational records to remain identifiable.

6.6 Hiding vs permanent deletion in company systems

When a company user removes or hides an item in the employer dashboard, that is usually a soft delete (hidden from normal view; retained for a policy period). Permanent deletion of files and database rows in company systems follows configured retention and purge rules, or explicit GDPR erasure as described above—not casual “remove” actions.

7. Your Legal Rights

Under UK and EU data protection laws, you have rights in relation to your personal data:

  • Request access to your personal data (commonly known as a "data subject access request" or DSAR).
  • Request correction of the personal data that we hold about you.
  • Request erasure of your personal data (the "right to be forgotten")—subject to the limits in Section 6, including lawful retention of employer operational records.
  • Request data portability—export your personal certificate vault data in a machine-readable format (available in-app or on request).
  • Object to processing of your personal data where we are relying on a legitimate interest.
  • Request restriction of processing of your personal data.
  • Request the transfer of your personal data to you or to a third party.
  • Withdraw consent at any time where we are relying on consent to process your personal data.

How to exercise your rights

Request What to do
Export or delete personal vault Use in-app Privacy & data (or mobile Settings), or email hello@watertight.app
Access or erasure of employer operational records Contact your employer (data controller); copy hello@watertight.app if you need help routing the request
Admin or billing account data hello@watertight.app

We aim to respond within 30 calendar days. We may ask you to verify your identity before disclosing or deleting data.

If we refuse an erasure request (for example because operational records must be retained for legal compliance or legal claims), we will explain the reasons and inform you of your right to complain to a supervisory authority.

8. Updates to this Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date and the updated version will be effective as soon as it is accessible.

Book a 30-minute call