Privacy Policy

2.1 Account Data

When a crew account is created by the platform administrator, we collect:

• Full name
• Email address
• Role (captain, purser, chief stew, chef, or crew)
• The vessel the account is associated with

When a guest account is created via invite code, we collect:

• Full name
• Email address
• The vessel and trip the guest is associated with

2.2 Guest Preference Data

Guests and crew may enter the following information about guests aboard:

• Dietary requirements and allergies
• Drink preferences
• Activity preferences
• Wellness and spa preferences
• Special occasions (birthdays, anniversaries)
• Cabin assignment
• VIP notes (crew-entered, not visible to guests)

This data persists across charter visits and is associated with the guest's account.

2.3 Vessel Operational Data

Crew members may enter the following vessel and trip data:

• Trip itineraries and daily schedules
• Daily meal menus and allergen flags
• Wellness and spa session schedules
• Drinks and cocktail menus
• Water toy availability
• Crew profiles including photos and biographical information
• Safety briefing content and photos
• Guest safety acknowledgment records

2.4 Vessel Position Data

If a vessel position is manually entered by the captain or purser, we store:

• Latitude and longitude coordinates
• The timestamp of the last update
• The derived timezone from those coordinates

This data is used solely to display vessel position and derive local weather conditions within the app.

2.5 Technical Data

We automatically collect limited technical data when you use the platform:

• Authentication session tokens (via Supabase)
• Browser type and device type
• IP address (logged by our hosting infrastructure, not stored by AuraMar directly)

We do not use advertising trackers, third-party analytics cookies, or behavioural tracking of any kind.

4.1 Multi-Tenant Architecture

AuraMar is built on a strict multi-tenant architecture. Each vessel's data is completely isolated from all other vessels on the platform. No crew member, guest, or administrator on one vessel can access data belonging to another vessel under any circumstances.

4.2 Role-Based Access Within a Vessel

Within a vessel, access to data is governed by role:

• Captain, purser, and chief stew have full access to all operational data including guest preferences and VIP notes
• Chef and crew have limited read access to relevant operational data
• Guests can view their own preferences and trip information only. They cannot view other guests' data, VIP notes, or crew-only information

4.3 Platform Administrator Access

The AuraMar platform administrator (Alina Wellness Ventures, LLC) has access to vessel subscription records and billing information only.

The platform administrator does NOT have access to vessel operational data (guest preferences, itineraries, VIP notes, or any other charter data) for vessels not subscribed to the Ongoing Concierge Service.

4.4 Ongoing Concierge Service

Vessels subscribed to the Ongoing Concierge Service explicitly authorise Alina Wellness Ventures, LLC to access their operational data solely for the purpose of delivering the contracted service. This access is governed by the Ongoing Concierge Service Agreement signed at the time of subscription.

5.1 Supabase (supabase.com)

Our database, authentication, and file storage infrastructure. All data entered into AuraMar is stored on Supabase's servers. Supabase is SOC 2 Type II certified and GDPR compliant. Their privacy policy is available at supabase.com/privacy.

5.2 Data Docked (datadocked.com)

When AIS vessel tracking is active, vessel MMSI or IMO numbers may be sent to Data Docked to retrieve live vessel position data. No personal guest or crew data is shared with Data Docked.

5.3 Lovable (lovable.dev)

AuraMar is built and hosted on the Lovable platform. Lovable's privacy policy is available at lovable.dev.

6.1 Active Subscriptions

Data is retained for the duration of the active subscription and for 30 days following cancellation to allow for data export.

6.2 After Cancellation

All vessel data including guest preferences, itineraries, crew profiles, and all associated records are permanently and irreversibly deleted 60 days after subscription cancellation. This deletion is automated and cannot be reversed.

6.3 Guest Accounts

Guest accounts and persistent preference data are deleted as part of the vessel data deletion process 60 days after the vessel's subscription is cancelled.

6.4 Inactive Accounts

Crew and guest accounts that have not been active for 24 months may be deleted at our discretion following 30 days written notice to the registered email address.

7.1 Right of Access

You may request a copy of the personal data we hold about you by contacting alina@auramarapp.com.

7.2 Right to Rectification

You may request that inaccurate data be corrected. Guest preferences can be updated directly within the app. Other corrections can be requested via alina@auramarapp.com.

7.3 Right to Erasure

You may request that your personal data be deleted. Requests will be fulfilled within 30 days. Note that deletion of a guest account will remove all associated preference data permanently.

7.4 Right to Data Portability

You may request an export of your data in a portable format by contacting alina@auramarapp.com.

7.5 Right to Object

You may object to the processing of your personal data by contacting alina@auramarapp.com. In most cases this will require account deletion as data processing is necessary to provide the service.

7.6 GDPR Rights (EU and UK Residents)

If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR including the right to lodge a complaint with your local data protection authority.