Privacy policy

1. Who we are

YachtMuster (“we”, “us”) operates yachtmuster.net, a recruitment platform and community for professional yacht crew. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Latvian Personal Data Processing Law, the data controller is:

• SIA "OZ Style"
• Registration number: 40103634763
• Rīga, Pūces iela 43 - 25, LV-1082, Latvia
• crew@yachtmuster.net

Questions, requests or complaints: crew@yachtmuster.net, or via our contact form.

2. The data we collect

• Account data — name, email address, password (stored only as a secure hash), account type and sign-in history.
• Profile data — the positions you seek, experience and sea time, vessels served, availability, notice period, city and country, profile photo, and your CV if you upload one.
• Certificates and documents — the tickets you store in your document vault (for example STCW, CoC, visas) together with their expiry dates.
• Medical fitness documents — if you upload an ENG1 or an equivalent seafarer medical certificate. See section 4.
• Applications — which positions you applied to, when, and their status.
• Community content — forum threads, posts and reactions, reviews you write (including those you publish anonymously), marketplace listings, daywork posts, and private messages you exchange with other members.
• Job alerts — the positions, region and minimum salary you ask to be told about, so we can email you when a matching vacancy is posted. Delete an alert at any time and the emails stop.
• Employer data — for employer accounts, your company and vessel details and the postings you create.
• Technical data — IP address, browser type and pages visited, kept in server logs for security and troubleshooting.
• Aggregate visitor statistics — page views and referrers, collected without cookies and without any identifier that could single you out. See section 10.

3. Why we use it, and our lawful basis

• To provide the service — creating your account, showing your profile to employers you apply to, running applications, messaging and the forum. Basis: performance of a contract with you.
• To keep the platform safe and genuine — email verification, moderation, fraud and spam prevention, enforcing our rules. Basis: legitimate interests in a trustworthy community.
• To send service messages — verification and password emails, application updates, notifications, certificate expiry reminders, and the job alerts you set up yourself. Basis: contract and legitimate interests. These aren't marketing: you asked for them, and each can be switched off individually.
• To send marketing such as a jobs digest or newsletter. Basis: consent, which you can withdraw at any time.
• To take payment for memberships, job adverts and advertising. Basis: contract and legal obligation for tax and accounting records.
• To comply with the law — responding to lawful requests and keeping required records. Basis: legal obligation.

4. Medical and other sensitive documents

An ENG1 or equivalent seafarer medical certificate is health data — a “special category” of personal data that receives extra protection in law. We handle it on the basis of your explicit consent, given when you choose to upload it.

You are never required to upload a medical certificate to use YachtMuster. If you do, it is stored in your document vault and is shown to an employer only where you apply to their position or otherwise choose to share it. You may delete it at any time from Certificates & documents, and doing so withdraws your consent for us to keep it.

5. Who we share it with

• Employers and recruiters — when you apply to a position, that employer receives your profile, CV and the documents attached to your application. Crew who set themselves available may also appear in employer candidate searches.
• The public — forum threads and marketplace listings are visible to everyone, including people without an account, and are indexed by search engines. What is shown is the content you wrote, any photos you attached, your display name and your profile photo. Reading the forum is open to all; posting, replying, reacting and messaging still require an account. Only post what you are happy for the world to see. You can delete your own forum posts and listings at any time, though search engines may keep a cached copy for a while afterwards.
• Other members — non-anonymous reviews show your display name and photo to signed-in members. Reactions you leave on a forum post are visible as a count to everyone, and which emoji you chose is visible to you and to moderators.
• Service providers who process data on our behalf under contract, each bound by a data-processing agreement and permitted to use your data only on our instructions:
  • Vercel — hosting and delivery of the website.
  • Neon — the database holding your account, profile and community content.
  • Cloudflare R2 — storage of the files you upload, in two separate places:
    • a private bucket for your CV, certificates and any medical document. It is not publicly accessible: those files can only be retrieved through this site, after we have checked you are entitled to see them.
    • a public bucket for your profile photo and any photos you attach to a forum post or a marketplace listing. These are published deliberately — the forum and the marketplace are public — so they are served from an ordinary web address that anyone with the link can open, the same as the page they appear on.
    Both are restricted to the European Union.
  • Resend — sending the emails described in section 3.
  • Stripe — card payments, once paid plans begin. See section 6.
• Authorities — where we are legally required to disclose.

We do not sell your personal data, and we do not share it with advertisers. Advertising on YachtMuster is sold by placement, not by targeting individuals.

6. Payments

Card payments are handled entirely by our payment processor. We never see, receive or store your full card details — only a customer reference and the status of your subscription or purchase.

7. International transfers

Your data is processed within the European Economic Area wherever possible. The documents you upload — CV, certificates and any medical certificate — are held in storage restricted to the European Union, and our database is hosted in the EU.

Some of our providers are incorporated outside the EEA and may process limited data (such as server logs or email delivery) elsewhere. Where data is transferred out, we rely on the safeguards permitted by Chapter V of the GDPR — an adequacy decision of the European Commission, or the Commission's Standard Contractual Clauses together with any additional measures the transfer requires.

8. How long we keep it

• Account, profile and documents — for as long as your account is open. Delete your account and we remove them, save for the narrow exceptions below.
• Applications — retained by the employer you applied to as their own record.
• Community content — forum posts, reviews and marketplace listings are deleted with your account.
• Moderation records — where a moderator removes something, we keep a record of what was removed and why, so we can explain the decision if you challenge it and so that a suspension cannot be avoided by closing an account and opening a new one. Basis: legitimate interests in a safe platform. If you delete your account, these records are stripped of your name, your identifier and the content itself, leaving only the fact that an item of that kind was removed on that date.
• Content you delete yourself — removed immediately. We log only that a post, listing or review of yours was deleted, and when. We do not keep a copy of what it said.
• Records required by law — invoices and accounting records are kept for the period required by Latvian accounting and tax law, generally five years.
• Server logs — a short rolling window for security purposes.

9. Your rights

Under the GDPR you have the right to:

• Access a copy of your data — available instantly from Privacy & my data.
• Rectify anything inaccurate — edit your profile at any time.
• Erase your data — delete your account from the same page.
• Port your data — the export is machine-readable JSON.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent at any time, including for marketing and for any medical document you uploaded.

We answer requests within one month, as the GDPR requires. If you are unhappy with our response you may lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), or with the supervisory authority in your own EU country of residence or workplace.

10. Cookies and third-party content

We use a small number of strictly necessary cookies only: a sign-in session cookie that keeps you logged in, and a preference stored in your browser that remembers light or dark mode. We do not use advertising, tracking or third-party analytics cookies, so there is nothing here to opt out of. If that ever changes we will ask for your consent first and update this policy.

We also serve every asset — including our fonts — from our own domain, so loading a page makes no request to an outside server.

For visitor statistics we use Vercel Web Analytics, which is cookieless by design: it sets nothing on your device, uses no persistent identifier, and does not track you across other websites. It records aggregate page views only. Because it stores nothing on your device and builds no profile, it needs no consent banner — but we tell you about it here because you have a right to know.

11. Security

Data is transmitted over encrypted connections and passwords are stored as salted hashes, never in plain text. Documents in your vault are never public and can never be reached by a direct link — every download is checked first. They can be opened by you; by an approved employer, either while your profile is set visible to employers or where you have applied to their position; and by our moderators where we have to investigate a report or answer a lawful request. An employer account we have not yet approved reaches no crew documents at all.

Your profile is visible to employers by default. You can turn that off at any time in your profile settings; after that, only employers whose positions you have actually applied to keep access to your CV and certificates, so hiding your profile never breaks an application you have already sent. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach without undue delay.

12. Children

YachtMuster is for working professionals and is not intended for anyone under 16. We do not knowingly collect data from children; contact us if you believe we have.

13. Changes

We will update this page when our practices change and revise the date at the top. Material changes will be notified to you in the app or by email.

See also our terms of service.