Privacy Policy

Who we are

Yahts4You is a job-search assistant for yacht crew. It is run by the operator named at the top of this page, who is the controller of your personal data. Write to the contact address above with any privacy question or request.

What we collect

• Account details: name, email address, password hash, sign-in records.
• Profile: contact details, location, nationality, languages, work history, certificates, visas, preferences and the documents you upload.
• Applications: the jobs you apply to, the exact email, CV version and attachments sent, and their status history.
• Email: if you connect Gmail, OAuth tokens (encrypted), and for replies to your applications only — sender, subject, date, the reply text and a short AI summary. Emails unrelated to your applications are not kept.
• Telegram: if you link the bot, your Telegram chat ID, username and chosen language.
• Billing: your Stripe customer reference, subscription status and invoice history. Card details are handled by Stripe and never reach us.
• Technical data: IP address and browser details in security logs, used for rate limiting and abuse prevention.

Why we use it

• To provide the service you signed up for (contract): matching, document generation, sending and tracking applications, notifications.
• To keep the service secure and prevent abuse (legitimate interest): audit logs, rate limiting.
• To keep invoices and records the law requires (legal obligation).
• To send product news only if you opted in (consent), which you can withdraw in Account & Privacy.

Gmail access

Connecting Gmail is optional and separate from creating an account. You choose the permissions: sending (gmail.send) and reading replies (gmail.readonly). We use them only to send the applications you approve or that Auto Apply sends under your rules, and to find replies to those applications. You can disconnect Gmail at any time in Gmail settings or in your Google account.

Google user data and Limited Use

Yahts4You's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the features you see in the app. We do not use it for advertising, do not sell it, and do not use it to train AI models. Our AI provider processes the text of replies only to classify and summarise them for you. People at Yahts4You do not read your Gmail data unless you ask us to for support, it is needed for security, or the law requires it.

AI processing

To read your CV, tailor documents and classify replies, the relevant text is sent to our AI provider (Google Gemini or Anthropic Claude, depending on configuration) under their paid API terms, which do not allow them to use this data to train their models. AI output is checked against your confirmed profile before it is used.

Telegram

If you link Telegram, notifications — including the text of employer replies — are delivered through Telegram and stored by Telegram under its own privacy policy. You can unlink Telegram at any time in Notifications; email notifications then take over.

Who we share it with

• Employers and recruiters receive the applications you send.
• Service providers that process data on our behalf under data processing agreements: our hosting provider (named above), Google (Gemini AI, Gmail API), Anthropic (if Claude is used), Stripe (payments), Telegram (only if you link it), our email delivery provider for system emails, and our file storage provider.
• Authorities, only when the law requires it.
• We do not sell personal data.

International transfers

Some providers process data outside the EU/EEA, for example in the United States. These transfers rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or on the Commission's Standard Contractual Clauses.

How long we keep it

• Account, profile, documents and applications: while your account exists. Cancelling your subscription does not delete them.
• Reply summaries not linked to an application: 30 days.
• Expired sessions and one-time links: 7 days after expiry.
• Backups: up to 30 days, then overwritten.
• Deleting your account removes your data and stored files immediately, except records we must keep by law (for example invoices). Copies in backups disappear within 30 days.

Cookies

We use only strictly necessary cookies: one that keeps you signed in and one that remembers your language. Your theme and job board filters are stored in your browser. We do not use analytics or advertising cookies, so we do not ask for cookie consent.

Your rights

You can access and export your data (Account & Privacy → Download my data), correct it in Profile, restrict or object to processing, withdraw consents, disconnect integrations and delete your account. For anything else, write to the contact address above; we answer within one month. You can also complain to the data protection authority in your country.

Age

Yahts4You is for adults. You must be at least 18 to create an account.

Security

Passwords are hashed, OAuth tokens are encrypted, files are kept in private storage and downloaded through short-lived links after an ownership check, and access to administrative tools is restricted and logged.

Changes

If we change this policy in a way that matters, we tell you by email or in the app before the change takes effect.