Privacy Policy

YachtApply ("we", "us") operates the website and service at yachtapply.com. For the purposes of the EU/UK General Data Protection Regulation (GDPR) and South Africa's Protection of Personal Information Act (POPIA), we are the controller / responsible party for the personal information described in this policy.

Operator detail to complete: insert the registered legal entity name, registration number, and registered address here before this policy is relied upon publicly. If you process data of South African residents, POPIA requires a registered Information Officer — name and contact details for that person go here too.

Account & profile. Email address, a hashed password (we never store your password itself), full name, phone number, gender (used only to filter role-appropriate listings), your CV file, and structured data our system extracts from it (roles, certifications, regions, skills).

Job preferences. Target roles, work types, regions, certifications, skills, and minimum salary you set to control matching and auto-apply.

Email connection metadata. If you connect Gmail or Outlook, we store the connection's encrypted OAuth tokens and your connected address only. We request send-only permission (gmail.send / Mail.Send) — we cannot and do not read your inbox, contacts, or any other mail.

Billing. Subscription status and transaction records. Card details are entered directly with Stripe and never touch our servers.

Job listings. To build the job feed, we process posts from public Facebook groups to identify genuine vacancies. See section 4 for how this works and what we do with the posts of people who are not YachtApply users.

• Contract — creating your account, matching you to jobs, and sending applications through your connected mailbox, all necessary to provide the service you signed up for.
• Consent — connecting a Gmail/Outlook mailbox, which you grant and can revoke at any time from your Account page.
• Legitimate interest — aggregating publicly posted job vacancies from Facebook groups into a single searchable feed, balanced against the retention and redaction limits in section 4.

Some listings on YachtApply are identified from posts made in public Facebook groups by people who are not YachtApply users and have not interacted with us directly. We take the following steps to limit what we retain about them:

• Once a post is processed, we automatically strip email addresses and phone numbers from the stored post text. Only the job-relevant contact method needed to apply is kept as part of the listing itself.
• Posts that don't turn out to describe a vacancy are permanently deleted after 90 days.
• We never scrape or store the identity (name, profile, or photo) of the person who made the post — only the content of public job-related posts.

If you posted in one of these groups and want a listing sourced from your post removed, contact us (section 9) and we will remove it.

We use the following processors to run the service. None of them are permitted to use your data for their own purposes.

• Account and profile data: until you delete your account.
• CV file: until you remove it from your profile or delete your account — either action deletes the file from storage, not just the reference to it.
• Facebook-sourced posts that produced a job listing: contact details are redacted from the stored post as described in section 4; the listing itself is retained as long as it's part of the job feed.
• Facebook-sourced posts that were not job listings: deleted after 90 days.
• Billing records: retained per applicable tax and accounting record-keeping requirements.

Under GDPR and POPIA you have the right to access, correct, delete, and export your personal data, and to object to or restrict how we process it. In practice:

• Access & export — download everything we hold about your account as JSON from Account → Data & Privacy.
• Correction — edit your profile directly at any time.
• Deletion — permanently delete your account, profile, CV, and all associated records from Account → Danger Zone. This also revokes any connected Gmail/Outlook authorization with the provider.
• Objection / complaint — contact us using the details in section 9. You may also lodge a complaint with your local data protection supervisory authority, or with South Africa's Information Regulator if POPIA applies to you.

Passwords are hashed, never stored in plain text. OAuth tokens for connected mailboxes are encrypted at rest. The site is served entirely over HTTPS. Access to production systems is limited to the operator.

For any question about this policy or to exercise a data right, email info@yachtapply.com.

We'll update the date at the top of this page when this policy changes. Material changes will be communicated by email where we hold one for you.