Privacy Policy
This page always shows our current, most up-to-date privacy policy.
1.Who we are
Sailing Hat is an early-stage project, currently in a pre-launch validation phase ("Sailing Hat", "we", "us"). We are the data controller for the personal data described in this policy.
You can reach us about anything in this policy at [email protected].
2.What we collect, and why
When you join the crew through our website
| Data | Why |
|---|---|
| Your name | To reply to you personally rather than generically |
| Your email address | To contact you with occasional updates about the project |
| Your phone number (optional) | Only if you choose to give it — so we can call or message you about the project |
| Country, IP address, browser user-agent, timestamp | Recorded automatically with your submission for security, fraud prevention and to understand where interest is coming from |
When we speak on the phone
| Data | Why |
|---|---|
| The fact that we called, when, and a short note of what you told us | So we remember your boat and what you want, and so nobody calls you twice about the same thing |
| A voicemail, if you leave one | So we know when it suits you for us to call back. We note that and delete the recording |
| Your phone number as shown to us by the network | To match your message to you and to call you back. If it matches your crew list entry, we greet you by your first name |
Our calls come from +370 665 10049, and that is the number to call us on.
When you order or ask us to send you something
| Data | Why |
|---|---|
| Your postal address | So we can deliver what you have ordered or asked us to send you. You provide it at that point, and it is not collected when you join the crew list |
| Your name and a contact detail | So the delivery can be addressed to you and we can reach you if there is a problem with it |
When you sign up through an advertisement on Facebook or Instagram
The form is hosted by Meta and pre-filled from your Meta profile. We receive your name, email address, your answer about boat size, and your answer to our question about what you wish your boat could tell you.
When you visit the site
We use a self-hosted, cookieless analytics tool to count visits and see which pages and campaigns bring people here. It does not use cookies, does not track you across other websites, and does not identify you individually.
We also use Cloudflare Turnstile to check that form submissions come from a person rather than an automated script.
Advertising measurement
We use the Meta Pixel and Meta's Conversions API to measure whether our advertising works. Where the law requires it — in the EU, EEA and UK — we ask for your consent through a cookie banner first, and it does not happen if you decline. This shares with Meta a pseudonymous record of your visit and, if you sign up, an encrypted (hashed) form of your name, email address and phone number, along with your IP address, browser user-agent and Meta's own advertising identifiers. Meta may use this to measure our ads and to show you or people like you further advertising.
3.Our legal basis for using your data
| What | Basis under the GDPR |
|---|---|
| Joining the crew list and receiving updates | Your consent — Article 6(1)(a) |
| Advertising and measurement cookies and identifiers | Your consent — Article 6(1)(a) |
| Security, bot prevention, keeping records of consent | Our legitimate interests — Article 6(1)(f) |
| Delivering an order you have placed with us | Performance of a contract with you, Article 6(1)(b) |
| Sending you something you have asked for but not paid for | Your consent, Article 6(1)(a) |
| Keeping records of orders where the law requires it | Compliance with a legal obligation, Article 6(1)(c) |
| Calling you, and keeping a note of what you told us | Your consent, Article 6(1)(a), given when you left us your number |
| Keeping a voicemail you chose to leave | Your consent, Article 6(1)(a) |
You can withdraw consent at any time. Withdrawing it does not affect anything we did before you withdrew it.
4.Cookies and similar technologies
| Purpose | Set by | Requires consent |
|---|---|---|
| Bot protection on the signup form | Cloudflare Turnstile | No — strictly necessary |
| Website analytics | Our own self-hosted analytics — no cookies | No — nothing stored |
| Advertising measurement | Meta Pixel | Yes — in the EU/EEA & UK |
You can change or withdraw your choice at any time using the cookie settings link on the site, or by clearing cookies in your browser.
5.Who we share your data with
We do not sell your personal data. We share it with the following, and only for the purposes described above:
| Recipient | Role | What they handle |
|---|---|---|
| Cloudflare, Inc. | Processor | Website delivery, form processing, our leads database, bot protection, email routing, and storing a voicemail if you leave one |
| Amazon Web Services | Processor | Hosting of the static website files |
| Resend | Processor | Sending our welcome and update emails — handles your name, email address and phone number |
| Processor | The inbox that receives mail sent to [email protected], checking a postal address you give us, and turning your first name into the greeting you hear if you call us | |
| Telnyx | Processor | Carrying our phone calls |
| Address validation providers | Processor | Checking that a postal address is valid and correctly formatted |
| Postal, courier and fulfilment partners | Processor | Delivering what you have ordered or asked us to send |
| Meta Platforms Ireland Ltd | Joint controller for advertising measurement | Hashed identifiers and advertising identifiers, where you have consented |
For the Meta Pixel and Conversions API, we and Meta act as joint controllers for the collection and transmission of that data, under Meta's controller arrangements. Meta's own handling of the data afterwards is governed by its privacy policy at facebook.com/privacy/policy.
6.Sending data outside the EU/EEA
Some of the providers above process data outside the European Economic Area, including in the United States. Where that happens, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses or a provider's certification under the EU–US Data Privacy Framework.
7.How long we keep it
We keep your personal data only for as long as it is needed for the purposes described in this policy, and no longer. You can ask us to delete your data at any time (see "Your rights" below). We keep records of your consent for as long as we need them to show we had permission, and our analytics data is aggregate only.
A voicemail is deleted once we have noted when to call you back, and in any case automatically after 30 days, whether anyone remembers to delete it or not. The short note of what you told us on a call is kept with your record on the crew list, and goes when that goes.
We keep delivery details for as long as we need them to fulfil what you ordered or asked for, and to meet any record keeping the law requires of us, then we delete them. Where we are legally required to keep a record of an order, that record stays until the required period has passed, even if you ask us to delete it.
8.Your rights
Under the GDPR you have the right to access your data, correct anything inaccurate, delete it ("the right to be forgotten"), restrict or object to how we use it, receive it in a machine-readable format (portability), withdraw consent at any time, and complain to a supervisory authority.
To exercise any of these, email [email protected]. We will respond within the timeframe required by law.
If you are unhappy with how we have handled your data, you can complain to the data protection authority in the EU/EEA country where you live.
9.Keeping your data safe
The site is served over HTTPS. Signups are stored in an access-controlled database, and identifiers shared with advertising partners are hashed before they leave our systems, meaning they are not readable as your name, email address or phone number. Access to the lead records is limited to the people running Sailing Hat.
10.Children
Sailing Hat is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us their data, contact us and we will delete it.
11.Automated decision-making
We do not make any decision about you that has a legal or similarly significant effect using automated processing alone.
12.Changes to this policy
We may update this policy from time to time. The version published on this page is always our current one and applies as soon as it is posted. We do not undertake to notify you of changes, so please check this page periodically for the latest version.
← Back to sailinghat.sh