Privacy notice

Hullo is a booking service for marina moorings, with a marketplace for the businesses at each marina. Hullo decides why and how the personal data in this notice is used, and is responsible for it under the EU General Data Protection Regulation (GDPR).

When you book a mooring, the marina receives your booking and uses it to run your stay. For that use the marina is responsible for your data in its own right, under its own privacy policy. The same goes for a merchant and the orders you place with it.

For anything in this notice, write to [email protected].

• Your email address, to sign you in. Asking for a sign-in code creates your account with that address, even if the code is never used.
• Your profile: your first and last name and phone number if you give them, the language you use Hullo in, and when you last signed in.
• Your boats: name, length, beam, draft, type, registration and home port, as far as you fill them in.
• Your boat papers and crew, if you use online check-in: the papers you upload for each boat and the people you save to sail with you (details below).
• Your reviews, if you review a stay: your ratings, the title and words you write, the photos you add and the flag you choose to show (details below).
• Your bookings: the marina, the mooring, the nights, the boat's name and length, the price quoted, whether it has been paid, any notes, and a history of each change (for example who checked you in or moved you).
• Your orders with merchants: what you ordered, the boat's name, where and when to deliver it, your notes, and each change of status.
• Device tokens: if you allow notifications in one of our iPhone apps, a token for your phone so booking and order messages can reach it, with the app's version and your phone's language.
• Messages we send you: a copy of each email and notification (sign-in codes, booking confirmations and reminders, order updates, invitations), with when and to whom it went.
• If you work at a marina or merchant: your role, who invited you, and the changes you make in the portal; the business's own contact details; and the delivery address for any label order.
• Photos and files marina staff upload: photos of the marina and its moorings, shown publicly on the marina's page, and files attached in Ask Hullo, which only that marina's staff can open. Photos are re-saved without their location and camera details before they are stored.
• Ask Hullo conversations: what marina staff write to the assistant in the portal, and its replies.
• Messages between you and a marina: what you and the marina's staff write to each other, the photos and PDFs attached, the language each message is written in, its translations, and when each side read it; and the marina's broadcasts to its guests, with who they reached and how (details below).

We do not store card details (moorings are paid at the marina office), your position (when you look for moorings near you, or order from inside a marina, your phone's position is used for that one request and then dropped), or your IP address (our servers use it for a moment to limit repeated requests, and keep no record of it, except with your acceptance of a marina's terms in an online check-in).

• To give you the service you asked for (performing our contract with you, GDPR Article 6(1)(b)): signing you in, quoting and taking bookings, passing them to the marina, passing orders to merchants, sending the emails that go with them, letting you and the marina message each other, translated into each reader's language, and letting staff run their marina in the portal, Ask Hullo included.
• To keep Hullo safe and working (our legitimate interests, Article 6(1)(f)): limiting repeated sign-in attempts and requests, keeping a record of who changed what, and finding and fixing faults.
• To keep the records the law requires (legal obligation, Article 6(1)(c)): bookings, and the account between each marina and Hullo, for tax and accounting.

We do not use your data for advertising, we do not sell it, and we do not send marketing email.

• The marina you book with sees your name, email address, the boat's name and length, the nights, the booking's status and any notes. Every member of its staff signed in to the portal can see them. It does not see your phone number or your boat's other details.
• A merchant you order from sees what you ordered, the boat's name, where to deliver it and your notes. It does not see your name, email address or phone number. The marina sees the same orders.
• Colleagues at a marina or merchant see each other's name and email address in the staff list.
• The Hullo team can see accounts and their memberships to support users and run the service, and can open the portal as a marina to help it.
• Our service providers, listed in the next section, handle data on our behalf.
• Authorities, only when the law requires us to share it.

Some marinas ask for papers before you arrive, such as the boat's insurance and registration, the skipper's licence and a crew list. Hullo lets you keep them once and reuse them at every marina.

• What we keep. The papers you upload for each of your boats (the file, and the number, issuer and dates you type in), and the people you save for a boat: name, nationality, date of birth, and the type and number of their travel document. Photos of papers are re-saved without their location and camera details; PDFs are stored as you send them. Save only people who have agreed to it, and tell them how their details are used.
• Why. To check you in online with the marinas you book (performing our contract with you, GDPR Article 6(1)(b)), so the marina can run your stay and meet its own duties, such as registering its guests with the authorities.
• Who sees them. Only you, until you share them. In an online check-in you choose which papers to share with that marina for that stay and tick a consent line, and we record when you did (your consent, Article 6(1)(a)). The marina's staff can then open those papers and see the crew list you sent for the stay, your expected arrival time and your note. Another marina never sees them. The Hullo team, when it opens the portal as that marina to help it, sees what the marina sees.
• Accepting a marina's terms. When you accept a marina's terms in a check-in, we record which version you accepted, the name you typed, when, and the IP address and browser your request came from, as the record of your acceptance for you and the marina. The IP address and browser are deleted 12 months after the stay; which version you accepted, the name you typed and when are kept with the booking for as long as the booking is.
• How long. Your papers and saved crew stay in your account until you delete them, the boat or your account. A marina's access to the papers shared for a stay ends 12 months after that stay; the crew list sent for it, and the IP address and browser recorded when you accepted its terms, are deleted then. While you can still change a check-in you can stop sharing any paper, and deleting a paper ends every marina's access to it at once. We remind you by email and notification 30 days before a paper you keep with us expires.
• Deleting your account deletes your papers, their files and your saved crew, ends every marina's access to them, and removes the crew lists, notes, arrival times, IP addresses and browser details of your check-ins. The record of accepting a marina's terms (which version, the name you typed and when) stays with the booking. What a marina has already copied into its own records, such as its guest register, is the marina's to answer for.

After you check out of a stay booked on Hullo, we ask you once, by email and notification, whether you want to review it. Reviewing is up to you.

• What is public. A review is shown on the marina's page on Hullo to anyone: your ratings, the title and words you wrote, your photos, your first name and the initial of your last name, the month of your stay, your boat's length as a range (for example 10–12 m) and, only if you choose one, a country's flag. Your email address, your full name, the boat's name and the dates of your stay are never shown. Search engines may show the marina's average rating and your review.
• Why. To let skippers share their experience and choose where to moor, and to let marinas answer (our legitimate interests, GDPR Article 6(1)(f), and the service you asked for when you write a review, Article 6(1)(b)).
• Photos. Photos are re-saved without their location and camera details. They become public only while your review is on the marina's page; until then, and once a review is taken down, only you can open them.
• The marina can read every review of its marina and reply in public. It cannot change or delete a review. It, or any signed-in skipper, can report a review to Hullo. Hullo reads reports and may hide or remove a review that breaks the review policy; we tell you why by email. We record who reported a review, why, and what we decided.
• Translation. We work out which language a review is written in from its words, so readers can see it.
• "Helpful". If you mark a review as helpful, we record that you did, so it counts once; the marina and other readers see only how many people did.
• Changing and deleting. You can change your review for 14 days after you write it. Deleting your account deletes the words, photos and flag of your reviews and takes them off the marina's page, and your helpful marks; the ratings you gave stay in the marina's average, without your name, like the booking they belong to. To have a review deleted completely, write to [email protected].

You can message a marina from its page, a booking or your berth, and its staff can write to you. A marina can also send one message to many guests at once, such as a storm warning (a broadcast).

• What we keep. Each message: who sent it, when, its text, the photos and PDFs attached, the language it is written in, and when the other side read it. Translations of each message are kept so it is translated only once. For a broadcast: its text, which guests it went to (by the marina's choice: boats in port tonight, arriving today, staying in the coming days, residents or this season's guests), in which language, and whether the push and email went out.
• Why. To let you and the marina talk about your stay and to tell you about the marina (performing our contract with you, GDPR Article 6(1)(b)).
• Translation. So that each of you reads your own language, Claude, Anthropic's model, translates the text of a message the first time someone reads it in another language (and when a notification about it is sent). Only the text is sent to Anthropic, never the attachments, your name or your email address. You can always see the original. A machine translation can be wrong: if something matters, check the original.
• Who sees them. You, and every member of that marina's staff signed in to the portal or HulloDock. Another marina never sees them. The Hullo team, when it opens the portal as that marina to help it, sees what the marina sees.
• Notifications. When the marina replies we send a notification to your phone and, at most every 15 minutes per conversation, an email with the message in your language.
• How long. A conversation, its translations and its attachments are deleted 24 months after its last message; a broadcast 12 months after it was sent.
• Deleting your account deletes the text and attachments of every message you sent; the marina's conversation keeps only a "deleted user" placeholder, with the marina's own replies.

These companies process personal data for Hullo, under contracts that bind them to use it only to provide their service to us:

• Microsoft Azure (Microsoft Ireland Operations Limited) hosts the website, the API, the database and uploaded files, keeps our keys and passwords, and sends our email through Azure Communication Services. All of it runs in Azure's Sweden Central region, in the EU.
• Cloudflare runs our domain's DNS and the network in front of every Hullo site. Every request to Hullo passes through Cloudflare, which may keep copies of public pages and marina photos to serve them faster.
• Anthropic provides Claude, the model behind Ask Hullo, the assistant in the marina portal. When marina staff use it, their messages, any files they attach, and the marina records the assistant reads to answer (the marina's details, moorings and rates and, for managers, the staff list) are sent to Anthropic to write the reply. Ask Hullo does not read skippers' bookings or orders, and skippers never talk to it. Claude also translates the messages between skippers and marinas, and the marinas' broadcasts: the text of a message is sent to Anthropic to translate it into the reader's language. Attached photos and PDFs, names and email addresses are not sent.

Maps on hulloapp.com load map tiles from OpenStreetMap (tile.openstreetmap.org), the nautical layer from OpenSeaMap (tiles.openseamap.org), and the map's code from unpkg.com. Your browser asks those servers directly, so they receive your IP address and the part of the map you are looking at, under their own privacy policies. Hullo sends them nothing else.

Hullo's servers, database and uploaded files are in Microsoft Azure's Sweden Central region, in the EU.

Cloudflare carries requests through its network around the world, and Anthropic processes Ask Hullo conversations and message translations in the United States. Where personal data leaves the EU this way, the transfer is covered by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

• Sign-in codes work once, for five minutes, and are never written to the database. The email that carried a code stays in our record of messages sent.
• Your sign-in on a browser lasts 30 days, or until you sign out.
• Your account, boats, bookings and orders are kept while your account exists. Nothing is deleted automatically. You can delete a boat yourself at any time; bookings keep the boat's name and length.
• Boat papers, crew lists and online check-ins: as described above. A marina's access to the papers shared for a stay ends 12 months after the stay; the crew list sent for it, and the IP address and browser recorded with an acceptance of its terms, are deleted then. The acceptance itself (which version, the name typed and when) is kept with the booking.
• Reviews stay on the marina's page while your account exists, unless Hullo removes one under the review policy. Deleting your account deletes their words, photos and flag; their ratings stay in the marina's average without your name.
• Device tokens are removed when you sign out of the app.
• Staff invitations stop working after seven days.
• Photos and files are taken out of use as soon as staff delete them and erased from storage within seven days. A public photo may stay in Cloudflare's cache for a short while after that.
• Ask Hullo conversations are kept with the marina's account.
• Messages with a marina, their translations and attachments are deleted 24 months after the last message in the conversation. A marina's broadcasts, and the record of who they reached, are deleted 12 months after they were sent.
• Booking and payment records that a marina or Hullo must keep for tax and accounting are kept for as long as the law requires, even after an account is deleted, but without your name and email address, apart from the name you typed to accept a marina's terms, kept as the record of that acceptance.

Under the GDPR you can ask us:

• for a copy of the personal data we hold about you;
• to correct anything that is wrong;
• to delete your data;
• to restrict how we use it while a question about it is settled;
• to stop using it where we rely on our legitimate interests;
• for the data you gave us in a machine-readable form, to take elsewhere.

Write to [email protected] from the address on your account, so we can check the request is yours. It is free, and we reply within one month. You can correct your name, phone number and boats yourself in your account at any time.

Deleting your account. Write to [email protected] from the address on the account and we will delete it: your profile, your boats, your boat papers and saved crew, your sign-in, and the text and attachments of the messages you sent marinas, which stay in the marina's conversation only as "deleted user". Booking and payment records the marina and Hullo must keep are kept without your name and email address. A marina's own copy of your stay is the marina's to answer for.

Complaints. If you think we have got something wrong, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the problem happened.

Hullo uses two cookies, both needed for the site to work, and a few entries in your browser's local storage. There are no advertising or analytics cookies. The cookie notice lists each one.

Everything travels encrypted (HTTPS) between your device, Cloudflare and our servers. Access to the database and uploaded files is limited to our own services and the Hullo team, and our keys are kept in Azure Key Vault. There are no passwords to steal: you sign in with a one-time code.

Hullo is meant for adults. We do not knowingly create accounts for children.

When this notice changes, the date at the top changes too. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.

Write to [email protected] for anything about your data, and to [email protected] for everything else.