Privacy Policy

1. INTRODUCTION This Privacy Policy describes how Turbo Yachts ("Turbo Yachts", "we", "us", or "our") collects, uses, discloses, and protects information about you when you use our website, mobile applications, and related services (collectively, the "Platform") to discover, book, or operate yacht charter trips. By creating an account or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform. 2. WHO THIS POLICY APPLIES TO The Platform is used by three categories of users: (a) Customers - individuals who book yacht charter trips (b) Owners - yacht owners and operators (also referred to as "Captains") who list yachts, set availability, and operate trips (c) Administrators - employees and contractors of Turbo Yachts who operate the Platform This Policy applies to all three categories. Where a section applies only to a specific category, it is noted accordingly. 3. INFORMATION WE COLLECT 3.1 Information you provide to us Account information - Full name - Email address - Phone number - Password (stored as a one-way hash; we never see your plain password) - Profile photo (optional) - Role (Customer or Owner) Yacht listing information (Owners only) - Yacht name, description, specifications, capacity - Photos and media of the yacht - Marina / home port location and coordinates - Pricing, add-ons, cancellation policy selection - Insurance information (where applicable) Booking information (Customers) - Trip date, time, duration, pickup location, party size - Add-on selections and special requests - Messages exchanged with the Owner through our in-app chat - Reviews you write about Owners and yachts Payment information - Billing name and address - Payment card details are collected and processed directly by our payment processor (Stripe) and are NOT stored on our servers. We retain only a payment-processor customer reference, the last four digits of the card, the brand, and the expiry date, for the purpose of displaying your saved payment methods and reusing them for authorized transactions. Identity and verification information (where applicable) - Government-issued ID, captain license, or other documents we may request to verify Owners or, for higher-value bookings, Customers 3.2 Information we collect automatically Device and usage data - IP address, device identifiers, browser type, operating system - Pages viewed, features used, time stamps - App crash reports and diagnostic logs Location data - Approximate location derived from IP - When a trip is in progress and you are the Captain, we collect precise GPS location from your device and share it with the Customer (and any "trip share" link recipients) for the duration of the trip. Captains may pause this only by ending the trip. - Customer-side location is collected when the Customer opts in to share their pickup location with the Captain. Cookies and similar technologies - Session cookies for keeping you signed in - Functional cookies for preferences (language, currency) - Analytics cookies (subject to the choices described in Section 9) 3.3 Information from third parties - Payment processor confirmations and dispute notifications (Stripe) - Email delivery status from our transactional email provider - Map and geocoding providers (returning place names for coordinates you submit) 4. HOW WE USE INFORMATION We use the information described above to: (a) Provide and operate the Platform: create your account, list yachts, take bookings, process payments and refunds, capture security deposit holds, settle post-trip charges, transmit messages between Customer and Captain, deliver location updates during a trip, and issue receipts and invoices. (b) Operate the trip-day flow: send OTPs to confirm trip start, share live GPS location during the trip, generate trip share links for family and friends, and surface trip status to all parties. (c) Handle post-trip charges and disputes: enable Captains to submit proof of fuel, damage, or overtime charges; notify the Customer; manage the 24-hour customer dispute window; and allow our Administrators to resolve disputes. (d) Settle payments: capture security deposit holds, debit shortfalls via off-session card charges with 3-D Secure authentication when required, and pay out net amounts to Owners. (e) Communicate with you: send booking confirmations, OTPs, payment receipts, trip reminders, dispute notices, and other transactional messages. We may also send service announcements and, where you have consented, marketing messages (which you can withdraw at any time). (f) Maintain trust and safety: verify identities, detect fraud, prevent abuse, enforce our Terms of Service, and comply with legal obligations. (g) Improve the Platform: analyze usage patterns, debug, conduct research, and develop new features. 5. WHY WE ARE PERMITTED TO PROCESS YOUR INFORMATION We process personal information for the following purposes: - To perform our contract with you - to operate the Platform, complete bookings, deliver trips, and settle payments; - To comply with our legal obligations - including U.S. federal and state tax, anti-money-laundering, payment-card-network, and consumer-protection requirements; - For our legitimate business interests - fraud prevention, Platform security, product improvement, and defense of legal claims; - With your consent - for marketing communications, precise location sharing, and certain non-essential cookies. You can withdraw consent at any time. 6. HOW WE SHARE INFORMATION We share information only as described below. We do NOT sell your personal information. 6.1 With the other party to a booking Customers and the Owner of the relevant yacht see each other's first name and profile photo, trip details, in-app messages, and (during a live trip) location updates. After a trip, both parties may see the published portion of each other's reviews (with author name reduced to first name and last initial on public pages). 6.2 With our service providers We share information with vendors that operate parts of the Platform on our behalf, including: - Stripe (payments, deposit holds, refunds, chargebacks) - Email delivery providers - Cloud hosting, storage, and database providers - Mapping, geocoding, and weather providers - Customer support tooling These providers may use your information only to perform services for us and are bound by confidentiality obligations. 6.3 With trip share recipients If a Customer generates a trip share link, anyone who opens the link can see the live trip status and location until the trip ends or the link is revoked. 6.4 With Administrators Our Administrators can access bookings, messages, charges, and account data where necessary to resolve disputes, prevent fraud, or operate the Platform. 6.5 For legal reasons We may disclose information to comply with a subpoena, court order, regulatory demand, or law, or to protect the rights, property, or safety of Turbo Yachts, our users, or the public. 6.6 In a corporate transaction If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections. 7. WHERE WE PROCESS YOUR INFORMATION Turbo Yachts is a United States service. Your information is stored and processed on cloud infrastructure operated in the United States by our service providers (including, without limitation, Stripe and our hosting, email, and analytics vendors). The Platform is intended for use within the United States; if you access it from outside the United States, you do so on your own initiative and are responsible for compliance with any applicable local law. 8. DATA RETENTION We retain personal information for as long as your account is active and for a reasonable period afterward to: - comply with tax, accounting, and other legal obligations - resolve disputes and enforce agreements - prevent fraud and abuse Typical retention windows (to be confirmed by client legal counsel): - Account data: while account is active + [X] years after closure - Booking and payment records: [X] years (tax / financial regulations) - In-app messages: [X] years after the related booking ends - Trip GPS tracks: [X] months after trip end - Marketing logs: until you withdraw consent Some information is retained in backups for a limited period after it is deleted from production systems. 9. YOUR PRIVACY CHOICES AND RIGHTS Subject to applicable U.S. state law, you have the following rights with respect to the personal information we hold about you: - to know or access the categories and specific pieces of personal information we have collected, used, disclosed, and retained; - to correct inaccurate personal information; - to delete your personal information, subject to legal, accounting, fraud-prevention, and dispute-resolution retention requirements; - to opt out of "sales" or "sharing" of personal information (we do not sell or share your personal information for cross-context behavioral advertising, but if this changes we will provide an opt-out as required); - to opt out of targeted advertising, profiling, or processing of sensitive personal information where state law provides this right; - to withdraw consent where processing is based on consent; - to designate an authorized agent to submit a request on your behalf, where state law permits; - to be free from retaliation for exercising any of these rights. California residents have additional rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the "Shine the Light" right to request information about disclosures to third parties for direct-marketing purposes. Residents of other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) have the rights granted under those laws. To exercise these rights, contact us at the address in Section 13 or through the privacy controls in your account settings. We will respond within the time frame required by applicable law. We may need to verify your identity before acting on your request. Notice of Financial Incentive: We do not offer financial incentives in exchange for personal information. 10. SECURITY We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS), encryption at rest for sensitive fields, hashed passwords, role-based access controls for Administrators, and PCI-compliant payment processing through Stripe. No system is perfectly secure; you are responsible for keeping your password confidential and for promptly notifying us of any suspected compromise of your account. 11. CHILDREN The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA). The Platform's services are intended for users 18 and older. If you believe a child under 13 has provided us with personal information, please contact us at the address in Section 13 and we will delete it. 12. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Platform before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was most recently revised. 13. CONTACT US If you have questions about this Privacy Policy or our handling of your information, please contact us: Entity: Turbo Yachts Address: Miami, Florida Email: info@theturboyachts.com Support: info@theturboyachts.com