Privacy Policy

1. Introduction and Our Commitment to Privacy

HeyMariner (“HeyMariner,” “we,” “us,” or “our”) is a maritime intelligence platform serving the global maritime community from our base at Duncan Avenue, Jersey City, NJ 07304, United States. We are committed to protecting your privacy and handling your personal data with integrity, transparency, and respect for your rights. This Privacy Policy describes in detail how we collect, use, store, share, protect, and process personal data in connection with your use of our platform at heymariner.com, our mobile applications, APIs, newsletters, community features, marketplace, and all related services (collectively, the “Platform”).

This Privacy Policy applies to all users of the Platform, including registered and unregistered visitors, free-tier users, paid subscribers, maritime professionals, shipping company accounts, port authority accounts, maritime training institution accounts, and API consumers. By using the Platform, you acknowledge that you have read, understood, and agree to the data processing practices described in this Policy.

We designed this Privacy Policy to be comprehensive, clear, and accessible to our maritime community, which spans many jurisdictions and legal frameworks. We comply with applicable privacy laws in the jurisdictions where we operate, including the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents, and other applicable United States federal and state privacy laws.

HeyMariner was built and is operated by an experienced team of maritime professionals — nine Master Mariners, five Chief Engineers, seventeen Officers, thirteen Engineers, and many dedicated volunteers — who understand the unique privacy considerations that arise in a maritime context. We treat maritime operational data, voyage information, and professional credentials with the same care and confidentiality that maritime professionals expect in their professional lives.

This Privacy Policy was last updated on June 19, 2026, and supersedes all prior versions. We encourage you to review this Policy periodically, particularly if you are a registered user, as our data practices may evolve as the Platform grows. If you have any questions about this Policy or about how we handle your data, please contact us using the details in Section 16.

2. Data Controller Information

For the purposes of applicable data protection laws, including the GDPR and CCPA, HeyMariner acts as the data controller for personal data processed through the Platform. This means we are responsible for determining the purposes and means by which your personal data is processed.

Where HeyMariner engages third-party processors to process personal data on our behalf (such as our cloud infrastructure provider, email service provider, and analytics provider), those processors act as data processors under our instructions. We enter into data processing agreements with all third-party processors to ensure they provide appropriate technical and organizational measures to protect your personal data.

For privacy-related inquiries, requests to exercise your data rights, or complaints about our data handling, please contact us directly using the contact details provided in Section 16 of this Policy.

3. Information We Collect

We collect several categories of information in connection with your use of the Platform. The specific information we collect depends on how you interact with the Platform, including whether you are an unregistered visitor, a free-tier registered user, or a paid subscriber.

3.1 Information You Provide to Us

We collect information that you directly and voluntarily provide to us when you interact with the Platform:

3.2 Information Collected Automatically

When you visit or use the Platform, we and our third-party service providers automatically collect certain technical information:

3.3 Maritime Search and Query Data

In connection with the maritime intelligence features of the Platform, we collect specific categories of search and query data that are unique to a maritime platform:

3.4 Communications Data

We collect and retain records of communications between you and HeyMariner, including support tickets, help center queries, email correspondence, chat messages (where available), and any responses from our team. We also collect records of communications between Users conducted through Marketplace messaging or community direct messaging features, subject to the terms of those features. Communications data is retained for the periods described in Section 10 and may be reviewed by our team for quality assurance, compliance, and safety purposes.

4. Legal Basis for Processing

Where the GDPR or similar data protection legislation applies to our processing of your personal data, we rely on the following legal bases. For each category of processing, we identify the applicable legal basis:

5. How We Use Your Information

We use the personal data we collect for a range of purposes, all of which are consistent with the legal bases described in Section 4. The following describes the primary purposes for which we use your information:

6. Maritime-Specific Data Processing

HeyMariner processes certain categories of maritime-specific data that require additional explanation given the unique characteristics and sensitivities of the maritime industry. This section provides additional transparency about how we handle maritime operational data:

6.1 Vessel Tracking Query Data

When you search for or track a specific vessel on the Platform, we create a log entry recording the fact that your Account (or your IP address if you are not logged in) accessed position and voyage data for that vessel at a specific time. This log data serves several purposes: it allows us to provide you with your recently searched vessels; it enables us to detect abuse patterns such as systematic commercial scraping; and it may be reviewed if we receive a lawful request from a maritime authority, port state control, flag state administration, or law enforcement agency in connection with a maritime incident or investigation.

We are mindful that vessel tracking query logs may have sensitivity in certain contexts — for example, a shipping company employee's pattern of vessel tracking queries might reveal commercially sensitive information about their fleet activity or competitive intelligence gathering. We do not use individual vessel tracking query logs for commercial profiling or sell this data to third parties. Vessel tracking query data is retained for twelve (12) months and then deleted, except where specific logs are preserved pursuant to a lawful legal hold or investigation request.

6.2 Route Planning Data

Route planning data, including saved routes, voyage waypoints, and voyage planning parameters you create in the Platform, may be commercially sensitive as they could reveal cargo movements, charter party terms, or competitive voyage planning activities. We treat route planning data with heightened confidentiality and do not disclose it to any third party except: (a) where you explicitly share a route with other users through the Platform's sharing features; (b) where required by a lawful legal process; or (c) to our trusted technical infrastructure providers who process data under strict data processing agreements.

6.3 Mariner Professional Credentials

If you provide professional credential information — such as Certificate of Competency details, STCW endorsements, GMDSS operator certificates, or IMO numbers associated with a vessel under your command — this information may be used to verify your professional status for access to professional-tier Platform features. We treat professional credential data with appropriate care and do not share it publicly or with third parties without your consent, except where required by applicable law or where you have opted in to a professional verification feature.

6.4 AIS Data and Individual Privacy

AIS data displayed on the Platform relates primarily to vessels and their movements. While AIS data itself is generally public data (as AIS transmissions are broadcast on open radio frequencies), we recognize that association between specific vessels and specific individuals (such as a named master's routing patterns) may create privacy implications. We do not publicly display individual seafarers' names, STCW credentials, or personal information in connection with AIS vessel position data. Vessel-related data on the Platform identifies vessels by their IMO and MMSI numbers; personal identification of crew or officers from AIS data is not a feature we support.

7. Cookies and Tracking Technologies

HeyMariner uses cookies, web beacons, pixel tags, local storage, and similar tracking technologies to operate the Platform, understand how it is used, and to provide a personalized experience. When you first visit the Platform, you will be presented with a cookie consent notice that allows you to accept all cookies, accept only essential cookies, or customize your preferences by category.

We use the following categories of cookies:

• Essential Cookies: Strictly necessary for the Platform to function, including session authentication cookies, CSRF protection tokens, and your cookie consent preference record. These cannot be disabled without significantly impairing Platform functionality.
• Analytics Cookies: Used to understand aggregate usage patterns, measure platform performance, and guide product development. Analytics data is anonymized or pseudonymized wherever possible. Our primary analytics provider is listed in Section 8.
• Preference Cookies: Used to remember your Platform display preferences, including map style, unit system (metric/imperial/nautical), preferred timezone for AIS timestamps, and interface theme.
• Marketing Cookies: Used, where you consent, to measure the effectiveness of our marketing campaigns on platforms such as Facebook and LinkedIn, and to enable relevant advertising. Marketing cookies are only placed where you have given explicit consent.

Full details of all cookies we use, including their names, durations, purposes, and provider, are published in our Cookie Policy, available at heymariner.com/legal/cookie-policy. You can manage your cookie preferences at any time through the Cookie Settings link in our site footer.

8. Data Sharing and Third Parties

HeyMariner does not sell your personal data to third parties for their own commercial purposes. We share your personal data only in the circumstances described below:

8.1 Infrastructure and Technology Providers

8.2 Legal Disclosures

We may disclose your personal data to maritime authorities, coast guard agencies, port state control authorities, flag state administrations, law enforcement agencies, courts, or regulatory bodies where such disclosure is: (a) required by applicable law or regulation; (b) necessary to respond to a valid legal process, including a subpoena, court order, or search warrant; (c) necessary to protect the safety of any person from death or serious injury; (d) necessary to investigate, prevent, or act regarding illegal activity, suspected fraud, or violations of our Terms; or (e) required in connection with national security or intelligence activities as permitted by law.

Given the maritime nature of our Platform and the potential safety implications of maritime security incidents, we may also disclose relevant data to flag states, port states, or international maritime organizations in connection with vessel casualties, maritime pollution incidents, or maritime security threats, where such disclosure is appropriate and proportionate.

8.3 Business Transfers

If HeyMariner is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or other transaction affecting our business, personal data held by us may be among the assets transferred or disclosed to the acquiring entity. In such circumstances, we will endeavor to notify you of the transfer and the identity of the acquiring entity, and to ensure that your data is protected under terms no less protective than this Privacy Policy.

9. International Data Transfers

HeyMariner is based in the United States and our primary data processing infrastructure is located in the United States. If you access the Platform from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data protection laws that may restrict the transfer of personal data to countries not recognized as providing adequate protection, your personal data will be transferred to and processed in the United States.

The United States does not have a general adequacy decision from the European Commission for all data transfers; however, we implement appropriate safeguards for international data transfers in compliance with applicable law. Where we transfer EEA or UK personal data to our third-party processors in the United States, we ensure such transfers are subject to appropriate legal mechanisms, which may include:

• Standard Contractual Clauses (SCCs) adopted by the European Commission or equivalent mechanisms approved under UK law;
• Where applicable, the EU-U.S. Data Privacy Framework (DPF) or equivalent certification;
• Data processing agreements incorporating appropriate technical and organizational security measures.

The Platform serves a global maritime community, and your data may also be processed by our providers using globally distributed infrastructure including servers located in Europe, the Asia-Pacific region, and other locations. All international data transfers are subject to appropriate safeguards and security measures. You may request further information about the specific safeguards we apply to international transfers by contacting us using the details in Section 16.

10. Data Retention Policy

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, to resolve disputes, and to enforce our agreements. The specific retention periods for different categories of data are as follows:

After the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be linked to an identifiable individual. Where data is anonymized rather than deleted, it may be retained indefinitely as non-personal data for statistical, research, or operational purposes.

11. Your Rights

You have a number of rights regarding your personal data, which may vary depending on your jurisdiction. We are committed to facilitating the exercise of these rights promptly and without undue difficulty.

11.1 GDPR Rights (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR and UK GDPR respectively:

11.2 California Consumer Privacy Act (CCPA) Rights

If you are a California resident, you have the following rights under the CCPA and CPRA:

11.3 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us by email at heymariner@gmail.com with the subject line “Privacy Rights Request,” by phone at +1 (267) 215-2840, or by post at Duncan Ave, Jersey City, NJ 07304, United States. We will verify your identity before processing your request. We aim to respond to all privacy rights requests within thirty (30) days; for complex or multiple requests, we may extend this period by a further sixty (60) days with prior notification to you. We process all requests free of charge, except for manifestly unfounded or excessive requests where we may charge a reasonable fee.

12. Children's Privacy

The HeyMariner Platform is designed for maritime professionals, maritime students of appropriate age, and other adults engaged in or interested in the maritime industry. The Platform is not directed to, designed for, or intended for use by children under the age of thirteen (13) years, and we do not knowingly collect personal data from children under 13.

If you are under 13 years of age, you must not create an Account, register for any services, or provide any personal information through the Platform. If you are a parent or guardian and believe that your child under 13 has provided us with personal data without your consent, please contact us immediately at heymariner@gmail.com or call +1 (267) 215-2840. Upon verified notification, we will delete the child's personal data from our systems as promptly as practicable.

For users aged 13 to 17, access to certain adult professional features of the Platform may be restricted, and parental or guardian consent may be required in jurisdictions where applicable law so requires. We encourage parents and guardians of minors in this age group who are interested in maritime careers to supervise their use of the Platform and to contact us if they have any concerns.

13. Security Measures

HeyMariner takes the security of your personal data seriously. We implement a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

13.1 Encryption

All data transmitted between your browser or application and the HeyMariner Platform is encrypted in transit using Transport Layer Security (TLS 1.2 or higher). All passwords are hashed using a strong, modern cryptographic hashing algorithm with salting; we never store plaintext passwords. Sensitive data fields in our database, including payment-related data, are encrypted at rest. Our database infrastructure (Neon) provides encrypted storage for all data.

13.2 Access Controls

Access to personal data within our organization is granted on a strict need-to-know basis. Only team members who require access to perform their functions — such as technical support staff investigating a reported issue or security personnel monitoring for abuse — have access to relevant personal data. All access to production systems and databases is authenticated using multi-factor authentication and logged for audit purposes. We conduct periodic reviews of access rights to ensure they remain appropriate.

13.3 Database Security

Our primary database infrastructure (Neon) provides automated backups, point-in-time recovery, network isolation, and database-level security controls. Database connections from our application servers to the database are encrypted and authenticated. We regularly review and apply security patches to all platform components. Database access credentials are stored securely and rotated on a regular schedule.

13.4 Application Security

The HeyMariner Platform is built with security-by-design principles, including protection against common web application vulnerabilities such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and insecure direct object references. Our development team follows secure coding practices and conducts security reviews of new features before deployment. We use automated dependency scanning to identify and remediate known vulnerabilities in third-party libraries.

13.5 Incident Response

In the event of a personal data breach, we have an incident response procedure to assess, contain, and remediate the breach promptly. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. Where required by applicable law (including the GDPR requirement to notify supervisory authorities within 72 hours of becoming aware of a qualifying breach), we will fulfill our notification obligations. Despite our security measures, no system is completely impenetrable. You should also take steps to protect your Account by using a strong, unique password and by notifying us immediately of any suspected unauthorized access.

14. Third-Party Links and External Resources

The HeyMariner Platform may contain links to third-party websites, external maritime databases, chart providers, regulatory authority websites, classification society portals, maritime training institution websites, flag state administration portals, port authority websites, and other external maritime resources. These links are provided for your convenience and informational purposes only.

HeyMariner does not control these third-party websites or resources and is not responsible for their privacy practices, content, or data collection. We encourage you to review the privacy policies of any third-party website you visit through links on our Platform. The inclusion of a link on the HeyMariner Platform does not imply our endorsement of the linked website or its operator.

In particular, when you access external maritime data sources — such as official IMO document databases, Lloyd's Register, the IHS Markit Seaweb database, class society public portals, or flag state registry databases — your interaction with those external systems is governed by those organizations' own terms and privacy policies, not by this Policy. When navigating to external chart providers or NAVAREA warning services, you are leaving the HeyMariner Platform and any data you provide to those external services is processed under their own terms.

Similarly, when you follow links to our social media presence — including our Facebook page (facebook.com/Heymariner), Instagram (@heymariner), or LinkedIn page (linkedin.com/organisation/heymariner) — your activity on those platforms is governed by the respective social media platform's privacy policy, not by this Privacy Policy.

15. Changes to This Privacy Policy

HeyMariner reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, to comply with new legal requirements, to incorporate new maritime intelligence features that involve new forms of data processing, or to improve clarity and transparency. When we make changes, we will update the “Last Updated” date at the top of this Policy.

For material changes — meaning changes that significantly affect your privacy rights or the way we process your personal data — we will provide prior notice by: (a) sending an email notification to your registered email address; (b) displaying a prominent notice within the Platform; and/or (c) requesting your consent where legally required (for example, where we propose a new use of your personal data that requires consent). We will provide at least fourteen (14) days' advance notice before material changes take effect for existing registered users.

Your continued use of the Platform after a revised Privacy Policy has been posted and any required notice period has elapsed constitutes your acceptance of the revised Policy. If you do not agree to the updated Policy, you must cease using the Platform and may request deletion of your Account.

We encourage all users, particularly registered users and paid subscribers, to review this Privacy Policy periodically. Previous versions of this Policy may be requested by contacting us at heymariner@gmail.com for transparency purposes.

16. Contact Information and Data Protection Contact

For all questions, requests, concerns, or complaints relating to this Privacy Policy or to how we handle your personal data, please contact us using the following details. We are committed to responding to all privacy-related communications promptly and transparently.

We take all privacy-related requests and complaints seriously. We aim to acknowledge all contacts within 2 business days and to fully resolve requests within 30 days. For complex matters, particularly where we need to verify your identity or where multiple data processing activities are involved, we may need additional time and will communicate expected timelines to you.

17. Complaints and Supervisory Authority

If you believe that HeyMariner has not handled your personal data in compliance with applicable data protection law, we encourage you to first contact us using the details in Section 16 so that we have an opportunity to address your concern. We take all complaints seriously and will endeavor to resolve your concern promptly and fairly.

If you are not satisfied with our response, or if you prefer to raise your complaint directly with a regulatory authority, you have the right to lodge a complaint with the appropriate supervisory authority for your jurisdiction:

We work cooperatively with supervisory authorities and comply with the advice given by supervisory authorities with regard to personal data transferred from the EU and UK, consistent with applicable law.

We appreciate that you trust HeyMariner with your personal data, and we are committed to that trust through transparent, lawful, and responsible data stewardship. Our maritime community is built on the professional values of integrity, safety, and mutual respect that define the best of the maritime profession — and we bring those same values to how we handle your data.