Privacy Policy

The data controller responsible for your personal information is:

This Privacy Policy applies to all personal data processed through the xplor platform, including yacht discovery, crew profiles, marine services, and the introduction of prospective clients to yacht industry professionals.

2.1 Information you provide directly. We collect personal information when you register for an account, complete your profile, submit an enquiry, list or claim a yacht, submit verification documents, make or receive payments, contact support, or participate in surveys or promotions.

This may include: full name, email address, phone number, date of birth, nationality, government-issued identification (passport, visa), employment documentation, maritime certifications (STCW, ENG1), yacht and vessel details, banking and payment information, and any other information you choose to provide.

2.2 Information collected automatically. When you access the platform, we may automatically collect device information (type, operating system, unique identifiers), IP address and approximate location, browser type and version, usage data (pages visited, features used, time spent), referral source, and cookies and similar tracking technologies.

2.3 Financial information. For payment processing, we collect bank account details, payment card information, and transaction history. Payment processing is handled by our secure third-party processor, Stripe, in accordance with PCI-DSS compliance standards. xplor does not store full payment card numbers on its servers.

2.4 Enquiry data. Where you submit a charter or sales enquiry, we collect the details of your requirement, the vessels you have indicated an interest in, and a record of which professional your enquiry was passed to and when.

2.5 KYC and compliance data. To comply with applicable Know Your Customer (KYC), Anti-Money Laundering (AML), and sanctions screening requirements, we may collect and process identity verification documents, tax identification numbers, and screening results.

We process your personal data on one or more of the following legal bases:

• Contract performance. Processing necessary to perform our contract with you, including account management, responding to your enquiry, and passing your enquiry to a professional able to fulfil it.
• Legitimate interest. Processing necessary for our legitimate business interests, including platform security, fraud prevention, service improvement, and analytics — where those interests are not overridden by your data protection rights.
• Legal obligation. Processing necessary to comply with applicable laws, including UAE data protection requirements, KYC/AML regulations, tax reporting obligations, and records retention requirements.
• Consent. Where you have given explicit consent, including for marketing communications and optional analytics cookies. You may withdraw consent at any time.

We use the information we collect to:

• Create and manage your account and platform profile.
• Process charter bookings and related transactions.
• Pass your enquiry to a licensed professional able to respond to it, and maintain a record of that introduction.
• Verify your identity and credentials for programme enrolment and KYC/AML compliance.
• Send administrative communications, updates, and security alerts.
• Respond to your enquiries, comments, and support requests.
• Monitor and analyse usage trends to improve platform services.
• Detect, prevent, and address fraud, technical issues, and security threats.
• Comply with legal obligations and enforce our terms.

Crew experience and anonymous yacht statistics. When you confirm your crew experience, we may note, for each job, the yacht, your role and how many months you served, and add yachts we don't have on xplor yet to an internal list of yachts to add. These records hold nothing that identifies you: no name, contact details, dates or link back to your profile. We use them only inside xplor, as statistics about yachts.

We may share your information in the following circumstances:

5.1 Service providers. With third-party vendors who perform services on our behalf, including payment processing (Stripe), cloud hosting, data analytics, email delivery, identity verification, and customer support. These providers are contractually required to protect your information and may only use it for the purposes we specify.

5.2 Introductions to professionals. Where you submit a charter or sales enquiry, we may pass your name, contact details and the details of your enquiry to a licensed broker, central agent or other yacht industry professional (a "Professional") so that they can respond to you. We rely on the performance of our contract with you, and on our legitimate interest in operating an enquiry service, as the lawful basis for this disclosure, and we will seek your consent first where consent is required. We pass your details only to Professionals who have executed the Standing Introduction Agreement. Once your details are passed, that Professional becomes an independent controller of your personal data, is responsible for its own compliance with applicable data protection law, and must provide you with its own privacy notice. xplor is not responsible for how a Professional subsequently processes your data. Professionals may be located outside the United Arab Emirates and outside the European Economic Area; where that is the case, the transfer mechanisms described in Section 10 apply.

5.3 Verifying introductions. We keep a record of each introduction, comprising your name, the requirement described, the date and time, and the identity of the recipient. We may contact you to confirm whether a charter or sale proceeded and with whom, in order to verify whether an introduction fee is payable by the Professional. You are under no obligation to respond, and your response has no effect on any transaction you have entered into. You may object to your details being passed to a Professional, or withdraw consent where consent is the basis relied upon, by contacting privacy@xplor.io — this will mean we cannot pass your enquiry to anyone able to fulfil it.

5.4 Legal requirements. When required by law, regulation, court order, or legal process, or to protect the rights, property, or safety of xplor, our users, or the public.

5.5 Business transfers. In connection with any merger, acquisition, sale of assets, financing, or transfer of all or a portion of our business, your information may be transferred to the acquiring entity.

5.6 With your consent. Where you have given explicit consent to share your information for a specific purpose.

We do not sell your personal information to third parties.

We use cookies and similar technologies to collect information about your activity on the platform.

6.1 Essential cookies. Required for core platform functionality, including authentication, session management, and security. These cannot be disabled.

6.2 Analytics cookies. Help us understand how visitors interact with the platform to improve user experience. These may be disabled.

6.3 Preference cookies. Remember your settings and preferences for future visits.

6.4 Bridge without an account. If you ask Bridge a question without signing in, we use Cloudflare Turnstile to protect the service against bots; Cloudflare processes information about your browser and device for that check under its Turnstile privacy addendum. Once the check passes, we set an essential first-party cookie holding a random visitor identifier, valid for seven days, which counts your free answers each day and keeps your conversation for seven days so it can move into your account if you sign up or sign in. To limit misuse we also count answers per network, using only a one-way hash of your IP address that changes every day; the IP address itself is not stored.

You can control cookies through your browser settings. Disabling certain cookies may limit platform functionality. For detailed information, see our Cookie Notice at xplor.io/cookies.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including:

• TLS encryption for all data in transit.
• Encryption of sensitive data at rest (including banking details and identity documents).
• Role-based access controls for platform administration.
• Regular security assessments and vulnerability testing.
• Employee and contractor training on data protection obligations.
• Incident response procedures for data breach detection and notification.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is fully secure. We cannot guarantee absolute security but will notify you promptly in the event of a data breach that affects your rights, as required by applicable law.

Depending on your location and applicable data protection laws (including the EU General Data Protection Regulation and UAE Federal Decree-Law No. 45 of 2021), you may have the following rights:

• Access. Request a copy of the personal information we hold about you.
• Rectification. Request correction of inaccurate or incomplete data.
• Erasure. Request deletion of your personal information, subject to legal retention requirements.
• Restriction. Request that we restrict the processing of your data in certain circumstances.
• Portability. Request transfer of your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest grounds.
• Withdraw consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Marketing opt-out. Unsubscribe from marketing communications at any time using the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact us at privacy@xplor.io. We will respond within thirty (30) days of receiving your request. We may request identity verification before processing your request.

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

9.1 We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with legal obligations.

9.2 Specific retention periods include:

• Account data: retained for the duration of your account and for ninety (90) days after deletion, except where longer retention is required by law.
• Introduction and financial records: introduction records, invoices and payment records are retained for the tail period set out in the Standing Introduction Agreement plus three (3) years, and in any event for a minimum of seven (7) years where required to comply with tax, audit, and regulatory requirements.
• KYC/AML records: identity verification documents and screening results are retained as required by applicable UAE and international regulations.

9.3 When data is no longer required, it is securely deleted or anonymised. Anonymised data that cannot be used to identify individuals may be retained indefinitely for statistical and analytical purposes.

9.4 The anonymous yacht statistics described in section 4 (and, for outreach, section 16) are not removed when you delete a job from your profile or delete your account: nothing in them links back to you, so there is nothing of yours to find and remove.

10.1 xplor is based in the United Arab Emirates. Your information may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards.

10.2 When we transfer personal data outside the UAE or the European Economic Area, we implement appropriate safeguards including standard contractual clauses approved by relevant authorities, adequacy decisions, or other lawful transfer mechanisms to ensure your information receives adequate protection.

10.3 Our primary data hosting is provided by services operating under industry-standard security certifications (SOC 2, ISO 27001).

Our services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@xplor.io and we will take steps to delete such information.

The platform may contain links to third-party websites or services that are not operated by xplor. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access through the platform.

13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or for operational reasons.

13.2 Material changes will be communicated by posting the updated policy on the platform and updating the effective date. Where required by law, we will notify you directly (for example, by email) before changes take effect.

13.3 Your continued use of the platform after the updated policy takes effect constitutes acceptance of the revised terms.

14.1 This Privacy Policy is governed by the laws of the United Arab Emirates, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and where applicable, the EU General Data Protection Regulation (GDPR).

14.2 Any disputes relating to this Privacy Policy shall be resolved in accordance with the dispute resolution provisions in the xplor Terms of Service.

15.1 What we collect. If you choose to connect an Instagram Business or Creator account to your xplor listing, we collect and store your Instagram username (handle), Instagram Business Account ID, a secure access token used to retrieve your media, and the URLs and captions of your recent public posts for display on your listing page. We do not collect your Instagram password, private messages, follower lists, or any data beyond what is necessary to display your public feed.

15.2 How we use it. Instagram data is used solely to display your recent public posts on your xplor listing page. We do not analyse, sell, or share your Instagram data with third parties. Your posts are refreshed automatically on a periodic basis using your stored access token.

15.3 Legal basis. Processing is based on your explicit consent, given at the time you initiate the Instagram connection via our OAuth flow. You may withdraw consent at any time by disconnecting your Instagram account.

15.4 Disconnecting. You can disconnect your Instagram account at any time from your listing management page. Disconnecting immediately deactivates your access token and removes your Instagram feed from your listing. Residual data (such as access logs) may be retained for up to 30 days before permanent deletion.

15.5 Data deletion. To request permanent deletion of all Instagram data we hold, visit xplor.io/legal/instagram-deletion or email privacy@xplor.io. We will action all deletion requests within 30 days.

15.6 Meta Platform compliance. Our use of the Instagram API is governed by Meta's Platform Terms and Developer Policies. We request only the minimum permissions required to display your public feed (instagram_business_basic). We do not request permissions to publish content, send messages, or access private data on your behalf.

16.1 What this is. Yacht crew sometimes post their CV in public places, such as online yacht crew jobs groups for yacht jobs, asking to be contacted about work. A member of the xplor team may choose one of those CVs by hand and send that person one email about live yacht jobs that fit their rank. We never collect CVs automatically, and a person writes and sends every email.

16.2 What we read. We read the CV once, in memory, to find your name, email address, rank, certificate names, a short summary of your experience (roles, yacht sizes and years), where you are and whether you're available. An AI service (Anthropic) reads it for us. We don't ask it for, and we don't keep, your date of birth, nationality, medical details, identity documents, or any contact details other than your email. We don't store the CV file.

16.3 Why. To tell someone who has publicly said they're looking for yacht work about live jobs that fit them, and where to see the rest on xplor. Our legal basis is legitimate interest (section 3).

16.4 What we keep. Only a one-way code made from your email address (a hash, which can't be turned back into the address) and one made from your name and rank, with the date, the rank, the jobs we showed you, and which campaign it was. We use the email code so we don't email you again within 12 months, and the name-and-rank code only to warn our team that someone may already have been contacted under a different email. We delete these records after 12 months. The email itself stays in our mailbox (info@xplor.io, hosted by Google) like any other email. We don't create an xplor account or profile for you; only you can do that.

16.5 Already on xplor. If your email address already belongs to an xplor account, we don't send you this email. We check that without storing anything new about you.

16.6 Opting out. Reply "no thanks" to the email, or use the link in it, and we won't contact you again. To keep that promise, we keep the one-way code of your email on a do-not-contact list; it can't be turned back into your address. You can also object, or ask what we hold about you, at privacy@xplor.io (see section 8).

16.7 Yachts and lengths of service. If your CV names a yacht we don't have on xplor, we add the yacht's name (and its length and type, if shown) to an internal list of yachts to add, with no link to you or your CV. We may also note yacht names, roles and lengths of service, and where a yacht cruised (regions, ports, and the season and year if your CV gives them), with nothing that identifies you; these are used only inside xplor.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

We aim to respond to all privacy-related enquiries within thirty (30) days.