Privacy Policy

The data controller responsible for your personal information is:

This Privacy Policy applies to all personal data processed through the xplor platform, including the FairSeas crew revenue participation programme, Fleet Builder referral programme, and all charter facilitation services.

2.1 Information you provide directly. We collect personal information when you register for an account, complete your profile, enrol in FairSeas programmes (crew, owner, Fleet Builder, client), submit verification documents, make or receive payments, contact support, or participate in surveys or promotions.

This may include: full name, email address, phone number, date of birth, nationality, government-issued identification (passport, visa), employment documentation, maritime certifications (STCW, ENG1), yacht and vessel details, banking and payment information, and any other information you choose to provide.

2.2 Information collected automatically. When you access the platform, we may automatically collect device information (type, operating system, unique identifiers), IP address and approximate location, browser type and version, usage data (pages visited, features used, time spent), referral source, and cookies and similar tracking technologies.

2.3 Financial information. For payment processing and revenue participation disbursements, we collect bank account details, payment card information, and transaction history. Payment processing is handled by our secure third-party processor, Stripe, in accordance with PCI-DSS compliance standards. xplor does not store full payment card numbers on its servers.

2.4 FairSeas programme data. For crew participating in the FairSeas revenue participation programme, we additionally collect crew roster certifications, charter reference data, Crew Distribution Statement records, and (where CRI+ weighted distribution is used and explicit consent is given) performance data, qualifications, length of service, and contribution assessments.

2.5 KYC and compliance data. To comply with applicable Know Your Customer (KYC), Anti-Money Laundering (AML), and sanctions screening requirements, we may collect and process identity verification documents, tax identification numbers, and screening results.

We process your personal data on one or more of the following legal bases:

• Contract performance. Processing necessary to perform our contract with you, including account management, charter facilitation, and revenue participation calculations and disbursements under the FairSeas Agreement.
• Legitimate interest. Processing necessary for our legitimate business interests, including platform security, fraud prevention, service improvement, and analytics — where those interests are not overridden by your data protection rights.
• Legal obligation. Processing necessary to comply with applicable laws, including UAE data protection requirements, KYC/AML regulations, tax reporting obligations, and records retention requirements.
• Consent. Where you have given explicit consent, including for CRI+ performance data collection, marketing communications, and optional analytics cookies. You may withdraw consent at any time.

We use the information we collect to:

• Create and manage your account and platform profile.
• Process charter bookings and related transactions.
• Calculate, generate, and distribute Crew Revenue Participation Pool allocations under the FairSeas Agreement.
• Process Fleet Builder referral tracking and earnings calculations.
• Verify your identity and credentials for programme enrolment and KYC/AML compliance.
• Generate Crew Distribution Statements and Charter Reference ID (CRID) transparency records.
• Send administrative communications, updates, and security alerts.
• Respond to your enquiries, comments, and support requests.
• Monitor and analyse usage trends to improve platform services.
• Detect, prevent, and address fraud, technical issues, and security threats.
• Comply with legal obligations and enforce our terms.

We may share your information in the following circumstances:

5.1 Service providers. With third-party vendors who perform services on our behalf, including payment processing (Stripe), cloud hosting, data analytics, email delivery, identity verification, and customer support. These providers are contractually required to protect your information and may only use it for the purposes we specify.

5.2 FairSeas participants. Within the FairSeas ecosystem, relevant information is shared between yacht owners, management companies, crew members, and xplor to facilitate charter operations and revenue participation calculations. This includes crew roster data shared with Captains and owners for Crew Distribution Statement approval, and charter summary data visible on CRID transparency pages (which do not include personally identifiable information such as crew names, banking details, or individual allocation amounts).

5.3 Fleet Builder programme. Referral tracking data is processed to attribute crew sign-ups to Fleet Builders and calculate earnings. Fleet Builders do not receive access to the personal data of referred crew members beyond confirmation of successful referral.

5.4 Legal requirements. When required by law, regulation, court order, or legal process, or to protect the rights, property, or safety of xplor, our users, or the public.

5.5 Business transfers. In connection with any merger, acquisition, sale of assets, financing, or transfer of all or a portion of our business, your information may be transferred to the acquiring entity.

5.6 With your consent. Where you have given explicit consent to share your information for a specific purpose.

We do not sell your personal information to third parties.

We use cookies and similar technologies to collect information about your activity on the platform.

6.1 Essential cookies. Required for core platform functionality, including authentication, session management, and security. These cannot be disabled.

6.2 Analytics cookies. Help us understand how visitors interact with the platform to improve user experience. These may be disabled.

6.3 Preference cookies. Remember your settings and preferences for future visits.

You can control cookies through your browser settings. Disabling certain cookies may limit platform functionality. For detailed information, see our Cookie Notice at xplor.io/cookies.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including:

• TLS encryption for all data in transit.
• Encryption of sensitive data at rest (including banking details and identity documents).
• Role-based access controls and multi-factor authentication for platform administration.
• Regular security assessments and vulnerability testing.
• Employee and contractor training on data protection obligations.
• Incident response procedures for data breach detection and notification.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is fully secure. We cannot guarantee absolute security but will notify you promptly in the event of a data breach that affects your rights, as required by applicable law.

Depending on your location and applicable data protection laws (including the EU General Data Protection Regulation and UAE Federal Decree-Law No. 45 of 2021), you may have the following rights:

• Access. Request a copy of the personal information we hold about you.
• Rectification. Request correction of inaccurate or incomplete data.
• Erasure. Request deletion of your personal information, subject to legal retention requirements.
• Restriction. Request that we restrict the processing of your data in certain circumstances.
• Portability. Request transfer of your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest grounds.
• Withdraw consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Marketing opt-out. Unsubscribe from marketing communications at any time using the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact us at privacy@xplor.io. We will respond within thirty (30) days of receiving your request. We may request identity verification before processing your request.

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

9.1 We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with legal obligations.

9.2 Specific retention periods include:

• Account data: retained for the duration of your account and for ninety (90) days after deletion, except where longer retention is required by law.
• FairSeas financial records: crew distribution statements, payment records, charter reference data, and CRID transparency records are retained for a minimum of seven (7) years to comply with tax, audit, and regulatory requirements.
• KYC/AML records: identity verification documents and screening results are retained as required by applicable UAE and international regulations.
• CRI+ performance data: deleted within thirty (30) days of a crew member withdrawing consent for CRI+ participation, unless retention is required for dispute resolution.

9.3 When data is no longer required, it is securely deleted or anonymised. Anonymised data that cannot be used to identify individuals may be retained indefinitely for statistical and analytical purposes.

10.1 xplor is based in the United Arab Emirates. Your information may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards.

10.2 When we transfer personal data outside the UAE or the European Economic Area, we implement appropriate safeguards including standard contractual clauses approved by relevant authorities, adequacy decisions, or other lawful transfer mechanisms to ensure your information receives adequate protection.

10.3 Our primary data hosting is provided by services operating under industry-standard security certifications (SOC 2, ISO 27001).

Our services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@xplor.io and we will take steps to delete such information.

The platform may contain links to third-party websites or services that are not operated by xplor. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access through the platform.

13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or for operational reasons.

13.2 Material changes will be communicated by posting the updated policy on the platform and updating the effective date. Where required by law, we will notify you directly (for example, by email) before changes take effect.

13.3 Your continued use of the platform after the updated policy takes effect constitutes acceptance of the revised terms.

14.1 This Privacy Policy is governed by the laws of the United Arab Emirates, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and where applicable, the EU General Data Protection Regulation (GDPR).

14.2 Any disputes relating to this Privacy Policy shall be resolved in accordance with the dispute resolution provisions in the xplor Terms of Service.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

We aim to respond to all privacy-related enquiries within thirty (30) days.