Privacy Policy

Last updated: 2 July 2026

This Privacy Policy explains what personal data BoatStays Ltd ("BoatStays", "we", "us") collects, why we collect it, how we use it, who we share it with, and the rights you have over it. BoatStays is the data controller for personal data processed through the platform.

Contact for privacy matters: privacy@boatstays.org.

1. Data we collect

  • Account data: name, email address, password hash, profile photograph.
  • Owner data: boat details and photographs, BSS certificate and insurance references, payout account details held by Stripe.
  • Identity verification data: where required, a reference to a government-issued identity document to verify your identity and prevent fraud. We minimise retention of raw identity documents (see Section 6).
  • Booking data: booking dates, vessel, guest counts, pricing, payment status, and messages exchanged between owner and guest.
  • Payment data: processed and stored by Stripe. We receive confirmation of payment status but do not store full card numbers or sort codes.
  • Review data: written reviews and star ratings submitted by members following a completed booking.
  • Communications data: emails and other correspondence sent to us at help@boatstays.org or privacy@boatstays.org.
  • Skipper chat data: when you message Skipper, our in-app assistant, we store the question you sent, the page you sent it from, an anonymous session ID generated in your browser, your browser user-agent and the timestamp. We do not link this to your account and we use it to improve help content and the assistant.
  • Technical data: IP address (truncated where possible), device type, browser type, and referring URL collected at the server level.
  • Usage data: aggregate page views and key events recorded by Plausible Analytics, a privacy-first, cookieless tool that collects no personal data or IP addresses.
  • Session data: your sign-in session is stored in your browser's local storage (not a cookie), containing an encrypted token that identifies your logged-in session.
  • Calendar sync data: where Owners connect a third-party listing platform (such as Airbnb, VRBO or Holray) via iCal, we import anonymous "busy" blocks (start date, end date, and an opaque event ID). We do not receive the names, contact details, or payment details of guests booked through those third-party platforms.
  • Fraud-prevention data: where you pay by card, we use 3-D Secure authentication in partnership with your card issuer. The result of that check (pass, fail, or challenged) is stored against the booking. We may also use device and behavioural signals surfaced by Stripe Radar to score payment risk.

2. How we use your data

  • To operate the platform: creating and managing accounts, listing boats, processing bookings, releasing payouts, and facilitating owner-guest communication.
  • To verify identity: checking that members are who they say they are, to prevent fraud and protect the community.
  • To send transactional communications: booking confirmations, cancellations, payment receipts, payout notifications, and security alerts.
  • To resolve disputes: investigating reported problems and administering our dispute resolution process.
  • To prevent fraud and abuse: detecting and preventing fraudulent listings, payment fraud, and unsafe activity on UK waterways.
  • To comply with legal obligations: tax reporting and responding to lawful requests from public authorities.
  • To improve the product: analysing aggregate, non-identifying usage data and Skipper chat questions to improve features and help content.
  • For marketing: where you have given explicit consent, sending newsletters and updates. You can withdraw consent at any time.

3. Legal bases for processing (UK GDPR)

  • Contract performance (Article 6(1)(b)): processing account data, booking data, and payment data to fulfil our contract with you and to facilitate the hire contract between owners and guests.
  • Legitimate interests (Article 6(1)(f)): running and securing the platform, preventing fraud, resolving disputes, communicating service updates, and improving the platform (including analysing Skipper chat questions). We balance these interests against your rights and use only the data necessary for each purpose.
  • Legal obligation (Article 6(1)(c)): processing required to comply with tax reporting obligations, anti-money-laundering regulations, or requests from law enforcement.
  • Consent (Article 6(1)(a)): optional marketing communications. Where consent is the legal basis, you may withdraw it at any time without affecting prior processing.

4. Who we share your data with

  • Stripe: payment processing and Connect payouts. Stripe is FCA-authorised and complies with UK GDPR for any US data transfers via standard contractual clauses.
  • Email delivery provider: to send transactional emails under a data processing agreement.
  • Hosting and infrastructure: cloud infrastructure located in the UK or EEA wherever possible.
  • Plausible Analytics: cookieless analytics processing within the EEA, collecting no personal data.
  • AI provider for Skipper: the text of your Skipper messages is sent to a third-party large language model provider in order to generate a reply. No account identifier is sent. Providers are bound by their own data processing terms and do not use your messages to train their models.
  • Stripe Identity (identity verification): where you complete identity verification, a reference to your government-issued ID document is processed by Stripe Identity, a service provided by Stripe. We receive the verification outcome (pass, fail, requires review) and a reference ID; we do not store the raw document image. Stripe Identity is covered by Stripe's data processing agreement and UK GDPR safeguards.
  • Third-party listing platforms (calendar sync): where you connect an external iCal feed, we fetch anonymous availability blocks from that platform. We do not share your personal data with them and they do not share their guests' personal data with us.
  • The other party to a booking: once a booking is confirmed, the other party's first name, profile photo, and necessary contact details are shared to enable handover.
  • Law enforcement and public authorities: where required by law, court order, or lawful request from HMRC, the Canal & River Trust, or the police.
  • Business transfers: if BoatStays is sold or restructured, your data may transfer to a successor entity under the same protections.

We do not sell, rent, or broker your personal data to third parties.

5. International data transfers

Some providers transfer data outside the UK. We only transfer personal data internationally where an adequate level of protection is in place:

  • Stripe transfers data to the US under standard contractual clauses (SCCs) approved by the ICO.
  • Plausible Analytics processes data within the EEA, which the UK has determined provides adequate protection.
  • Any other international transfers use UK-approved SCCs or are covered by an ICO adequacy decision.

You can request further information about transfers and safeguards by emailing privacy@boatstays.org.

6. Data retention

  • Account and booking data: 7 years from account closure, to meet HMRC tax and accounting obligations.
  • Identity verification documents: raw document images deleted within 30 days of verification. A record of verification date and outcome is retained for 7 years.
  • Communications and dispute records: 6 years from the date of communication or dispute resolution.
  • Skipper chat logs: up to 12 months, then deleted or aggregated.
  • Technical and server log data: up to 12 months, then aggregated or deleted.
  • Marketing consent records: 3 years from the date consent was given or last refreshed, or until withdrawn.
  • Closed accounts: personal data no longer required for legal or accounting purposes is deleted or anonymised within a reasonable period after closure.

7. Your rights under UK GDPR

  • Right of access: request a copy of the personal data we hold about you.
  • Right to rectification: ask us to correct inaccurate or incomplete data.
  • Right to erasure: ask us to delete your data where it is no longer necessary (subject to legal retention obligations).
  • Right to restrict processing: ask us to pause processing in certain circumstances.
  • Right to data portability: receive your data in a structured, machine-readable format.
  • Right to object: object to processing based on legitimate interests or for direct marketing.
  • Right to withdraw consent: withdraw consent at any time where consent is the legal basis.
  • Automated decision-making: we do not use fully automated decision-making with significant effects. If introduced, we will update this policy and provide appropriate rights.

To exercise any right, email privacy@boatstays.org. We will respond within one calendar month. We may verify your identity before fulfilling a request.

If you believe we are processing your data unlawfully, you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Marketing communications

We only send marketing emails where you have given us explicit consent via a clearly labelled opt-in checkbox during registration. We do not use pre-ticked boxes.

To unsubscribe:

  • click the unsubscribe link in any marketing email;
  • visit your account settings on the platform; or
  • email privacy@boatstays.org with the subject line "Unsubscribe".

Withdrawing consent does not affect delivery of transactional emails relating to your bookings, account security, or payments.

9. Cookies and local storage

BoatStays minimises browser storage. We do not use tracking, advertising, or profiling cookies and do not display a cookie consent banner because we set no non-essential cookies.

  • Sign-in session (local storage): an encrypted session token stored in your browser's local storage, not a cookie. Strictly necessary for the platform to function. Clear it at any time via your browser's storage settings, which will sign you out.
  • Skipper session ID (local storage): a random anonymous ID generated in your browser so we can group your Skipper questions across a single visit. Not a cookie, not shared with third parties, and clearing your browser storage removes it.
  • Stripe payment cookies: when you initiate a booking payment, Stripe sets strictly necessary cookies to process the payment securely. These are exempt from consent under UK PECR.
  • Plausible Analytics (cookieless): cookieless, privacy-first analytics using no cookies, collecting no personal data, and unable to track you across websites. No consent required.

10. Skipper, our AI assistant

Skipper is an in-app chatbot that answers questions about BoatStays. A few specifics:

  • Conversations are not persisted in your account. Closing the window clears the chat.
  • We store the question text, the page you sent it from, an anonymous session ID, your browser user-agent and a timestamp so we can improve help content and the assistant. We do not store Skipper's replies, and we do not link these logs to your account.
  • The question text is sent to a third-party AI provider in order to generate a reply. Providers do not use your messages to train their models.
  • Please do not share passwords, payment details, or sensitive personal information with Skipper. For anything account-specific, email support@boatstays.org.
  • Skipper is an AI and can make mistakes. For booking, payment or safety matters, always rely on the official pages or contact support.

11. Children's data

BoatStays is not directed at children under 18. Account registration requires confirmation of age. If we become aware we have collected data from a person under 18 without parental consent, we will delete it promptly. If you believe we hold such data, please contact privacy@boatstays.org immediately.

12. Security

  • Encryption of data in transit using TLS (HTTPS).
  • Encryption of sensitive data at rest in our database.
  • Row-level access controls so personal data is accessible only to those with a legitimate need.
  • A least-privilege principle for internal access to production systems.
  • Regular security reviews of the platform and its dependencies.

No system is perfectly secure. Use a strong, unique password and enable any two-factor authentication we make available.

12.1 Data breach notification

In the event of a breach likely to risk your rights and freedoms, we will notify you without undue delay (Article 34, UK GDPR) and notify the ICO within 72 hours (Article 33, UK GDPR).

13. Third-party links and services

The platform may contain links to third-party websites. This Privacy Policy does not apply to those sites. We are not responsible for their privacy practices and encourage you to read their policies.

14. Changes to this policy

We may update this Privacy Policy as the platform evolves or legal requirements change. We will notify registered members of material changes by email. The current version is always at boatstays.org/privacy.

15. Contact and questions

For any questions, to exercise your data rights, or to make a privacy-related complaint, email privacy@boatstays.org. You can also contact the ICO at ico.org.uk or on 0303 123 1113.