Privacy Notice

1. Who we are and our role

We are the data controller for personal data about account holders, users and website visitors, and we decide why and how it is processed. Where you upload personal data about your own crew or third parties into the Service, you act as controller for that content and we act as your processor, processing it on your instructions to provide the Service.

Contact: hello@fullaheadmaritime.com. Billing enquiries: ceo@fullaheadmaritime.com.

2. What we collect, why, and on what legal basis

• Account data (name, email, organisation name, password hash, role) — to create and administer your account and provide the Service. Legal basis: performance of a contract.
• Fleet content (vessels, equipment, maintenance jobs, certificates, evidence documents and any personal data you place in them) — to deliver the Service. Legal basis: performance of a contract; for third-party data you upload, your own legal basis as controller.
• Support communications (messages, attachments) — to answer your requests. Legal basis: contract and legitimate interests in supporting customers.
• Usage and telemetry (pages viewed, feature usage, audit log entries, timestamps) — to secure, debug and improve the Service. Legal basis: legitimate interests.
• Device and technical data (IP address, browser and device identifiers, error reports) — for security, fraud prevention and reliability. Legal basis: legitimate interests and legal obligation.
• Marketing preferences — to send product updates where you have asked for them. Legal basis: consent, withdrawable at any time.

AI features: prompts and the fleet data needed to answer them are sent to our AI provider to generate regulatory summaries and insights. Before anything is sent, both the instructions and the data are checked: pattern-matched contact details and identification numbers (emails, phone numbers, passport and seaman's book numbers, bank, national and tax identifiers, precise personal positions) are redacted — names and free text are not removed, any request containing a credential is refused, and the request is recorded (without its text) — if that record cannot be written, nothing is sent. We do not use your fleet content to train publicly available models.

3. Who we share data with

• Service providers and subprocessors — hosting, database, email delivery, AI inference, error monitoring and support tooling, under written data-processing terms.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal, accounting and audit, where necessary.
• Authorities — where required by law or to establish, exercise or defend legal claims.
• A successor — in a merger, acquisition or sale of the business.

We do not sell personal data.

4. International transfers

We are based in Cyprus (EU). Some of our providers process data outside the EEA. Where that happens, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses together with appropriate supplementary measures. You can request details of the safeguards used.

5. Retention

We keep account and fleet data for as long as your account is active, and for 30 days after termination to allow export, after which it is deleted or anonymised. Audit log and security records may be kept for up to 12 months. Records required for tax and accounting are kept for the period required by Cypriot law (generally six years).

6. Your rights

Under the EU GDPR you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing.

Contact hello@fullaheadmaritime.com to exercise any of these rights; we respond within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority where you live or work.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest for stored data, row-level access controls that isolate each organisation's data, role-based permissions, audit logging and least-privilege access for administrators. No system is perfectly secure, but we will notify you and the relevant authority of a personal data breach where legally required.

8. Cookies, analytics and local storage

We use strictly necessary cookies and browser storage to keep you signed in, to remember preferences (including your analytics choice), and to cache your fleet data for offline use at sea. These are required for the Service to work and are always on.

Analytics run only if you choose "Accept analytics". Your choice covers Google Analytics, HubSpot and our own first-touch campaign-source attribution (described below), and nothing else. Until you accept, neither service is loaded, nothing is sent to Google or HubSpot, and no attribution is recorded. If you accept, we load Google Analytics 4 (provided by Google) to measure which pages are used. Google sets its own analytics cookies and, like any website you connect to, receives your IP address and browser details when your browser contacts it; we ask Google not to use the data for advertising. We send Google the page address without any extra details after the "?" except campaign tags (such as utm_source), and we never send your email, name or phone number. We do not fingerprint devices, we do not record what you type or how you move the mouse, and we do not buy or enrich data about visitors.

First-touch campaign-source attribution. Only if you choose "Accept analytics", this site remembers in your browser, for the current session, the public page you first landed on (the page path only, never anything after the "?"), the referring website (the site address only, not the page) and any campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term). If you then send us a form or create an account, these items are stored with that enquiry or account so we know which page or campaign brought you. Nothing is recorded for sign-in, password reset, invitation, claim or verifier pages, or inside the signed-in app. Attribution is not needed to use the Service. Choosing "Essential only", or withdrawing your choice, removes these items from this browser and stops any further recording.

Separately, we keep an anonymous daily count of requests to public pages, grouped by date, broad request classification, channel, page group and broad source category. This aggregate counter operates independently of your analytics choice. It does not identify an individual or link requests to an account; the aggregate record does not retain visitor IP addresses, raw browser names, full page addresses or raw referrers.

HubSpot. Only if you choose "Accept analytics", we also load the HubSpot tracking code (provided by HubSpot, Inc., our CRM provider) for our HubSpot account. It sets HubSpot cookies (such as hubspotutk, __hstc, __hssc and __hssrc) and records the pages you visit on this site, the time of the visit and the referring site; like any website you connect to, HubSpot receives your IP address and browser details. We send HubSpot the page address without anything after the "?" except campaign tags, and we never send it your email, name, account number or vessel details from this site. HubSpot may associate your visits with a contact or company already recorded in our CRM when its tools can match them, for example after you submit a form or reply to an email from us. It cannot identify every visitor, and most visits remain anonymous. HubSpot processes tracking and customer data on our instructions as our processor, and keeps it while it is in our HubSpot account; for some of its own purposes, however, HubSpot acts as a separate controller under its own published privacy policy and data-processing terms — including where data collected by its tracking code is used to improve its products and its commercial datasets (which applies when Intent data access is enabled for an account). In those cases HubSpot decides the purposes and retention itself, so that retention is not wholly controlled by us. Our own banner is the only consent banner on this site: it decides whether the HubSpot code loads at all, and we pass your choice to HubSpot (analytics only; no advertising or functionality cookies); we delete contact records on request (see "Your rights"). See HubSpot's privacy policy at legal.hubspot.com/privacy-policy. Choosing "Essential only" keeps HubSpot off; withdrawing tells HubSpot not to track this browser (it keeps a small "do not track" cookie for that purpose) and removes the HubSpot tracking cookies for this site.

Embedded video. Our explainer film is shown as a still image until you press play. Only when you press play is the video loaded from YouTube (Google), which may then receive your IP address and device and browser details and may set cookies or similar identifiers.

Separate custom visitor recorder remains disabled. Accepting analytics does not activate Full Ahead's custom first-party visitor recorder. The anonymous aggregate request counter described above is a separate record and is not affected by this choice. The custom visitor recorder creates no visitor or session identifiers, sends no custom visitor events and does not link visitor history to your account on sign-in. Legacy visitor identifiers and permission receipts are removed from this browser. This recorder remains off until its separate technical and security checks, including abuse prevention, have been independently approved. Any future activation will require a separate release and an updated disclosure.

Google Analytics data follows the retention set in our Google Analytics property. You can change or withdraw your choice at any time with "Cookie settings" at the bottom of every page. Withdrawing stops analytics and removes Google Analytics and HubSpot tracking cookies for this site; it does not erase data already received by those providers. Requests already in progress may finish after withdrawal. You can ask us to erase applicable records (see "Your rights"). You can also clear cookies and site data in your browser settings, though this will sign you out and remove offline data.

9. Children

The Service is intended for business use and is not directed to children under 16.

10. Changes

We may update this notice. Material changes will be announced in the app or by email before they take effect.