Privacy policy

1. Who we are

AbleSeafarer is responsible for the personal information described here. For anything about your data, including the requests in section 9, email admin@ableseafarer.com. We reply within 30 days.

2. What we collect

Your account

• Your name, or your company's name, and your email address.
• Your password, stored only as a one-way hash. We cannot read it.
• Whether you use AbleSeafarer as a seafarer or as a company.

If you sign in with Google or LinkedIn

The provider tells us your name, email address, whether it has verified that address, a link to your profile photo, and an account identifier. We never see your password for that service, and we ask for no access to your contacts, posts or files.

Seafarer profiles

• Name, date of birth, nationality, country and city of residence, and phone number.
• Rank, sea service, certificates, English level, availability, expected salary, and the summary you write.
• Documents you upload: certificates, your CV, a passport-style photo, and your seaman's book. These can contain identity and document numbers.

Company profiles

• Company name, registration number, country, city, website, contact email and phone, description, and logo.
• Registration documents you upload so we can verify the company.
• The vacancies you publish.

Technical information

• For each signed-in session: your IP address and your browser's user-agent string, so you and we can spot sessions that aren't yours.
• IP addresses, held briefly, to limit repeated sign-in attempts and document downloads.
• A record of administrative actions, such as approving a company, for accountability.
• Anonymous page-view statistics. See cookies and analytics.

3. Why we use it

We use your information only to run AbleSeafarer, on these legal bases:

• To provide the service you signed up for (contract): creating your account, showing your profile to companies you apply to, publishing vacancies, and sending account emails such as confirmation links and password resets.
• Legitimate interests: keeping accounts secure, preventing fraud and abuse, verifying that companies are real before they can recruit, and understanding in aggregate how the site is used.
• Legal obligations: where the law requires us to keep or disclose information.

We do not sell your information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

4. Who can see it

Companies

Your seafarer profile is shared with a company when you apply to one of its vacancies. Your uploaded documents stay hidden until that company moves your application to shortlisted or beyond. If the application moves back, access is withdrawn immediately: every document view is checked against the application's current status and served through a link that expires within a minute. A company that saves or downloads a copy is responsible for that copy under its own privacy obligations.

The public

A company's name, logo, description and website appear on its published vacancies. Seafarer profiles and documents are never public.

Our administrators

A small number of AbleSeafarer staff can access account information to verify companies, answer support requests, and investigate abuse.

Service providers

These companies process data on our behalf, under contracts that limit them to our instructions:

• Hetzner: hosts the application and its database in the European Union.
• Amazon Web Services: stores uploaded documents and encrypted database backups in Frankfurt, Germany.
• Mailgun: sends account emails from its EU region.
• Cloudflare: routes email sent to our contact address.
• Umami: provides the cookieless page-view statistics described below.
• Google and LinkedIn: only if you choose to sign in with them.

We may also disclose information where the law requires it, or to protect the safety of our users.

5. International transfers

We store your data in the European Union. When you apply to a company based outside the EU, your profile, and later your documents, go to that company because you asked us to send them; that is necessary to pursue the job you applied for. Where a service provider can access data from outside the EU, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard.

6. How long we keep it

• Your account and profile: for as long as your account is open. We delete them within 30 days of a deletion request.
• Documents you delete: removed from the service at once. A recoverable copy is kept for up to 90 days to protect against accidental loss, then erased.
• Backups: encrypted database backups are kept for 30 days, so deleted data disappears from them within 30 days.
• Sessions: expire after 30 days, or when you sign out.
• Administrative records: kept for as long as they are needed for security and accountability.

7. Cookies and analytics

We use only the cookies the site needs to work, so there is no cookie banner:

• A session cookie that keeps you signed in, for up to 30 days.
• A short-lived sign-in cookie that protects the Google or LinkedIn sign-in step. It expires after five minutes.

Page-view statistics come from Umami, which sets no cookies and stores no personal data. It counts which pages are viewed and from what kind of browser, device and country, without identifying you.

8. Security

All traffic is encrypted in transit. Documents are stored encrypted in private storage that cannot be reached from the open internet; each view goes through a link that expires within a minute. Passwords are hashed. Backups are encrypted, and staff access is limited to those who need it.

9. Your rights

Under data protection law, including the GDPR, you can ask us to:

• give you a copy of the personal information we hold about you
• correct information that is wrong (most of it you can edit yourself in your profile)
• delete your information
• restrict or object to how we use it
• send it to you, or to another service, in a portable format

Email admin@ableseafarer.com from the address on your account. We may ask you to confirm your identity before acting. You can also complain to the data protection authority in the country where you live or work.

10. Deleting your account

To delete your AbleSeafarer account and its data:

1. Email admin@ableseafarer.com from the address you use to sign in, with the subject “Delete my account”.
2. We confirm the request and delete your account, profile, documents and sessions within 30 days, and email you when it is done.

Remaining copies disappear from backups within 30 days, and from document recovery storage within 90 days. We keep only what the law requires us to keep.

If you signed in with Google or LinkedIn, you can also remove AbleSeafarer's access from that account's security settings. Doing so stops future sign-ins through that provider, but it does not delete your AbleSeafarer account; ask us for that as above.

11. Children

AbleSeafarer is for people of working age. It is not intended for anyone under 16, and we do not knowingly collect their information.

12. Changes to this policy

If we change this policy we will update the date at the top. If a change significantly affects how we use your information, we will tell you by email before it takes effect.