Privacy Policy

1. Who we are

OnDeck Academy is an independent education service run by a working superyacht captain. For anything in this policy, or to exercise any right in section 10, contact us at info@ondeck-academy.com. We are the data controller for the data described below, except where the merchant of record is an independent controller for payment and tax data — see section 4.

2. What we collect

Only what a feature actually needs. Nothing is bought in from data brokers.

• Account details. Your email address, and — if you sign in with Google — the name and email address Google returns. Sign-in is by magic link or Google, so there is no password for us to store, and we never receive yours.
• Your career record. What you choose to enter: name, current rank and vessel, target certificate of competency, voyage and sea-time entries, certificates with their issue and expiry dates and reference numbers, travel dates for the Schengen day count, crew agency applications, and your progress through the study tools.
• Course progress.In the Deckhand Foundation course, which lessons you have finished, your best score on each lesson’s four-question check, and when. If you are signed in, this is saved to your account so it follows you between devices. It shows you where you are in the course. It is not an assessment, it signs nothing off, and we do not share it with employers or anyone else.
• Files you upload. Certificate and document scans, which go to a private storage area readable only by your own account.
• Referee details you enter. The name, role, vessel and email address of a captain or manager you ask for an endorsement. See section 6.
• Purchase records.For a paid product we store the payment provider’s transaction reference, the product, your email address and its customer reference, so access can be granted and a refund honoured. Historical records may contain Paddle references. We never see or store your card number.
• What you send the AI tools. The questions, answers and documents you put into the tutor, the examiner, the CV review and the contract review. See section 7.
• Marketing list. If you give us your email address for updates, it and the page you gave it on.
• Technical data. Standard server logs from our host, and — for the free AI trials — a one-way hash of your IP address with the date, used to count free uses. The hash cannot be turned back into your IP address, and the rows are cleared daily.

3. Why we use it, and our legal basis

• To run the Service you asked for — your account, your career record, your purchased access, your refund. Legal basis: performance of a contract with you.
• To keep the Service standing up — rate limits, spend caps, abuse prevention, and diagnosing faults. Legal basis: our legitimate interest in a service that works and is not abused.
• To send you service email — magic links, receipts, endorsement requests you triggered, and certificate expiry reminders you switched on. Legal basis: performance of a contract, and your consent for the reminders.
• To send you marketing email — only if you asked for it. Legal basis: consent, which you can withdraw at any time from the unsubscribe link in every message.
• To meet tax and accounting duties on sales. Legal basis: legal obligation, discharged mainly by the merchant of record.

We do not use your data for automated decisions that produce a legal or similarly significant effect on you. The AI tools give study feedback and opinions, not decisions — nothing on this site awards, refuses or revokes a qualification.

4. Who else handles it

We use a small number of established suppliers to run the Service. They may process your data only on our instructions, except a merchant of record, which acts as an independent controller for the payment and tax side of a sale.

• Vercel — hosting and server logs.
• Supabase — the database, sign-in, and private file storage that hold your account and career record.
• Payment provider. New checkout is currently closed while OnDeck changes provider. The replacement merchant of record and its privacy notice will be named here before sales reopen. Paddle remains the controller for historical transactions it processed.
• Brevo — the marketing list and transactional email.
• Anthropic — the model behind the tutor, the examiner, the CV review and the contract review.
• ElevenLabs — speech for the spoken tutor and examiner, which receives the text to be spoken.

We do not sell personal data, and we do not share it for advertising. We will disclose data if the law requires it, or to establish or defend a legal claim.

5. Where your data goes

Some of the suppliers above are based outside the UK and the EEA, chiefly in the United States. Where data is transferred out, we rely on the safeguards in those suppliers’ data processing terms — standard contractual clauses, the UK addendum, or an adequacy decision where one applies. You can ask us which applies to a particular supplier.

6. Data about people who are not you

When you request an endorsement, you give us a referee’s name, role, vessel and email address so we can send them a one-time verification link. Only ask for an endorsement from someone who expects to hear from you. We use those details for that request and the record of its outcome, and for nothing else — no marketing, no list. A referee can ask us to delete their details at the contact address in section 1.

The same applies to any other person you name in a voyage entry, a testimonial request, or a document you upload.

7. The AI tools

The tutor, the examiner, the CV review and the contract review send what you type or upload to Anthropic to generate a reply, and send the reply back to you. We do not store those conversations in our database, and they are not used to train any model.

The free CV review reads your document to produce the review and does not retain it. For the paid Captain’s Read, your CV is attached to the notification email that reaches the captain who reviews it, and your request record — your email address, the transaction, and any notes you added — is stored so the review can be delivered and tracked. The CV file itself is not kept in our database.

Do not paste anything into these tools that you would not want read by a person: treat a contract or a CV as you would treat handing it across a table.

8. Cookies

We set no advertising cookies. The only cookies we set are the ones that keep you signed in — strictly necessary, and set only once you sign in.

We count page visits with Vercel Web Analytics so we can see which parts of the site crew use. It sets no cookies, does not follow you to other sites and does not identify you: it records the page address, the referring site, and your country, browser, operating system and device type. Private links (Career Passport, attestation and endorsement links) are stripped of their token before anything is sent, and no query string is ever recorded.

The Deckhand Foundation course also keeps your course progress, and the last lesson you opened, in your browser’s local storage, so it works without an account. It stays on that device and is not sent to us unless you sign in. You can clear it at any time by clearing this site’s data in your browser. When you sign in, progress saved on the device is added to your account. On a shared device, sign out when you finish.

The OOW Study Companion works the same way: module progress, quiz scores, flashcards, tutor and examiner records and your study plan stay in your browser until you sign in. Signed in, they are saved to your account so they follow you to another device, and they are deleted with your account.

There is currently no live checkout script on the site. Before checkout reopens, this policy will identify any strictly necessary payment and fraud-prevention cookies set by the new merchant of record.

9. How long we keep it

• Your account and career record — until you delete it or ask us to close your account. Closing the account deletes your career record, your certificates and your uploaded files with it.
• Course progress — until you delete your account, which deletes it with the rest of your record. Progress kept only in your browser stays until you clear it.
• Purchase records — for as long as tax and accounting law requires, normally six years, even after an account is closed.
• Marketing list — until you unsubscribe.
• Free-trial counters — cleared daily.
• Server logs — for the short retention period our host applies.

10. Your rights

Under UK and EU data protection law you can ask us to: give you a copy of your data; correct it if it is wrong; delete it; restrict or object to how we use it; or hand it to you or another service in a portable form. Where we rely on consent, you can withdraw it at any time, without affecting what we did before you withdrew it.

Much of this you can do yourself: edit or delete any entry in your career record from your account, turn a passport share link off, and unsubscribe from any email. For anything else, write to info@ondeck-academy.com. We will answer within one month.

If you think we have got it wrong, you can complain to the supervisory authority where you live. In the UK that is the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, so we can put it right.

11. Children

The Service is for people working towards, or already in, a professional maritime career. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

If we change how we use your data, we will update this page and change the date at the top. If the change is significant, we will tell account holders by email. For the full terms of the Service see our Terms & Conditions, and for purchases our Refund Policy.