Privacy Policy

1. Who we are

OnDeck Academy is an independent education service run by a working superyacht captain. For anything in this policy, or to exercise any right in section 10, contact us at info@ondeck-academy.com. We are the data controller for the data described below, except for payment data, where Paddle is a controller in its own right — see section 4.

2. What we collect

Only what a feature actually needs. Nothing is bought in from data brokers.

• Account details. Your email address, and — if you sign in with Google — the name and email address Google returns. Sign-in is by magic link or Google, so there is no password for us to store, and we never receive yours.
• Your career record. What you choose to enter: name, current rank and vessel, target certificate of competency, voyage and sea-time entries, certificates with their issue and expiry dates and reference numbers, travel dates for the Schengen day count, crew agency applications, and your progress through the study tools.
• Files you upload. Certificate and document scans, which go to a private storage area readable only by your own account.
• Referee details you enter. The name, role, vessel and email address of a captain or manager you ask for an endorsement. See section 6.
• Purchase records. For a paid product we store the Paddle transaction reference, the product, your email address and the Paddle customer reference, so your access can be granted and a refund honoured. We never see or store your card number.
• What you send the AI tools. The questions, answers and documents you put into the tutor, the examiner, the CV review and the contract review. See section 7.
• Marketing list. If you give us your email address for updates, it and the page you gave it on.
• Technical data. Standard server logs from our host, and — for the free AI trials — a one-way hash of your IP address with the date, used to count free uses. The hash cannot be turned back into your IP address, and the rows are cleared daily.

3. Why we use it, and our legal basis

• To run the Service you asked for — your account, your career record, your purchased access, your refund. Legal basis: performance of a contract with you.
• To keep the Service standing up — rate limits, spend caps, abuse prevention, and diagnosing faults. Legal basis: our legitimate interest in a service that works and is not abused.
• To send you service email — magic links, receipts, endorsement requests you triggered, and certificate expiry reminders you switched on. Legal basis: performance of a contract, and your consent for the reminders.
• To send you marketing email — only if you asked for it. Legal basis: consent, which you can withdraw at any time from the unsubscribe link in every message.
• To meet tax and accounting duties on sales. Legal basis: legal obligation, discharged mainly by Paddle as merchant of record.

We do not use your data for automated decisions that produce a legal or similarly significant effect on you. The AI tools give study feedback and opinions, not decisions — nothing on this site awards, refuses or revokes a qualification.

4. Who else handles it

We use a small number of established suppliers to run the Service. They may process your data only on our instructions, except Paddle, which is an independent controller for the payment and tax side of a sale.

• Vercel — hosting and server logs.
• Supabase — the database, sign-in, and private file storage that hold your account and career record.
• Paddle.com Market Ltd — merchant of record for every purchase. Paddle takes the payment, holds the card details, handles VAT and issues refunds. Its own privacy notice governs what it does with that data.
• Brevo — the marketing list and transactional email.
• Anthropic — the model behind the tutor, the examiner, the CV review and the contract review.
• ElevenLabs — speech for the spoken tutor and examiner, which receives the text to be spoken.

We do not sell personal data, and we do not share it for advertising. We will disclose data if the law requires it, or to establish or defend a legal claim.

5. Where your data goes

Some of the suppliers above are based outside the UK and the EEA, chiefly in the United States. Where data is transferred out, we rely on the safeguards in those suppliers’ data processing terms — standard contractual clauses, the UK addendum, or an adequacy decision where one applies. You can ask us which applies to a particular supplier.

6. Data about people who are not you

When you request an endorsement, you give us a referee’s name, role, vessel and email address so we can send them a one-time verification link. Only ask for an endorsement from someone who expects to hear from you. We use those details for that request and the record of its outcome, and for nothing else — no marketing, no list. A referee can ask us to delete their details at the contact address in section 1.

The same applies to any other person you name in a voyage entry, a testimonial request, or a document you upload.

7. The AI tools

The tutor, the examiner, the CV review and the contract review send what you type or upload to Anthropic to generate a reply, and send the reply back to you. We do not store those conversations in our database, and they are not used to train any model.

The free CV review reads your document to produce the review and does not retain it. For the paid Captain’s Read, your CV is attached to the notification email that reaches the captain who reviews it, and your request record — your email address, the transaction, and any notes you added — is stored so the review can be delivered and tracked. The CV file itself is not kept in our database.

Do not paste anything into these tools that you would not want read by a person: treat a contract or a CV as you would treat handing it across a table.

8. Cookies

We set no advertising cookies and use no analytics or tracking service. The only cookies we set are the ones that keep you signed in — strictly necessary, and set only once you sign in.

When you open a checkout, Paddle loads its own checkout script, which sets the cookies it needs to process the payment and detect fraud. That is covered by Paddle’s privacy notice, linked in section 4.

9. How long we keep it

• Your account and career record — until you delete it or ask us to close your account. Closing the account deletes your career record, your certificates and your uploaded files with it.
• Purchase records — for as long as tax and accounting law requires, normally six years, even after an account is closed.
• Marketing list — until you unsubscribe.
• Free-trial counters — cleared daily.
• Server logs — for the short retention period our host applies.

10. Your rights

Under UK and EU data protection law you can ask us to: give you a copy of your data; correct it if it is wrong; delete it; restrict or object to how we use it; or hand it to you or another service in a portable form. Where we rely on consent, you can withdraw it at any time, without affecting what we did before you withdrew it.

Much of this you can do yourself: edit or delete any entry in your career record from your account, turn a passport share link off, and unsubscribe from any email. For anything else, write to info@ondeck-academy.com. We will answer within one month.

If you think we have got it wrong, you can complain to the supervisory authority where you live. In the UK that is the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, so we can put it right.

11. Children

The Service is for people working towards, or already in, a professional maritime career. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

If we change how we use your data, we will update this page and change the date at the top. If the change is significant, we will tell account holders by email. For the full terms of the Service see our Terms & Conditions, and for purchases our Refund Policy.