Legal
Privacy Policy
1. Who we are
KnownWaters is operated by KnownWaters Ltd, a company registered in England and Wales under company number 17378729, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
In this Privacy Policy: “KnownWaters”, “we”, “us” and “our” mean KnownWaters Ltd. “Customer” means the yacht-owning company, yacht-management company or other business entity that purchases or authorises use of the Service for a Vessel. “Vessel” means the yacht associated with a Customer workspace. “Authorised User” means a crew member, officer, yacht-management employee, owner’s representative or other person authorised by the Customer to use the Service. “Knowledge” means the operational knowledge, notes, photographs, voice recordings, locations, contacts and related material submitted to the Service. “Service” means the KnownWaters website, mobile-optimised web application and related services.
You can contact us about privacy matters at: Email: info@knownwaters.com (for general enquiries, use hello@knownwaters.com). Postal address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
2. Our data-protection roles
2.1 Where KnownWaters acts as a controller
KnownWaters generally acts as a data controller when we determine why and how personal data is used for our own purposes, including registering and administering accounts, authenticating users and securing the Service, managing Customer subscriptions and payments, providing support, communicating about the operation of the Service, detecting misuse and security threats, maintaining business, tax and legal records, improving the reliability and performance of the Service, and establishing, exercising or defending legal claims.
2.2 Where KnownWaters acts as a processor
Where the Customer determines why operational Knowledge is collected and how it is used for its Vessel operations, KnownWaters processes personal data contained in that Knowledge on the Customer’s behalf. In those circumstances the Customer is normally the data controller, KnownWaters is normally the Customer’s data processor, we process that data in accordance with the Customer’s documented instructions and the Data Processing Addendum, and requests relating to personal data held in Customer Knowledge are handled in conjunction with the relevant Customer. The exact roles will depend on the facts and purposes of each processing activity.
3. Who this Privacy Policy applies to
This Privacy Policy applies to:
- Authorised Users of the Service
- Customer Administrators and representatives
- Prospective Customers and people who contact us
- People whose contact information is entered into the Service
- Suppliers, agents and other third parties referred to in Knowledge
- Individuals appearing in photographs, recordings or written Knowledge
- Website visitors
The Service is intended for business and professional use. A person must be at least 18 years old to create a KnownWaters account.
4. Personal data we collect
4.1 Account and identity information
- Full name
- Email address
- Profile photograph, where provided
- Role or position onboard
- Vessel affiliation
- Customer or management-company affiliation
- Date joined or left a Vessel, where recorded
- Account status and permissions
- Administrator or reviewer status
- Telephone number, where required for an enabled WhatsApp or messaging feature
4.2 Knowledge submitted through the Service
- Written notes, descriptions and titles
- Operational observations and recommendations
- Location coordinates
- Photographs and related image metadata
- Voice recordings and their transcripts
- AI-generated title or category suggestions
- Submission, review and approval timestamps
- Names of contributors and reviewers
- Sharing and access records
- Details about anchorages, tender points, beaches, suppliers, restaurants, marinas, agents and other locations or services
- Any other information an Authorised User chooses to include
Voice recordings are retained as part of the underlying Knowledge record rather than deleted once transcribed, because the recording (not only the transcript) can be replayed during review. Retention of the recording follows the same rules as the rest of the Knowledge entry it belongs to — see §14.
4.3 Third-party contact and personal information
Knowledge may contain information about people who do not have KnownWaters accounts, including supplier or agent names, business telephone numbers, business email addresses, job titles, company affiliations, professional observations, individuals who appear in photographs, and limited guest or operational information where permitted by the Customer.
Customers and Authorised Users must not use KnownWaters as a general guest-profile, medical-record, personnel-record or identity-document storage system.
4.4 Subscription and billing information
- Customer name
- Billing contact
- Billing address
- Subscription plan
- Transaction records
- Invoice details
- VAT or tax details
- Limited payment information provided to us by our payment processor
KnownWaters does not normally receive or store full payment-card details.
4.5 Communications and support information
- Emails and support requests
- Feedback
- Reports of errors or misuse
- Survey responses
- Account-verification correspondence
- Records of our communications with Customers and Authorised Users
4.6 Usage and technical information
- IP address
- Browser and device type
- Operating system
- Login dates and times
- Authentication and security events
- Page and feature usage
- Actions taken within the Service
- Knowledge submission, approval, access and sharing activity
- Error logs
- Cookie or similar technology identifiers
- Diagnostic and performance information
4.7 Information we do not intend the Service to collect
Unless expressly agreed with the Customer and supported by an appropriate lawful basis, the Service must not be used to store:
- Passport or identity-document copies
- Payment-card or personal financial information
- Account passwords or security codes
- Detailed medical records
- Biometric identification data
- Political opinions
- Religious or philosophical beliefs
- Sexual-orientation or sex-life information
- Trade-union membership
- Genetic information
- Detailed information about criminal allegations or convictions
- Confidential crew employment or disciplinary files
- Highly sensitive owner or guest profiles
- Live security arrangements or access codes
- Information about children that is not strictly necessary, authorised and lawful
5. How we obtain personal data
We may obtain personal data:
- Directly from you, when you register, submit Knowledge or contact us
- From the Customer or a Vessel Administrator who creates or approves your access
- From another Authorised User who submits Knowledge
- Automatically, from your browser, device or use of the Service
- From payment and infrastructure providers
- From yacht-management companies or other organisations acting for the Customer
- From business correspondence and publicly available professional sources, where appropriate
Where another person provides your personal data, that person and the relevant Customer are responsible for ensuring that the information is collected and shared lawfully.
6. How and why we use personal data
Our principal processing activities where KnownWaters acts as a controller are:
- Creating, authenticating and administering accounts — performance of a contract, or our legitimate interest in controlled access.
- Providing the Service — performance of a contract; legitimate interests.
- Administering subscriptions and payments — performance of a contract; legal obligation for accounting/tax.
- Protecting the security and integrity of the Service — legitimate interests in preventing unauthorised access, fraud and misuse.
- Providing customer support — performance of a contract; legitimate interests.
- Sending operational communications — performance of a contract; legitimate interests.
- Maintaining and improving reliability and performance — legitimate interests, balanced against individual rights.
- Complying with legal and regulatory obligations — legal obligation.
- Establishing, exercising or defending legal claims — legitimate interests; legal obligation where applicable.
- Using an optional profile photograph — consent, removable at any time.
- Sending non-essential marketing communications — consent or legitimate interests, depending on the communication and applicable law.
Where KnownWaters acts as a processor, the relevant Customer determines the lawful basis for processing Customer Knowledge. We do not rely on consent where an individual has no genuine choice or where the processing is necessary for another stated purpose.
7. AI-assisted features
KnownWaters uses artificial-intelligence services to transcribe voice recordings, suggest Knowledge titles and categories, and structure submitted information. Currently this means: audio is sent to OpenAI’s Whisper API for transcription, and the resulting transcript is sent to OpenAI’s GPT-4o-mini model to generate a suggested title and category. This happens automatically and asynchronously after submission, before a human reviewer sees the entry.
Where these features are used:
- Relevant recordings, transcripts or text are sent to OpenAI as a subprocessor
- AI-generated outputs are suggestions and may be inaccurate
- Authorised Users should review outputs before approving or relying on them
- AI suggestions do not constitute verification by KnownWaters
- KnownWaters does not use AI-generated titles or classifications to make decisions about individuals that produce legal or similarly significant effects
- The Customer remains responsible for determining whether particular information should be submitted to an AI-enabled feature
8. Location information
Authorised Users may provide a location by dropping a pin on a map, entering coordinates manually, selecting a location from search results, or allowing the device to provide its current location. KnownWaters uses this information to associate Knowledge with a location and display it on the operational map. KnownWaters does not continuously track an Authorised User’s location in the background. Device-level location permissions can be controlled through the relevant browser or device settings.
9. Special-category data and highly sensitive information
Some information, including health data, religious beliefs, ethnicity and biometric information, receives additional protection under data-protection law. KnownWaters is not intended to be a repository for special-category personal data. Customers and Authorised Users must not submit special-category data unless all of the following apply:
- It is strictly necessary for a legitimate operational purpose
- The Customer has confirmed an appropriate lawful basis and additional legal condition
- The submission is permitted under the Customer’s policies
- The information is limited to what is necessary
- Appropriate access and security controls are in place
KnownWaters may remove, restrict or quarantine information that appears to contain inappropriate or excessive sensitive personal data.
10. Information relating to children
People under 18 may not create KnownWaters accounts. Knowledge may nevertheless incidentally contain information about or images of children, including owners’ or guests’ children. Customers and Authorised Users must not submit information about children unless it is:
- Necessary for a specific and legitimate Vessel operation
- Appropriately authorised
- Fair and lawful
- Proportionate and limited to what is required
- Handled with particular regard for the child’s interests, privacy and safety
KnownWaters should not be used to create detailed profiles of children or retain unnecessary photographs, health information, schedules or behavioural observations about them.
12. Vessel-workspace visibility
KnownWaters is designed to separate one Customer or Vessel workspace from unrelated workspaces, enforced through server-side vessel lookups in the Worker rather than relying on the frontend alone. Subject to configured permissions:
- Authorised Users should only be able to access the workspaces to which they have been granted access
- Users of unrelated Vessel workspaces should not be able to view each other’s Knowledge
- KnownWaters personnel may access information where reasonably necessary for support, security, maintenance, legal compliance or incident response
- Service providers may process information as required to provide their contracted services
- Information may leave the Vessel workspace where an Authorised User deliberately uses an external sharing feature
No internet-based system can be guaranteed to be completely secure or immune from unauthorised access.
13. International transfers
Several of our service providers (including OpenAI, Cloudflare, Airtable, Mapbox, Resend and, where used, Twilio) are based in or process data in the United States. Where a restricted international transfer occurs, we use a lawful transfer mechanism. Depending on the destination and circumstances, this may include a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another legally permitted safeguard. Where required, we also assess whether the safeguard provides an appropriate level of protection in the circumstances. You may contact us for more information about the safeguards relevant to your personal data.
14. Retention
We retain personal data only for as long as reasonably necessary for the relevant purpose, subject to legal obligations and the Customer’s instructions where we act as a processor. Our retention approach:
- Active account information — for the duration of the account
- Closed account information — up to 12 months after closure, unless a longer period is needed for security, legal or record-keeping purposes
- Customer subscription records — for the subscription term and six years afterwards for tax, accounting and contractual records
- Security and authentication logs — 12 months
- Support communications — 3 years after the issue is closed
- Voice recordings — retained as part of the Knowledge record (see §4.2), for as long as the Knowledge entry itself is retained. Not automatically deleted after transcription
- Transcripts and approved Knowledge — for the duration of the Customer workspace and any agreed post-termination export period (30 days)
- Rejected or draft Knowledge — retained for 12 months from creation unless the Customer’s reviewers delete it earlier; Customers may request a shorter default
- Deleted files and backups — removed from active systems promptly and from backups within 90 days
- Marketing preferences — until consent is withdrawn or the information is no longer required, with suppression records retained where necessary
- Legal claims and disputes — for as long as reasonably necessary to establish, exercise or defend the relevant claim
Operational Knowledge may remain in the Customer’s workspace after the individual contributor leaves the Vessel. This is because the Knowledge is intended to form part of the Customer’s continuing operational knowledge. Where appropriate, personal attribution or other identifying information may be removed, restricted or anonymised while preserving non-personal operational information. The Customer’s retention instructions do not override applicable data-protection rights or other legal requirements.
15. Security
We maintain technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, including:
- Role-based access controls
- Authentication controls
- Encryption in transit and, where appropriate, at rest
- Monitoring and logging
- Vulnerability and dependency management
- Restricted administrative access
- Backup and recovery procedures
- Incident-response procedures
- Contractual confidentiality and security requirements for providers
Customers and Authorised Users are responsible for:
- Protecting their login credentials
- Using unique and appropriately secure passwords
- Not sharing accounts
- Promptly removing access for departed crew
- Reporting suspected unauthorised access
- Avoiding the submission of unnecessary sensitive information
No security measure can eliminate all risk.
16. Your data-protection rights
Depending on the circumstances and applicable law, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate or incomplete information
- Request deletion of personal data
- Request restriction of processing
- Object to processing based on legitimate interests
- Receive certain information in a portable format
- Withdraw consent where processing is based on consent
- Object to direct marketing
- Complain to a data-protection regulator
These rights are not absolute and may depend on the purpose and lawful basis for processing.
Where KnownWaters processes information on a Customer’s behalf, we may refer the request to that Customer or assist the Customer in responding. To exercise a right, contact info@knownwaters.com. As an early-stage business this contact may currently be Lewis directly; we will publish a dedicated privacy contact as the team grows. We may need to verify your identity and clarify the information involved.
17. Automated decision-making
KnownWaters does not currently use personal data to make solely automated decisions that have legal or similarly significant effects on individuals. AI-assisted transcription, title generation, category suggestions and search functionality do not determine employment, Vessel access or other significant decisions without human involvement. If this changes, we will update this Privacy Policy and provide any additional information required by law.
19. Third-party websites and services
The Service may link to third-party websites or allow information to be shared through external services. Those organisations operate under their own terms and privacy policies. KnownWaters does not control their independent processing activities. Users should review the applicable privacy information before submitting or sharing personal data through an external service.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the Service, our providers, our data practices or applicable law. We will provide reasonable notice of material changes, for example by email, in-app message or prominent notice within the Service. Where we intend to use personal data for a materially new purpose, we will provide relevant information before beginning that processing and obtain consent where consent is required. Continued use of the Service does not by itself constitute consent to processing that legally requires consent.
21. Complaints
Please contact us first if you have concerns about how we handle personal data: Email: info@knownwaters.com. Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.
You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.