PRIVACY POLICY
SailCoCo
sailcoco.com
Effective Date: October 12, 2026 Last Updated: October 12, 2026
1. Introduction and Scope
This Privacy Policy describes how SailCoCo LLC, a California limited liability company (the "Company"), collects, uses, shares, retains, and protects personal information through sailcoco.com and the SailCoCo mobile and web applications and related services (together, the "Service"). The Service is a subscription application for boat owners, cruising sailors, and charter and rental operators that provides cruising compliance information, an artificial intelligence assistant called the CoCo Agent, storage for vessel and compliance documents, a community feed of user reports, access through third-party artificial intelligence assistants, and an application programming interface for developers.
This Policy applies to every visitor and user of the Service. Capitalized terms not defined here carry the meanings given in the Terms of Service. The Terms of Service incorporate this Policy by reference, and this Policy remains available as its own page. It governs personal data wherever a Service rule touches it. Send privacy questions and data requests to privacy@sailcoco.com. While the Service is in private preview, the Company may also collect the feedback you choose to send about the Service. When the Company processes personal data on behalf of a developer customer under the SailCoCo Data Processing Agreement, such as questions that a developer's end users send through the developer's application, the Company acts as that customer's processor, and the customer's own privacy notice governs that processing.
2. Information the Company Collects
The Company collects the categories below, organized by source.
2.1 Account data. Name, email address, username, password in protected form, vessel details you choose to add (such as type, length, and flag), the nationality group of you and your crew if you choose to enter it, your plan, your country of residence, and whether you opted in to marketing email, with the date of that choice.
2.2 Subscription and billing data. Your plan, renewal dates, and transaction history. Stripe processes payments. Card numbers and full payment credentials go to Stripe, not to the Company. The Company receives transaction receipts and limited billing details needed to service your account.
2.3 Trip and location data. Routes, ports, waypoints, and vessel position. Location may come from your phone and from onboard equipment, including Signal K sources. Vessel position is precise geolocation, and the Company uses it to provide the cruising and compliance features you request. When you or a developer looks up the rules that apply at a position, the Service uses that position to answer the request and does not store it.
2.4 Ship's Papers uploads. The vessel and compliance documents you upload to Ship's Papers, such as vessel registration, insurance declarations, radio and MMSI license, cruising permits, clearance papers, and pet vaccination certificates. The Company stores these as encrypted files. The Service does not collect passport, driver's license, or national identity card data. The Ship's Papers scanner rejects identity documents by design, and the Company does not store them.
2.5 Community Feed content. The port and entry reports you post, and any photos you add, along with the metadata attached to those posts.
2.6 CoCo Agent interactions. The questions you ask the CoCo Agent and the answers it returns. The Company sends these messages to the artificial intelligence provider that powers the assistant so it can respond.
2.7 Device and usage data. IP address, browser type, operating system, device identifiers, pages and screens viewed, timestamps, and referring pages, collected automatically when you use the Service.
2.8 Cookies and analytics data. Data collected through cookies and similar technologies, described in Section 9.
2.9 Support communications. Messages, dispute submissions, and attachments you send to support, including messages you exchange with the CoCo Agent when you contact support through it.
2.10 AI Assistant Access data. If you link a third-party artificial intelligence assistant to your account, the Company receives the authorization for that link, the requests the assistant sends to the Service on your behalf (the tool used, the question or search terms, and the time), and usage counts. The Company receives only what the assistant sends to the Service, not your full conversation with the assistant.
2.11 Developer data. If you register as a developer, the Company collects your name, email address, organization, the API keys it issues to you, stored in protected form, your plan and billing details, and logs of your API requests, including time, API endpoint, response status, IP address, and usage counts.
2.12 Community Feed reports and moderation records. If you report a post or are the subject of a moderation decision, the Company keeps the report, the decision, the notice it sent, and any appeal.
2.13 Compliance Records. A Compliance Card is the Service’s summary of the published rules for a declared boat and place. When you record a briefing, or a Charter Operator or developer records one for you, the Company keeps a Compliance Record: the Compliance Card shown, its side and context, the place and the declared boat and trip details, the lines shown with their verified dates, the time, the language, a content hash, and the name or reference of the person shown the card. Anyone holding the Record ID can view the card as shown at verify.sailcoco.com, but that page does not show the person’s name or reference. A Charter Operator can see the Compliance Records for its own guests. When a Charter Operator records a briefing for a guest, the Charter Operator decides to do so and is responsible for telling that guest, and the Company keeps the record under this Policy.
3. How the Company Uses Information
The Company uses personal information to create and manage accounts, deliver the Service and the Compliance Information you request, run the CoCo Agent, store your Ship's Papers documents, process payments and renewals through Stripe, keep the acceptance and electronic signature records the Terms of Service require, keep the Compliance Records you or a Charter Operator create, prevent fraud and enforce the Terms of Service, respond to payment disputes and chargebacks using its transaction and consent records, provide customer support, send service and transactional emails, send marketing emails only if you opted in and only until you withdraw that consent, show the rights, prices, taxes, and disclosures that apply in your country of residence, operate the developer interface and assistant connectors and enforce their usage limits, review reports about Community Feed posts and send moderation notices, comply with tax and other legal obligations, and maintain the security of the Service. The Company uses precise geolocation only to provide the cruising and compliance features you request and to keep the Service secure. The Company does not use personal information for targeted advertising and does not build advertising profiles.
4. How the Company Shares Information
The Company shares personal information only with the categories of recipients below and does not sell personal information. Except as described in Sections 4.6 to 4.9 and 4.12, each recipient acts as a service provider or processor under a written contract that limits its use of the data to the services it performs for the Company.
4.1 Payment processing. Stripe receives the data needed to process payments and renewals and to meet financial compliance duties.
4.2 Hosting and infrastructure. Hosting providers store Service data and server logs on the Company's behalf.
4.3 Artificial intelligence provider. The provider that powers the CoCo Agent, currently Anthropic, receives the questions you send and related context so the assistant can respond. The Company selects providers that process this data for the Company and not for their own purposes.
4.4 Analytics providers. The Company uses Google Analytics, which receives the usage data described in Sections 2.7 and 2.8 to help the Company understand how the Service performs. The Company configures Google Analytics with Google signals and advertising features turned off and does not allow Google to use this data for advertising. The Company also turns off data sharing with other Google products and services, so Google processes this data only as the Company's service provider.
4.5 Email and support services. Email delivery and support ticket vendors receive contact details and message content needed to run those services.
4.6 Developers and marine-electronics partners. The Company exposes a data feed of Compliance Information to developers and to chartplotter and marine-electronics partners through an application programming interface. That feed carries compliance and reference information, not the personal account information of users.
4.7 Legal and safety disclosures. The Company may disclose personal information to comply with law, respond to valid legal process, enforce the Terms of Service, or protect the rights, safety, or property of the Company, its users, or the public.
4.8 Business transfers. If the Company merges, is acquired, or sells assets, personal information may transfer as part of that transaction, with notice to you consistent with the Terms of Service.
4.9 With your direction. The Company shares information when you ask it to, such as displaying your username or a report you post on the public Community Feed.
4.10 No Advertising. The Company uses no third-party advertising networks and does not run targeted or behavioral advertising. The Company does not sell or share personal information for advertising, ever. Clearly labeled sponsorships may appear in the Service as described below.
4.11 Sponsorships. The Service may display clearly labeled sponsorships. A sponsor never receives your personal information. A sponsor receives aggregate statistics at most. A sponsor never influences the Compliance Information the Service provides. The Company marks each sponsored placement so you can tell it apart from ordinary content.
4.12 Third-party AI assistants you choose. When you use a third-party artificial intelligence assistant with the Service, the provider of that assistant, for example Anthropic for Claude or OpenAI for ChatGPT, receives the information the Service returns to your requests. That provider acts under its own privacy policy as an independent controller, not as the Company's service provider. The Company does not decide how that provider uses, keeps, or trains on your conversation. Review its privacy policy before you link it.
4.13 Current service providers. The Company's current service providers are Google Cloud (hosting and storage, United States), Anthropic (artificial intelligence, United States), Stripe (payments), Google Workspace and Porkbun (email), GitHub (software development), and Google Analytics (website and app usage analytics). The Company updates this list when it changes.
4.14 Compliance Records. A Charter Operator can see the Compliance Records for its own guests. Anyone holding a Record ID can view the card as shown at verify.sailcoco.com, without the name or reference of the person shown the card.
5. Data Retention and Disposal
The Company keeps account data while an account stays active and for a reasonable period afterward to handle disputes, refunds, and legal duties. Ship's Papers documents stay while your account is active and until you delete them or close your account. Subscription consent records stay for at least three years. Clickwrap acceptance records under section 1.2 of the Terms of Service, including the date, time, account, document version, and specific language accepted, stay for at least three years. Compliance Records stay for three years after they are created, unless the account holder who created them deletes them sooner, so they can show later what was shown and when. Tax and financial records stay as long as tax law requires. Support and dispute records stay as long as needed to resolve and document the matter. When personal information is no longer needed, the Company deletes it or strips it of identifying details using reasonable secure disposal measures. Marketing consent records stay for as long as the consent is in effect and for three years after it is withdrawn. Assistant connector and API request logs stay for 30 days, and usage counts needed for billing stay as long as the related financial records. Community Feed reports, moderation decisions, and appeals stay for at least six months after the decision and longer where needed for a dispute or a legal duty.
6. Data Security
The Company uses reasonable administrative, technical, and physical safeguards, including encryption of data in transit and encryption of Ship's Papers documents at rest, access controls, and vendor review. No method of transmission or storage is fully secure, and the Company cannot promise perfect security. If a breach of security affects your personal information, the Company will notify you as the law requires.
7. International Data Transfers
The Company operates from the United States, and personal information is processed and stored on servers in the United States. If you use the Service from outside the United States, your information transfers to the United States, where privacy laws may differ from those of your home country. For transfers from the European Economic Area, the United Kingdom, and Switzerland, the Company relies, where the law requires a transfer mechanism, on the European Commission Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, and the Swiss addendum where they apply. The Company keeps data processing agreements that include these clauses with the processors that handle personal information on its behalf, including Stripe, its hosting provider, and its artificial intelligence provider. Section 13 states the additional rights and protections for users in those regions.
8. Your Choices and Requests
You may review and update most account information in your account settings. You may also email privacy@sailcoco.com to request access to, correction of, or deletion of your personal information. The Company verifies each request by matching it to the account email or asking for information only the account holder would have, and responds within 45 days. If the Company needs more time, it will tell you and may take up to 45 more days, as the law allows. You may also use an authorized agent to submit a request for you, and the Company may ask the agent for proof of authorization and may verify your identity directly. The Company does not deny service, charge a different price, or lower the level of service because you exercised a privacy right. The Company may keep records it needs for completed transactions, dispute history, fraud prevention, and legal compliance, along with records of your acceptance of its terms and policies and of your marketing consent choices, even after a deletion request. The Company keeps those records only for the periods stated in Section 5, uses them only to show what you agreed to, to honor your choices, and to handle legal claims, and will tell you when it keeps them. If you opted in to marketing email, you may withdraw that consent at any time through the unsubscribe link in any marketing message or in your account settings. You may disconnect a third-party assistant at any time in your account settings or in the assistant. Service and transactional emails continue while you hold an account.
9. Cookies, Analytics, Do Not Track, and Opt-Out Signals
9.1 Cookies. A cookie is a small file stored on your device. The Service uses strictly necessary cookies to run accounts and checkout, functional cookies to remember preferences, and analytics cookies to measure how the Service performs. The Service does not use advertising cookies and does not permit third-party advertising networks to collect data across other websites through the Service. You can block or delete cookies in your browser settings, though parts of the Service may stop working without the strictly necessary ones. In the European Economic Area, the United Kingdom, and Switzerland, the Service sets analytics cookies only after you consent, you may refuse them as easily as you accept them, and you may withdraw that consent at any time in the cookie settings.
9.2 Do Not Track and opt-out preference signals. Some browsers send "Do Not Track" signals. No common industry standard for responding to those signals exists, so the Service does not change how it collects information when it receives one. No third party collects personally identifiable information about your activity across other websites or services through the Service.
10. California Residents
If you are a California resident, this section applies to you and provides the disclosures California law requires.
10.1 Categories collected and shared. The categories of personal information the Company collects appear in Section 2. The categories of recipients appear in Section 4. The Company does not sell personal information and does not share it with third parties for advertising.
10.2 Do Not Track. The Company's response to browser signals and opt-out preference signals appears in Section 9.2.
10.3 Sensitive personal information. Precise geolocation and the nationality group you choose to enter are sensitive personal information under California law. The Company uses them only to provide the features you request, such as selecting the rules that apply to your boat and crew, to keep the Service secure, and for the other purposes California law permits without a right to limit, so the Service does not offer a separate option to limit their use.
11. Children's Privacy
The Service is not directed to children, and every account holder must be at least 18 years old. The Company does not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal information to the Service, email privacy@sailcoco.com and the Company will delete it.
12. Residents of Other States
Several states have their own privacy laws that grant residents rights to access, correct, delete, and opt out of certain uses of personal information. The Company extends the request process in Section 8 to residents of every state. If the law of your state grants you a right this Policy does not list, you may still submit the request, and the Company will honor it where the law requires.
13. European Economic Area, United Kingdom, and Switzerland
13.1 Scope and Controller. This section applies to you if you use the Service from the European Economic Area, the United Kingdom, or Switzerland. It adds to the rest of this Policy and controls over any conflicting term for those users. For the processing described in this Policy, SailCoCo LLC is the controller of your personal information, and you may reach the Company at privacy@sailcoco.com.
13.2 Legal Bases for Processing. The Company processes account, subscription, trip, Ship's Papers, and support data to perform the contract you enter when you use the Service. It processes billing and record-keeping data to meet legal obligations, including tax and financial duties. It processes device, usage, and security data for its legitimate interests in operating, securing, and improving the Service, weighed against your rights. Where processing depends on your consent, the Company relies on that consent, and you may withdraw it at any time without affecting processing already carried out. The Company sends marketing email based on your consent. It processes your country of residence to perform the contract and to meet legal obligations. It processes Community Feed reports and moderation records to meet its obligations under the EU Digital Services Act and for its legitimate interest in keeping the Community Feed accurate and safe. It sets analytics cookies only with your consent. It processes CoCo Agent questions, AI Assistant Access requests, and developer account data to perform the contract with you, and it processes API and connector request logs for its legitimate interest in securing the Service and enforcing usage limits. It keeps Compliance Records to perform the contract with the account holder who creates them and, for a guest named by a Charter Operator, for the legitimate interest of the Company and the Charter Operator in showing later which card was shown and when.
13.3 Your Rights. You have the right to access your personal information, to correct it, to erase it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing relies on consent. You may exercise these rights through the process in Section 8 or by emailing privacy@sailcoco.com. For requests under this Section, the Company responds within one month, which it may extend by two more months where requests are complex or numerous, and it tells you about any extension within the first month. The Company does not charge a fee or reduce your service for exercising a right, except where the law allows. You also have the right to lodge a complaint with your local supervisory authority, the United Kingdom Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable to you.
13.4 Representatives in the European Union, the United Kingdom, and Switzerland. The Company has appointed DataRep as its representative under Article 27 of the EU General Data Protection Regulation for users in the European Economic Area, under Article 27 of the UK General Data Protection Regulation for users in the United Kingdom, and under the Swiss Federal Act on Data Protection for users in Switzerland. DataRep may be contacted in addition to or instead of the Company on any issue related to the processing of your personal information. You may contact DataRep on data protection matters by email at datarequest@datarep.com (quoting "SailCoCo LLC" in the subject line), through the web form at www.datarep.com/data-request, or by post: in the European Economic Area, DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, or any of DataRep's other EU and EEA addresses listed at www.datarep.com; in the United Kingdom, DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom; and in Switzerland, DataRep, Leutschenbachstrasse 95, 8050 Zurich, Switzerland. Post sent to these addresses must be addressed to "DataRep", not to the Company. For anything other than data protection, including questions about the Service, your account or billing, please contact the Company at support@sailcoco.com.
13.5 International Transfers and Safeguards. When the Company transfers your personal information from the European Economic Area, the United Kingdom, or Switzerland to the United States or another country, it relies, where the law requires a transfer mechanism, on the safeguards described in Section 7, including the Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, and the Swiss addendum where they apply. The Company keeps data processing agreements that include these clauses with Stripe, its hosting provider, and its artificial intelligence provider. You may request a copy of the relevant safeguard by emailing privacy@sailcoco.com.
13.6 Right of Withdrawal. If you are a consumer in the European Economic Area or the United Kingdom, you have a 14-day right to withdraw from a purchase of digital services. At checkout, the Service asks for your express consent to begin access right away and your acknowledgment that you lose the withdrawal right once access begins. The Terms of Service state how this right applies to each purchase.
13.7 Automated Decisions. The CoCo Agent uses artificial intelligence to answer your questions, and the Service tells you so. CoCo Agent answers, including answers the Service returns to a third-party assistant, are labeled as generated by artificial intelligence and carry a machine-readable marker. The Company does not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects.
14. Changes to This Policy
The Company may update this Policy as its practices or the law change. Updates post at this page with a revised "Last Updated" date. For material changes, the Company will email the address on your account and post a conspicuous notice on the Service at least 30 days before the change takes effect. Continued use of the Service after the effective date accepts the updated Policy, except where the law requires fresh consent.
15. Contact
Send privacy questions, data requests, and complaints to SailCoCo LLC at privacy@sailcoco.com. The Company responds to data requests within 45 days and will tell you if it needs more time. You may also write to SailCoCo LLC, 303 Twin Dolphin Drive, Suite 600, Redwood City, California 94065, USA. Users in the European Economic Area, the United Kingdom, and Switzerland may also contact the Company's representative described in Section 13.4.