Privacy Policy

As a controller.For a Captain’s account information and our operation of the Service (including our website, billing, and security), we determine how and why personal information is processed.

As a processor.For Guest information that a Captain collects through the Service (such as a booking or a signed waiver), the Captain is the controller and we process that information on the Captain’s behalf and under their instructions. If you are a Guest and want to access, correct, or delete information about a specific booking, please contact the Captain you booked with; we will assist them as needed.

From Captains:

• account and contact details (name, email, password, business name, location);
• business and listing content you add (boats, trips, pricing, availability, meeting locations, waiver text);
• billing information processed by our payment processor (we receive limited details such as plan, status, and the last four digits of a card — we do not store full card numbers); and
• support communications and usage of the Service.

From Guests (on behalf of Captains):

• name, email address, and phone number;
• booking details (trip, date, party size, notes) and payment status;
• waiver information, including the electronic signature, the name of any minor or person signed for, the date and time signed, and the IP address used to sign; and
• communication preferences, including text-message opt-in or opt-out.

Automatically: log data, device and browser information, and cookies or similar technologies used to operate and secure the site and keep you signed in.

We use personal information to:

• provide, maintain, and secure the Service;
• process bookings, deposits, and subscription billing;
• send transactional messages on a Captain’s behalf to Guests (booking confirmations, requests, cancellations) and account or service messages to Captains;
• provide support and respond to inquiries;
• detect, prevent, and address fraud, abuse, and security issues; and
• comply with legal obligations and enforce our agreements.

When you first set up your account, you may optionally import details from your existing website to pre-fill your listings; that one-time processing is used solely to prepare your setup for your review and is not used to train any general-purpose model.

We do not sell personal information. We share it only as needed:

• Service providers (subprocessors) who help us run the Service, under contracts that limit their use of the information, including: Stripe (payments), Twilio (SMS), Resend (email), Vercel and Supabase (hosting and database), and Anthropic (the optional website-import step during setup, which processes only the public content of the website address you provide).
• Captains receive the Guest information submitted to their own booking and waiver pages.
• Legal and safety — when required by law, to respond to lawful requests, or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Guest payments and Captain subscriptions are handled by Stripe. Card details are submitted directly to Stripe and are subject to Stripe’s privacy policy. We receive transaction metadata (such as amount, status, and identifiers) but not full card numbers.

We use strictly necessary cookies to keep you signed in and to operate and secure the site, and we may use limited analytics to understand and improve usage. You can control cookies through your browser settings; disabling necessary cookies may break parts of the Service.

We retain Captain account information for as long as the account is active and as needed to provide the Service, then for a reasonable period to meet legal, tax, accounting, and security obligations. Guest information is retained on behalf of the Captain for as long as the Captain’s account is active or as the Captain instructs, subject to legal requirements (for example, waivers and transaction records may be retained longer). Account deletion and data export are handled on request rather than self-serve: email support@trydeckhand.com and we will delete or de-identify associated data within a reasonable period, or provide an export, unless we are required to keep it.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and database-level access rules. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing.

• Captains can update most account information in the app or by contacting us.
• Guests should contact the Captain they booked with to exercise rights over a booking; we will assist the Captain in responding.
• Messages — texts are sent only to Guests who opt in at booking, and you can reply STOP at any time to stop them. We do not send marketing email through the Service; email relates to a booking you made, and you can ask the Captain or contact us to stop it.

U.S. state privacy rights.Residents of California and other states with privacy laws may have additional rights, including the right to know, delete, correct, and opt out of “sales” or “sharing” of personal information. We do not sell personal information or share it for cross-context behavioral advertising. To exercise a right, contact us at support@trydeckhand.com. We will not discriminate against you for exercising your rights.

Where a Guest affirmatively opts in at booking, the Service sends trip-related text messages about that booking (confirmation, request received, and cancellation) to the Guest on a Captain’s behalf through Twilio. That choice is stored with the booking and applied to every message we send about it; if a Guest does not opt in, we send no texts. Message frequency varies by booking activity. Message and data rates may apply. Reply STOP to opt out or HELP for help. Mobile information is used to deliver these messages and is not sold or shared for marketing purposes.

The Service is intended for businesses and is not directed to children under 13, and we do not knowingly collect personal information from children for our own purposes. Where a minor participates in a trip, a parent or guardian provides the relevant information and signature through the Captain’s waiver, and that information is processed on the Captain’s behalf.

We operate in the United States and process and store information there. If you access the Service from outside the United States, you understand that your information will be processed in the United States.

The Service may link to third-party sites and services that we do not control. Their privacy practices are governed by their own policies.

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or in-app) and update the effective date above. Your continued use of the Service after the effective date constitutes acceptance.

This section sets out the data-processing terms that apply when we process Guest personal information as a processor (a service provider) on a Captain’s behalf. It supplements the “Our two roles” section above and functions as our data processing addendum (DPA) for that processing.

• Scope and purpose.We process Guest personal information only to provide the booking, payment, waiver, and communication features the Captain uses, and on the Captain’s documented instructions (including as configured in the product). We do not use it for our own independent purposes.
• Confidentiality. Personnel authorized to process the data are bound by confidentiality obligations.
• Security. We maintain technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and database-level access rules.
• Sub-processors.We use the sub-processors listed in “How we share information” that are involved in processing Guest data (Stripe, Twilio, Resend, Vercel, and Supabase) under contracts that impose data-protection obligations consistent with this section, and we remain responsible for their performance.
• Assistance. Taking the nature of the processing into account, we provide reasonable assistance to the Captain in responding to data-subject requests and in meeting their security, breach-notice, and data-protection-assessment obligations.
• Breach notification. We notify the affected Captain without undue delay after becoming aware of a personal-data breach involving Guest data we process for them.
• Return or deletion.On termination, and at the Captain’s choice, we delete or return Guest personal information, except where retention is required by law.
• CCPA/CPRA service provider. We act as a service provider for Guest personal information. We do not sell or share it, and we do not retain, use, or disclose it except as necessary to perform the services for the Captain (the business purpose) or as permitted by law.

For GDPR-regulated processing, the parties will enter into any additional standard-contractual-clause terms required for cross-border transfers. Contact support@trydeckhand.com to request a countersigned DPA.

For privacy questions or to exercise your rights, contact us at support@trydeckhand.com.

Saltworks Holdings LLC
6650 Rivers Ave., STE 100, Charleston, SC 29406, USA

DeckHand is a Saltworks company.