1. Who is responsible
YOTEON operates this platform as a limited business pilot and is the controller for personal data collected through the service. Before any paid service begins, the contracting legal entity and its statutory details will be identified in the applicable service agreement and added to this notice.
Privacy enquiries and data-rights requests can be sent to hello@yoteon.com.
2. Data we process
- Account and profile information, including name, business email, role, organisation and authentication records.
- Operational information submitted by yacht teams and suppliers, including yacht, equipment, crew, service, inventory, RFQ, quote, order, invoice and budget records.
- Documents, attachments, messages and support correspondence that users choose to provide.
- Technical and security information such as IP address, browser details, session identifiers, access logs, audit events and abuse-prevention signals.
- AI requests and the supporting yacht records selected to answer them.
Do not upload personal data that is not necessary for yacht operations. Users remain responsible for having authority to provide information about crew members, customers and supplier contacts.
3. Why we use data
We process data to create and secure accounts, provide yacht and supplier workspaces, deliver RFQ and procurement workflows, maintain service history, respond to support requests, prevent fraud and malware, improve reliability and comply with law.
Depending on the activity, the legal basis is performance of a contract or steps requested before a contract, YOTEON's legitimate interests in operating and protecting the platform, compliance with legal obligations, or consent where the law requires it.
4. Service providers
YOTEON uses specialist providers to operate the service. These currently include Supabase for database, authentication and storage; Vercel for application hosting; Cloudflare for security and bot protection; Resend for transactional email; OpenAI for selected AI-assisted features; and Hetzner-hosted infrastructure for private malware scanning.
Providers act under their own terms and data-protection commitments. Data may be processed outside the European Economic Area where a provider's infrastructure requires it. Where applicable, YOTEON will use recognised safeguards such as adequacy decisions or standard contractual clauses.
5. Sharing and confidentiality
Workspace information is shared only with authorised members of the relevant yacht or supplier organisation and, when a user initiates a transaction, with the selected counterparties. YOTEON does not sell personal data.
Information may also be disclosed when required by law, to protect users or the platform, or as part of a business reorganisation subject to appropriate confidentiality controls.
6. Retention
Account and operational records are kept while the workspace is active and for a reasonable period afterwards to preserve contractual, security and audit history. Retention may be extended where law, dispute resolution, fraud prevention or backup integrity requires it. Pilot or test records may be removed earlier.
7. Security
YOTEON applies role-based access, row-level database controls, encrypted transport, audit records, multifactor authentication options, file validation and private malware screening. No online service can guarantee absolute security, so users must protect credentials and report suspected compromise promptly.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. You may also complain to the data-protection authority responsible for your location.
Send requests to hello@yoteon.com. We may need to verify your identity and authority before acting.
9. Children and changes
YOTEON is a business service and is not intended for children. We may update this notice as the pilot develops, when providers change or when legal requirements require it. Material changes will be communicated through the service or by email where appropriate.