Privacy Policy

Airboat ("we", "us", "our") operates the website https://airboat.uk, a UK-based marketplace connecting people who want to charter, rent or experience boats with verified boat owners and operators.

We are the data controller of personal information processed through the site. If you have any questions about this policy or how we handle your data, contact us at privacy@airboat.uk.

We collect the following categories of personal data:

• Account data — name, email address, password (hashed), profile picture, role (guest/host).
• Verification data — for hosts: government-issued ID, insurance documents, safety certificates.
• Listing data — for hosts: boat details, photos, pricing, availability, location.
• Booking data — dates, guest counts, total price, transaction history.
• Payment data — handled directly by Stripe; we never store full card numbers.
• Communication data — emails you send us, messages between hosts and guests on the platform.
• Technical data — IP address, browser type, device, pages visited (via cookies and server logs).

We process your data to:

• Create and manage your account, listings and bookings.
• Process payments and pay out to hosts (via Stripe Connect).
• Verify hosts' identity and insurance to keep the platform safe.
• Send transactional emails (booking confirmations, payout notifications, password resets) via Resend.
• Respond to support requests.
• Detect, prevent and investigate fraud, abuse and policy violations.
• Comply with legal and regulatory obligations.

Under the UK GDPR and Data Protection Act 2018, we rely on the following lawful bases:

• Contract — to provide the services you sign up for.
• Legitimate interests — to operate, secure and improve the platform.
• Legal obligation — to comply with tax, anti-money-laundering and other laws.
• Consent — for optional cookies and marketing emails (where applicable).

We share data with carefully selected third parties only as needed:

• Stripe Inc. — payment processing and host payouts. Stripe privacy policy.
• Resend — transactional email delivery. Resend privacy policy.
• Google — optional sign-in (OAuth). Only your name and email are received.
• Hosting providers — for site infrastructure.
• Hosts and guests — limited contact info to facilitate completed bookings.
• Law enforcement — if required by law or to protect rights and safety.

We do not sell your personal data.

We use essential cookies to keep you logged in and to remember your preferences. We also use limited analytics cookies to understand site usage. See our Cookie Policy for full details.

We keep your account data for as long as your account is active. Booking and payment records are retained for at least 7 years to meet HMRC and accounting obligations. Verification documents (ID, insurance) are retained for the duration of your hosting activity plus 1 year. You can request deletion of your account at any time — see "Your rights" below.

Passwords are hashed with bcrypt. Payments are handled directly by Stripe's PCI-DSS Level 1 infrastructure — your card details never touch our servers. All communication with the site is encrypted via HTTPS. Access to personal data within the team is limited to staff with a genuine business need.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion (the "right to be forgotten"), subject to legal retention requirements.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent for optional processing at any time.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email privacy@airboat.uk.

We may update this policy from time to time. Material changes will be notified to registered users by email. The "Last updated" date at the top of this page reflects the most recent revision.