YaCap

Privacy Policy

Effective date: 12 October 2026

This Privacy Policy explains how the YaCap mobile application and the website yacap.gr (together, the “Service”) collect, use, share and protect your personal data. By using the Service you acknowledge that you have read and understood this policy.

This policy is an integral part of our Public Offer Agreement.

1. Who we are

The Service is operated by Softering LLC (ТОВ «Софтерінг»), Ukraine, which acts as the data controller for the personal data described in this policy.

Contact for any privacy matter: contact@softering.com

2. Information we collect

2.1 Account and profile information

  • Full name, email address and profile photo — provided by you or received from Sign in with Apple or Sign in with Google;
  • Phone number, date of birth and blood type — optional, only if you choose to add them;
  • Vessel information (name, type, length, draft and similar) — optional.

2.2 Location information

If you allow location access, we use your precise and approximate GPS location to show nearby marinas, buoys and anchorages, display distances and provide coordinates for SOS. Location access is optional and can be turned off at any time in your device settings.

2.3 Emergency (SOS) information

When you use the SOS feature, we collect and transmit your GPS coordinates, the selected emergency type, the time of the emergency, vessel information (if provided) and personal emergency information such as your phone number and blood type (if provided). This information is used only to assist the emergency response.

2.4 Bookings, orders and payments

When you reserve a buoy or berth or order food, we process the details of the booking or order (location, time, items, delivery point such as pier or berth number, amounts, tips and status) and share the necessary details with the marina, buoy operator or restaurant that fulfils it.

Card payments are processed by our payment provider Stripe on its secure, PCI DSS-certified systems. Your full card number and security code are entered into Stripe's protected form and never reach or are stored on our servers; we only receive limited information such as the payment status, amount and the last digits and brand of the card. All data is transmitted over encrypted (TLS) connections.

2.5 Automatically collected information

Device type and operating system, app version, anonymous usage statistics, and crash and performance data. This data is used in aggregated form and is not used to identify you.

3. How we use your information and legal bases

  • To provide the Service — your account, the map and nearby locations, filtering by your vessel, bookings, orders and payments (performance of a contract, GDPR Art. 6(1)(b));
  • SOS emergency features — to help protect your life and safety (vital interests, Art. 6(1)(d)) and your consent where required;
  • Location features — based on your consent given through the device permission (Art. 6(1)(a)), which you can withdraw at any time;
  • Optional health data (blood type) — only with your explicit consent (Art. 9(2)(a)), or where needed to protect your vital interests in an emergency (Art. 9(2)(c));
  • Service communications — important messages about bookings, orders and changes to the Service (contract and legitimate interests);
  • Improving reliability and security — analytics, crash reports and fraud prevention (legitimate interests, Art. 6(1)(f));
  • Legal obligations — accounting, tax and responding to lawful requests (Art. 6(1)(c)).

4. Sharing of information

We do not sell your personal data. We share it only:

  • with emergency services and coast guard when you trigger SOS;
  • with the marinas, buoy operators and restaurants you book with or order from — only what they need to serve you;
  • with trusted service providers acting on our behalf (hosting, database, authentication, maps, payments, notifications, analytics);
  • when required by law or by competent authorities.

All service providers are bound to protect your data and use it only on our instructions.

5. Third-party services

The Service uses, among others: Supabase (database and authentication), Google Firebase (hosting and push notifications), Google Maps, Sign in with Apple, Sign in with Google, Stripe (payments) and weather data providers. Each of them processes data under its own privacy policy.

6. International transfers

Some of our providers, and our own team, are located outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

7. Data storage and security

We use secure storage, limit access to personal data to those who need it and encrypt data in transit. No system is 100% secure, however, and we cannot guarantee absolute security.

Our protection measures include technical security controls, passwords and access control on all systems and software, anti-malware protection and monitoring. Card data is never processed on our systems — see our Payment Security Policy.

8. Data retention

We keep personal data only as long as necessary to provide the Service, to comply with legal obligations (for example, accounting records for payments) and to keep emergency-related records. When you delete your account, we delete or anonymise your personal data unless we are legally required to keep it.

9. Your rights

Under the GDPR and applicable law you have the right to access your data, correct it, request its deletion, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (for example, for location or notifications) without affecting earlier processing.

To exercise your rights or delete your account and data, email contact@softering.com from the address linked to your account. We reply within one month.

A request for access to your data should include your name, the email linked to your account (or other details that let us identify you), the data you are asking about and the purpose of the request. We respond within 30 calendar days of receipt, unless the law provides otherwise. Inaccurate data is corrected without delay once we learn about it.

You also have the right to lodge a complaint with a supervisory authority — in Greece, the Hellenic Data Protection Authority (www.dpa.gr).

10. Cookies and web analytics

The website yacap.gr uses only the browser storage needed for it to work (for example, remembering your language choice). If we add cookies or web analytics in the future, they will be used to understand how the website is used and improve it; data such as IP address and browser type would be sent to the analytics provider in anonymised form, and we will ask for your consent where the law requires it. You can block or delete cookies in your browser settings; some website functions may then be limited.

11. Confidentiality

We treat all information you provide to us before, during and after using the Service — in any form — as confidential, except information that is publicly available or lawfully obtained from a third party. We do not use it for purposes unrelated to the Service and do not disclose it to third parties except as described in this policy.

12. Children's privacy

The Service is not intended for users under the age of 18. We do not knowingly collect data from children; if we learn that we have, we will delete it.

13. Changes to this policy

We may update this policy from time to time. The current version is always available at yacap.gr/policy with its effective date; significant changes will also be announced in the app.

14. Contact us

Softering LLC · contact@softering.com