Boatspace Privacy Policy

Last updated: 11 September 2026

This policy covers the Boatspace web application (https://boatspace.io) and the Boatspace mobile app for iOS and Android (package identifier io.boatspace.app).

It describes what the product actually stores and transmits today, not what it may do in future. Where the product falls short of what this policy would ideally promise, we say so rather than paper over it.

1. Who is responsible

Brahl Solutions AB, Tegnérsgatan 9B, 412 52 Göteborg, Sweden. Swedish company registration number 559270-4166.

Privacy contact: info@bahlsolutions.se, a monitored role address. Johan Birgersson is responsible for privacy questions at Brahl Solutions.

Data protection officer: none. Brahl Solutions is not required to appoint a data protection officer, and has not appointed one. Send privacy questions to the address above.

Brahl Solutions is the controller for: user accounts and sign-in; product analytics, session replay and error diagnostics across the whole product, including the marina workspace; product feedback and support correspondence; and our own sales research about boatyards.

A marina or boatyard decides what is recorded about its own customers and their boats — customer contact details, vessel data, inspections, photographs, internal notes, work orders and costs.

We will not pretend these two are cleanly separated. Because Brahl Solutions decides, on its own, to send analytics and session recordings of the marina workspace to PostHog for our own product-development purposes, and because Brahl Solutions staff holding an internal support role can read records across all marinas, we act as a controller over some data that a marina entered about its customers.

Whatever the formal allocation of roles between us and a particular marina, you may send any request under this policy to us. We will act on it ourselves or pass it to the marina that holds the record and tell you which one that is.

2. Whose data is in Boatspace

• Marina and boatyard staff who sign in.
• Boat owners who sign in to the owner portal.
• Boat owners and other customers who have no account, recorded in a marina's customer register with name, email address, telephone number and free-text notes.
• People invited by email who have not (yet) accepted, including invited boat owners, whose name is stored as well as their address.
• Brahl Solutions internal staff.
• Named contacts at boatyards and marinas in our sales research database, who have not contacted us.
• People who are incidentally visible in a photograph, or audible in a video, taken in a yard.

3. What we hold, and why

3.1 Your account and how you sign in

Your email address is your account identifier. Boatspace signs you in by sending a one-time link to that address; the link can be used once and then expires. How long an unused link stays valid is a setting in our authentication provider rather than something this policy fixes; we will tell you the current value if you ask.

Ordinary accounts have no password. There is one exception, and we would rather name it than let you discover it: the iOS app also offers a password sign-in, because Apple's App Review team cannot receive a link sent to a mailbox they do not have. A password is set on one dedicated review account only; ordinary accounts have none and that path simply fails for them.

We also store your full name and display name if supplied, a permanent user ID, your marina membership and role, and your chosen interface language (Swedish or English). Your email address, name and role are visible to other staff at any marina you belong to.

Lawful basis: Article 6(1)(b) (performance of a contract) where you are our contracting user; Article 6(1)(f) (legitimate interests — operating an authenticated service for our customer) where your employer or marina is the contracting party.

3.2 The vessel record

Name, make, model, year, length and beam, home port, registration number, hull identification number (HIN), engine, drive and power details; who owns the boat and since when; which yard currently holds it, where it is stored on the site, and its season status; and the service history, with each entry attributed to the yard or the owner who supplied it.

A registration number or HIN linked to a named owner is personal data about that owner, not only about the boat. The same is true of the storage location: it says where a named person's property physically is.

Lawful basis: Article 6(1)(b) — performing the yard's service agreement with the boat's owner; Article 6(1)(f) for maintaining an accurate, durable vessel record across changes of owner and yard.

3.3 Customer contact records held by a yard

Name, email address, telephone number and free-text notes about the boat's owner or the person the yard bills. These people need not have a Boatspace account and may never have used the product; the yard, not the person, supplies the record (see section 10). Every staff member at that marina — in any role, including seasonal lift crew — can read and change these records.

When a yard adds a boat and invites its owner, we also store a fingerprint (an unsalted MD5 hash) computed over the owner's name, email address, telephone number and note, used to make that multi-step operation repeatable without creating duplicates. A hash of an email address is still personal data, not anonymous data.

Lawful basis: Article 6(1)(b) (the yard's contract with its customer) and Article 6(1)(f) (running a boatyard's customer register).

3.4 Photographs, video and documents

• Photographs taken in the app, or picked from your phone's photo library through the app, are re-encoded before upload (longest side 2400 px). Camera metadata, including any location the phone recorded, is removed in that re-encoding.
• Video is recorded at 720p, up to 60 seconds, with sound — a technician's spoken commentary, and anything else audible nearby, is part of the file. Video is uploaded exactly as the phone recorded it, with no re-encoding, so any location or device metadata the camera wrote into the file is preserved.
• Documents uploaded from the browser — invoices, survey reports, insurance papers, estimates, manuals — are stored as received. Nothing is stripped from them, and the original filename becomes part of the stored file's path; invoice filenames often contain a customer's name. Our validation accepts files up to 25 MB, but a browser upload passes through our hosting platform, which limits a single request to about 4.25 MB, so in practice larger files fail. Pre-lift position photos uploaded from the browser are limited to 4 MB.
• Files are held in private storage with no public read access. Viewing one produces a signed link that stops working after five minutes.

Lawful basis: Article 6(1)(b) — documenting the condition of a boat and the work done on it; Article 6(1)(f) — evidence in the event of a later dispute about damage or workmanship.

3.5 Free text written about a boat

Findings and defects (title, description, severity, whether they block a lift, triage notes); inspection results, measurements and reasons an item was skipped; photo captions (up to 500 characters); material notes (up to 4,000 characters); work-order titles, descriptions and the reason a work order was moved to trash; marina-internal notes about a vessel; arrival-condition notes at the start of a season; cost entries with amounts and notes; approval requests sent to owners and the owner's written answer; and messages sent to owners, including whether and when the owner opened the message.

If you are a boat owner, this matters to you: the yard's internal notes, its findings about your boat, its capture records and its cost entries are never shown in the owner portal. What you see is the service history, the documents and the messages the yard has deliberately published to you. Owners can also add service history themselves, which the yard then reviews; the reviewer's comment on your submission is written by the yard, not by you.

3.6 Records about how staff work

Boatspace records who checked what and when, how many minutes a named technician logged against a job, which materials that technician consumed, an audit log of actions taken in a marina workspace (who did it, what was affected, and a data payload that can include an invited person's email address), and — where a Brahl Solutions operator has excluded one staff member from one boat — a free-text reason for that exclusion.

This is employment-context personal data and, taken together, a monitoring measure. Swedish co-determination law may require a yard to consult its union before introducing it, and we tell every yard so before rollout.

Lawful basis: Article 6(1)(f) — running the yard's operations, cost accounting and an accountable audit trail.

3.7 Invitations

Invitations to staff store the invited email address; invitations to a boat owner store the invited email address and name, plus an invitation token. Tokens stop working after 14 days; the record itself is kept.

Today the product records invitations but does not send the invitation email — no email provider is connected to that path. A person who opens an invitation link without signing in sees a partially masked version of the invited email address (first two characters plus the full domain); the invited person's name, the vessel and the marina are shown only after they sign in with a matching address.

3.8 Email we do send

• Sign-in links, sent through Supabase Auth to the address you type.
• Work-order export PDFs. When someone exports work orders from the mobile app, a PDF is generated and emailed through Resend to one fixed mailbox controlled by Brahl Solutions, not to the person who requested it. The PDF contains the vessel name, make and model, the marina, and for each work order its title, status, type, due date, assignee name, logged minutes, material notes and linked finding titles with severity — plus the name or email address of the person who ran the export. That recipient address is currently also written to our server logs and returned to the app.
• Owner notifications are recorded in the database (recipient address, title, message body, action link, status) but are not currently delivered — no provider is connected. Nothing in this category reaches an email service today.

3.9 Product feedback

Feedback you send from the account screen is 5–4,000 characters of your own text, stored with your user ID, the page you sent it from, your language, the environment and the release. You cannot edit or delete it yourself from inside the product. It is covered by the retention period in section 8, and we delete it by hand if you ask us to. As part of turning feedback into a fix, the text is read by a scheduled task and may be quoted into a branch and a pull request in our source repository at GitHub, which is private. Our internal instruction is that the reporter's identity is not quoted, and the automated export does not include your user ID — but the text is your own words, and we cannot guarantee that words you wrote do not identify you.

3.10 Device information

Every photo, video and scan is stored with a device string: manufacturer, model, operating system and version (for example "Apple · iPhone 15 Pro · iOS · 26.1"). Our analytics SDK additionally attaches the app version and build, device model and type, operating system, device language, time zone, whether the app is running in a simulator, and a device identifier it generates and keeps on your device.

3.11 Camera scanning of part labels

The article-number scanner runs Google ML Kit text recognition on the device. Camera frames are processed in memory and discarded; the scanner itself stores and uploads no image. What is stored is the recognised article number and the raw recognised text block, against the vessel and the technician who scanned it.

3.12 What stays on your own device

• The iOS Keychain: your session tokens, the marina you selected, and drafts of inspection findings and measurements you have started but not submitted. Cleared when you sign out or submit.
• App sandbox, not encrypted beyond the operating system's own file protection: a queue database and the photo and video files waiting to upload, together with their captions. Successfully uploaded items are deleted from the phone 24 hours later; an item that has permanently failed to upload stays on the phone.
• Browser storage on the web: your open vessel tabs (including the boat names), theme and sidebar preference, plus PostHog's own analytics storage. These are not cleared when you sign out.

3.13 Sales research about boatyards

We keep an internal research database of candidate marinas and yards: company name, organisation number, location, website and social profiles, employee and financial figures, free-text notes, outreach stage and internal follow-up notes. Many of these businesses are one- or two-person operations, so the notes concern identifiable individuals who have not contacted us and whose data we did not obtain from them (see section 10). We send business names and localities to third-party geocoding services (OpenStreetMap's Nominatim; GeoNames and Overture Maps data are also used in this tooling).

Lawful basis: Article 6(1)(f) — direct business-to-business marketing and market research. You can object at any time (see section 11) and we will remove you.

4. Session replay — please read this one

Boatspace records web sessions as video-like replays and sends them to PostHog, where our team watches them. This is on for everyone signed in to the web application. There is currently no switch in the product to turn it off.

Session replay is switched off in the iOS app. The app no longer records the screen, the camera view, its own log output or its network timeline for replay purposes.

What a web recording contains today. The recording reproduces the page as it was drawn on your screen, with the text masked. Text you type into form fields is masked, and rendered text on the page is masked as well: vessel names, owner and customer names, email addresses, telephone numbers, internal notes, findings and cost figures appear as blocked-out shapes rather than readable words. What remains is the layout, the navigation and your interactions — which element you clicked, in what order, and how the page responded. Masking covers text, not images: photographs displayed on the page, including private vessel evidence photos, are still part of the recorded page.

Recordings made before this change are unmasked, and they still exist. Text masking on the web, and the removal of replay from the iOS app, were introduced after the product had already been in use. Recordings captured before that point reproduce the screen as it was: readable vessel, owner and customer data on the web, and on iOS a stream of screenshots that includes the live camera view during photography and filming. Those recordings remain in our PostHog project until they are purged. We are purging them. In the meantime, ask us and we will delete the recordings we hold of you straight away.

Recordings are linked to your account, so a named person is attached to each one. We use them to understand how our users actually work and to diagnose failures we cannot reproduce.

Lawful basis: Article 6(1)(f). Our interest is making an early-stage product work in real yard conditions; the number of users is small and the recordings are watched by our own team. We accept that this is intrusive, and that people whose data appears on screen — a yard's customers — are not the person using the product. If you do not want your sessions recorded, write to info@bahlsolutions.se. Be aware of what we can honestly offer today: there is no per-person or per-device switch, so we cannot stop the recorder from capturing your sessions. What we do is delete the recordings we hold of you, and keep deleting the ones made after you ask, until we have built the ability to exclude you at source. We treat that as an unconditional commitment on our side, even where the law would allow us to weigh it (see section 11).

5. Analytics, page addresses and cookies

Besides session replay, Boatspace sends product analytics to PostHog: which screens you opened and in what order, whether you completed or abandoned key flows, how long each took, upload successes and failures, and error types. The contents of free-text fields are not sent as such — a note becomes a character count, never its content. That is not the whole truth about text, though: item 2 below describes how automatic capture on the web can pick up text already visible on the page. Record identifiers (vessel, inspection run, work order) are sent.

Six things worth stating plainly:

1. Collection starts before you sign in. Both analytics clients start when a page or the app loads, so the marketing page, the sign-in page, the shared vessel page and an invitation link produce events and an anonymous device identifier before anyone signs in. No personal profile is created until you sign in; at that point the earlier anonymous identifier is linked to your account.
2. On the web, ordinary clicks, form changes and submissions are captured automatically, including the visible text and attributes of the element you interacted with. In the marina workspace that text can include an owner's or a customer's name.
3. Web page addresses are recorded with each page view. Query strings and fragments are removed before an address is sent, but the path itself is kept, and Boatspace paths contain record identifiers — including, on an invitation link, the invitation token, which is part of the path and is therefore recorded. That removal applies to the URL-bearing properties we have enumerated for the web client, not to every property an event can carry, so we cannot guarantee the list covers every URL-bearing property the installed SDK version sets. Events recorded before we made this change may still contain an address with its query string, as it was received.
4. Mobile screen tracking keeps the full route, including the vessel and inspection identifiers in it. When the app is opened from a link, the SDK also records the link that opened it, again with the query string and fragment removed. That removal is deliberate: a sign-in link carries a single-use authorisation code in its query string, and that code is no longer sent to PostHog from the URL-bearing properties we have enumerated — the same qualification as in item 3 applies to properties outside that list. Events recorded before we made this change may still contain such a link as it was received.
5. Web error reports and iOS crash reports go to PostHog, including exception type, message and stack trace.
6. PostHog's web SDK captures campaign parameters present in the address you arrived on (utm_*, gclid, fbclid and similar) as a matter of its own default behaviour; we neither configure nor disable it. We do not use them to build advertising profiles or share them with ad networks. The iOS app contains no advertising identifier, no App Tracking Transparency prompt and no advertising SDK. Boatspace does not track you across other companies' apps or websites, and we do not sell personal data.

Your browser and your phone connect to PostHog directly, so PostHog receives your IP address and may derive an approximate location from it.

Cookies and device storage on the web: an authentication cookie (its name begins sb- and ends -auth-token, with our project name at the authentication provider in between; necessary to keep you signed in); a language cookie (boatbase-preferred-locale, one year, readable by scripts, containing only "sv" or "en"); PostHog's own analytics and session-replay storage; and the browser storage listed in 3.12, which persists until you clear your browser. Only the authentication and language cookies are strictly necessary.

There is currently no consent banner and no in-product opt-out for the analytics storage. Storing non-necessary data on your device requires your consent under Swedish electronic communications law, and we do not yet ask for it. Until we do, write to info@bahlsolutions.se and we will delete what has been collected from your device. We cannot yet stop collection for a single device, so what we can offer is deletion, not an opt-out.

Lawful basis for analytics and error diagnostics: Article 6(1)(f).

6. Who else handles this data

We do not use Sentry, Google Analytics, Firebase Analytics, Segment, Amplitude or any advertising network.

Where a provider makes data processing terms available, those terms govern our use of that service. We do not, however, claim that one and the same contractual standard covers every recipient in the table: the map, geocoding and weather sources are open public endpoints, which is also why we send them no customer or owner data at all. If you ask which terms apply to a particular provider, we will answer with the position as it stands when you ask.

Access within Brahl Solutions: staff holding an internal support role can access records across all marinas, in order to support, operate and improve the product (Article 6(1)(f)). Access within a marina: unless stated otherwise above, every staff member of a marina can read that marina's customer records, vessel records, inspections, findings, internal notes, work logs and cost entries, regardless of role.

7. Transfers outside the EU/EEA

The database, file storage and authentication that hold the substance of Boatspace are hosted in the EU: production in eu-central-1 (Frankfurt) and our preview environment in eu-north-1 (Stockholm). Analytics, session replay and crash reports go to PostHog's EU Cloud in the EU.

Several of the other companies we use are established outside the EEA, and personal data may be processed or accessed from outside the EEA when they operate and support their services. Where that happens, we rely on the transfer safeguards those providers make available in their own data processing terms. We have not yet worked through and established which transfer mechanism applies to each individual provider in the table above. We will tell you, on request, which providers are involved in a given part of the product and what we know about the safeguards at the time you ask.

8. How long we keep things

Boatspace exists to keep a boat's history intact across changes of owner and yard, so the vessel record is kept for a long time on purpose. It is not kept forever, and it is not kept "until you ask us to delete it". These are the periods we apply:

Shorter technical periods, on top of the table:

• Work orders you move to trash are permanently deleted 30 days later, by an automated job that runs daily. The files attached to that work order are not deleted — photos, videos and documents remain in the vessel's document library, with the link to the deleted work order removed.
• Invitation tokens stop working after 14 days; the invitation record itself is kept.
• Sign-in links can be used once and then expire; how long an unused link stays valid is a setting in our authentication provider, which we will tell you on request. Download links for a stored file expire after 5 minutes; a mobile upload reservation after 30 minutes.
• Uploaded photos and videos are deleted from the phone 24 hours after the upload succeeds.

We also say what the table does not cover: inspections, findings, work orders, internal notes, the audit log, and invitation and notification records have no retention period of their own. We have not set one for them, and nothing in the product deletes them independently of the vessel record they belong to.

Two honest qualifications. First, the trash purge is the only deletion the product performs automatically today. The periods in the table are applied by us on review, and for analytics events, error reports and recordings it is the project setting at PostHog that determines actual deletion — we have not yet confirmed that it is set to the periods above. We are building the automation that will enforce them. Second, session recordings made before we masked text on the web and switched replay off in the iOS app are unmasked and still exist in our PostHog project. We are purging them, and you can ask us at any time to delete the ones that show you.

9. Security

Ordinary accounts are passwordless, so there is no password of yours to be stolen; the single App Review account described in 3.1 is the exception. Access to records is enforced in the database itself by row-level security, scoped to the marina you belong to or the boat you own — not only in the application layer. Some server-side operations necessarily run with an elevated database credential and are not subject to those row policies: storing and serving files, minting signed download links, writing the audit log, looking up an invitation by its token, and the nightly retention job. File storage buckets are private with no public read access, and files are served through short-lived signed links. On iOS, session tokens are held in the Keychain and are only readable while the device is unlocked, on that device. The iOS app does not permit arbitrary unencrypted connections to the internet (local-network connections are permitted by the platform default we ship).

Three limits you should know about, because we would rather you learn them here:

1. Any staff member at a marina, in any role, can read and change every customer contact record and every vessel record at that marina. Row-level security in our database controls access by row, not by column, so an email address added to a shared record becomes visible to everyone who could already see that record.
2. The upload queue on a phone — the photos and videos waiting to be sent, and their captions — is stored in the app's own sandbox in an unencrypted database, protected only by the operating system's own file protection, and is not excluded from device backups.
3. Brahl Solutions staff with an internal support role can access records across marinas.

10. Where the data comes from, when it does not come from you

If you have no Boatspace account and your details are nevertheless in the product, they came from one of these sources:

• A marina or boatyard entered your name, email address, telephone number and any notes into its customer register, or invited you to claim your boat, or named you as a vessel's owner.
• Another user wrote about your boat, or photographed or filmed it, in the course of their work.
• For our sales research database: publicly available company information and imported source files (we record the filename of each import), enriched with third-party geocoding and information from company websites and social profiles.

Article 14 GDPR requires us to give you this information directly, normally within one month. We do not currently deliver it: there is no working email path in the product for invitations or owner notifications. Until there is, this policy is the document where that information is collected, published at the fixed address in section 16, and we also send it to you on request. You may also ask us at info@bahlsolutions.se what we hold about you.

11. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing we base on legitimate interests — which includes analytics, session replay, and our sales-research database.

For direct marketing, an objection is absolute as a matter of law: we stop, with no balancing. For session replay we choose to treat your objection the same way, as a commitment of ours rather than a legal requirement. What that means in practice today: we cannot switch recording off for one person, but we delete the recordings we hold of you and keep deleting new ones until exclusion at source has been built. For other legitimate-interest processing, the law requires us to weigh your objection against our grounds; we do that and tell you the outcome.

Deletion and export are manual today. There is no self-service way to delete your account or export your data from inside Boatspace, and no finished tooling for it on our side either. We do both by hand on request — in the product, and at PostHog for your analytics profile, your events and your recordings. Because the work is manual, we will tell you what we removed and when. When we erase an account we also look for the stored files belonging to it and remove them rather than leaving them orphaned.

Erasure has real limits we would rather state than hide. Cost entries and invoice records are kept for seven years because Swedish bookkeeping law requires it, and that obligation overrides an erasure request. A marina's service history and its evidence photographs may be needed to establish, exercise or defend legal claims about work on a boat, and where that is so we may keep them under Article 17(3)(e) and tell you what we kept and why. Where the marina is the controller, we will forward your request to it and tell you.

Write to info@bahlsolutions.se. We answer within one month, and will say if we need the two-month extension the GDPR allows.

If you are unhappy with how we handle it, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) — current contact details at www.imy.se — or to the authority where you live or work.

12. Do you have to give us your data?

Providing your email address is a practical requirement of having an account: it is the identifier and the only way in, so without it we cannot give you access. Everything else — your name, your interface language, the content you write — is optional in the sense that the product works without it, though a yard may need certain information from its customer in order to perform its own contract with them.

13. Special categories, children, automated decisions

We do not ask for and do not intentionally process special-category data under Article 9 — no health, biometric, political, religious or trade-union data — and we do not rely on any Article 9 condition. Two edges are worth naming: a video recorded in a yard captures sound and may pick up a bystander's voice or image, and a free-text note is a free-text field, so a technician could type something a policy cannot prevent. Our standing instruction to staff and to participating yards is that sensitive information must not be entered, and we remove such information when we find it. Photographs are never processed to identify a person.

Boatspace is a tool for boatyards and boat owners. It is not directed at children and we do not knowingly hold data about anyone under 13.

We make no automated decisions producing legal or similarly significant effects, and we do not profile you for such decisions.

14. If something goes wrong

If personal data is lost, exposed or accessed without authorisation, we assess the risk and, where required, notify Integritetsskyddsmyndigheten within 72 hours and inform affected people without undue delay. Where the data belongs to a marina's customers, we inform that marina without undue delay so that it can meet its own obligations. Report a suspected breach to info@bahlsolutions.se.

15. What the App Store privacy label declares

The list below describes what the iOS app collects, in the categories Apple's App Privacy label uses, and we keep the label in App Store Connect in line with it: Contact Info (name, email address, telephone number); User Content (photographs and video, audio recorded with video, inspection notes and other written content, support and feedback text); Identifiers (your account user ID, and device identifiers including the analytics device identifier and the device model/OS string stored with each capture); Usage Data (product interaction — which screens and flows you use — and other usage data including the link that opened the app); Diagnostics (crash data, performance data and other diagnostic data); Financial Info (yard-side cost entries recorded against a boat); and Location — coarse location derived by PostHog from the IP address your device connects with, and precise location where a phone's camera has written GPS coordinates into a video file, which we do not strip.

Session replay is a web feature and is not active in the iOS app.

All of it is linked to your identity, because the app identifies you to our analytics provider by user ID and email address. No data is used for tracking as Apple defines it: the app contains no advertising identifier and no advertising SDK.

16. Availability and changes

This policy requires no sign-in to read. It is published at the fixed address https://boatspace.io/en/privacy (Swedish: https://boatspace.io/sv/privacy) and linked from the website footer and from the app's App Store and Google Play pages. Here is what that looks like today, rather than how we would like to describe it: the mobile app does not yet link here from inside the app. We will add that link in a coming release. You can always have the policy sent to you on request at info@bahlsolutions.se.

We will post material changes here with a new "Last updated" date, and where a change affects how we use data you have already given us, we will make that clear at the top of the policy.

Questions: info@bahlsolutions.se · Brahl Solutions AB, Tegnérsgatan 9B, 412 52 Göteborg, Sweden.