Steeryn · Legal
Privacy Policy
Version 2026-10-17 (effective date)
Steeryn (operated by Costa Technology Advisory LLC, a Texas limited liability company, "Steeryn", "we") operates the platform at steeryn.com (the "Service"): business software for charter-yacht management companies. This policy explains what personal data the Service processes, why, and who else touches it.
Steeryn is a business-to-business product. There is no public signup and no consumer audience: every account is created by invitation from a charter management company that subscribes to the Service (a "Customer").
1. Who is responsible for your data
- For the data inside a Customer's workspace (bookings, guest names, crew rosters and employment records, vessel financials, owner and crew accounts), the Customer — the management company — is the controller: it decides why and how that data is processed. Steeryn processes it on the Customer's behalf as a processor, under a Data Processing Addendum with the Customer.
- If you are a guest, owner, broker, or crew member and want to exercise rights over your data (access, correction, deletion), contact the management company that holds your relationship. Steeryn assists the Customer with such requests under the DPA but does not decide them.
- For the limited data Steeryn needs to run the platform and the Customer relationship itself (your account email, sign-in and security records, support messages you send us, and billing records with Customers), Steeryn acts as described in this policy. Questions to steeryn@costasails.com.
2. What personal data the Service processes
Only what the platform needs. Concretely:
| Category | What | Where it comes from |
|---|---|---|
| Account data | Name, email address, role (manager, fleet manager, owner, crew), sign-in records | Entered when the Customer invites a user |
| Crew roster | Crew names, role titles, vessel assignments, and performance/bonus figures the Customer's managers configure | Entered by the Customer's managers |
| Crew employment records | Contact details, date of birth, home address, government identifiers (passport, social security, work permit; stored encrypted, only the last 4 digits visible in the app), salary terms, and certifications with expiry dates | Entered by the management company's staff |
| Guest names | Charter-guest names only as they appear in booking records synced from the Customer's own booking application. Steeryn does not collect guest contact details, guest payment cards, or guest passport data | The Customer's booking application |
| Broker/agent data | Names and business contact email, as they appear in the same booking records | The Customer's booking application |
| Vessel financial records | Per-vessel revenue, cost, and cash figures, including bank account balances. These are business records; they are personal data only to the extent a vessel is identifiable with an individual owner | The Customer's accounting and booking applications |
| Audit records | An append-only log of security-relevant actions (sign-ins, invitations, credential connections, price approvals, terms acceptances) | Generated by the Service |
| Technical records | IP address, device and browser information, and timestamps in sign-in and security logs | Generated when you use the Service |
| Support and communications | Messages and support requests you choose to send us | Sent by you |
The Service has no payment features: it does not collect or store payment cards or payment credentials. The Service does not intend to process special-category data (health, biometrics, etc.) and has no fields for it; do not upload sensitive personal information the Service is not designed to process.
3. Why (purposes)
- Operate the platform: dashboards, calendars, financial views, pricing analysis, crew views.
- Send transactional email only: invitations and password resets. No marketing email.
- Secure the Service: authentication, tenant isolation, audit logging, error monitoring, preventing misuse and investigating incidents.
- Manage billing and the Customer relationship, comply with law, enforce our agreements, and establish or defend legal claims.
We do not sell personal data. We do not share it for advertising. There is no advertising or behavioral profiling anywhere in the Service.
Steeryn does not use guest personal data to estimate an individual's willingness to pay or to personalize a charter price for that individual, does not use one Customer's nonpublic competitively sensitive information to generate pricing recommendations for another Customer, and does not use Customer workspace data to train a general-purpose AI model made available to others.
Where applicable law requires a legal basis, we rely on performance of a contract, our legitimate interests in providing and securing a business service, compliance with legal obligations, and consent where consent is required.
4. Who else processes data (sub-processors)
Steeryn runs on a small set of infrastructure providers. Each processes data only to provide its function to Steeryn, under contract:
| Provider | Function | Data it touches |
|---|---|---|
| Supabase | Database and authentication hosting | All workspace data, including the personal data in Section 2 |
| Vercel | Web application hosting | Data in transit while serving requests |
| Trigger.dev | Scheduled background jobs (data sync) | Booking and financial data during sync runs |
| Resend | Transactional email delivery | Recipient name and email address |
| Sentry | Error monitoring | Diagnostic data with personal data scrubbed (request bodies and headers dropped, users reduced to an ID); no session replay |
| Anthropic | AI extraction of market data and financial documents, where enabled | Market/competitor page content and financial documents. Guest names are replaced with non-personal tokens before any content is sent, so no charter-guest personal data reaches Anthropic |
This list matches Annex III of the DPA; Customers get notice before it changes.
The Customer's own systems are not our sub-processors. A Customer may connect the Service to its own accounting, booking, and market-rate applications. Those connections use the Customer's own credentials, under the Customer's own agreements with those vendors; Steeryn reads from them on the Customer's instruction. Credentials for these connections are stored encrypted and are never shown to any user, including Steeryn support staff.
Beyond the providers above, we disclose personal data only: to professional advisers, insurers, auditors, or authorities where reasonably necessary; to a successor in a financing, merger, acquisition, reorganization, or sale, subject to confidentiality protections; or where the Customer directs it or the person concerned consents.
5. Retention
- Workspace data is retained for the life of the Customer's subscription. On termination the Customer has an export window, after which Steeryn deletes or returns the personal data within 60 days per the DPA; copies in backups are deleted as the backups expire in the ordinary course, and anything law requires us to keep is kept only that long.
- De-identified market observations (competitor rates and availability captured from public and market-data sources) are retained indefinitely. They describe vessels and market prices, not individuals; they contain no guest, crew, or account personal data.
- Audit logs are append-only and retained for the life of the Customer's subscription; on termination they are deleted or returned with the rest of the workspace data per the DPA.
- Steeryn's own records (account, support, billing, and security records Steeryn holds in its own right) are kept as long as reasonably needed for the purposes in Section 3, including legal, accounting, and dispute-resolution requirements.
6. Security
- Tenant isolation: every database table is protected by row-level security scoped to the management company; isolation is covered by an automated cross-tenant leak test that gates every release.
- Access control: invite-only accounts, role-based access (manager, fleet manager, owner, crew), minimum password length 12. Two-factor authentication is mandatory for every account. Owners see only their own vessels; crew see only their own performance records. Crew employment records, including government identifiers, are visible to the Customer's managers only, enforced at the database layer.
- Encryption: TLS in transit everywhere; third-party credentials and crew government identifiers stored encrypted (AES-256-GCM) with a key held outside the database. Identifiers are write-only: the application has no capability to display a stored identifier back, and the interface shows at most the last 4 digits, never the full value.
- Monitoring: error tracking with personal data scrubbed; append-only audit log.
No system is perfectly secure; the DPA sets out breach-notification duties to Customers. Subscribed Customers can request the full security measures (DPA Annex II).
7. International transfers
The infrastructure providers in Section 4 are US-based; the primary database is hosted in the United States. Where data about EU/UK individuals is processed, international transfers rest on the safeguards set out in the Data Processing Addendum with the Customer.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, to appeal a decision, and to complain to a regulator. Because the management company is the controller for workspace data, send requests to that company; Steeryn will assist it as required by the DPA. For anything Steeryn holds in its own right, write to steeryn@costasails.com. We may need to verify your identity and authority before responding, and authorized agents must show evidence of their authority where required.
9. Children
The Service is business software and is not directed to children; we do not knowingly create accounts for children. A Customer's booking records may identify minor charter guests by name. In that situation the Customer determines why the information is processed, and Steeryn processes it on the Customer's behalf under the DPA.
10. Cookies
The Service uses only cookies that are necessary to sign you in and keep your session working. There are no analytics or advertising cookies. Details in the Cookie Policy.
11. Changes
We will post changes here with a new effective date, and give Customers notice of material changes (including sub-processor changes, per the DPA).
12. Contact
Costa Technology Advisory LLC
steeryn@costasails.com