Effective date: 1 March 2026
This Privacy Policy explains how MCD ("we", "us", or "our"), based in Spain, collects, uses, and protects the personal data of users of NaviShare (navishare.io). As a company established in the European Union, we are subject to the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
The data controller is MCD, Spain.
Contact: navishare@navishare.io
When you register, we collect your first name, last name, and email address. You may optionally add a profile photo.
Data you enter about your boats, co-owners, bookings, expenses, maintenance logs, and uploaded documents (e.g. insurance certificates, registration papers). This data is provided entirely by you.
We use PostHog (EU cloud) to collect anonymised analytics about how users interact with the platform. This includes page views, feature usage, and session recordings. PostHog data is stored within the European Union.
Standard server logs including IP address, browser type, and timestamps, retained for security and debugging purposes.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the NaviShare service | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (booking confirmations, expense notifications, document expiry alerts) | Performance of a contract (Art. 6(1)(b)) |
| Analytics and product improvement | Legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention, and debugging | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
We share your data only with trusted processors necessary to operate the service:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | EU (AWS eu-west-1) |
| PostHog | Product analytics and error tracking | EU (EU Cloud) |
| Resend | Transactional email delivery | USA (SCCs in place) |
Resend is based in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to legitimise this transfer.
We retain your account and operational data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, unless we are required by law to retain it longer. Anonymised analytics data may be retained indefinitely.
As a data subject in the EU, you have the right to:
To exercise any of these rights, email us at navishare@navishare.io. We will respond within 30 days.
You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD): www.aepd.es.
NaviShare uses only strictly necessary cookies to maintain your session (authentication). We do not use advertising or tracking cookies. PostHog analytics uses a first-party cookie to identify sessions; you can opt out via your browser settings.
NaviShare is not directed at children under 18. We do not knowingly collect personal data from minors.
We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The current version is always available at navishare.io/privacy.
Privacy questions or requests: navishare@navishare.io