Privacy Policy

This Privacy Policy applies to the OffshoreTrainer platform (accessible via offshoretrainer.me and the OffshoreTrainer iOS application), related training services, Document Vault, and account infrastructure.

The Data Controller responsible for personal data processing under the European General Data Protection Regulation (EU GDPR 2016/679) and the Montenegrin Law on the Protection of Personal Data (Zakon o zaštiti podataka o ličnosti — ZZPL) is:

We process different categories of data depending on how you interact with our services:

• Account & Authentication Data: Email address, user display name, profile avatar (if uploaded), unique Supabase authentication UUID, and sign-in session timestamps.
• Training, Practice & Assessment Records: Exam attempt history, question responses, scoring, completion timestamps, practice mode progress, bookmarks, and verifiable training certificates.
• Document Vault Records (Client-Side Encrypted): Document metadata (UUID, encrypted size, creation timestamp) and client-side encrypted ciphertext. In the current production deployment, documents are stored exclusively in your local browser database (IndexedDB) and are not uploaded to our servers. Plaintext document contents are never accessible to OffshoreTrainer.
• Messaging & Crewing Communications: End-to-end encrypted message envelopes, public device identity keys (X25519), and seafarer CV or vacancy applications you explicitly submit to designated maritime employers.
• Subscription & Payment Status: Entitlement tier (Free / Pro), subscription lifecycle status (active, past_due, canceled), renewal date, Dodo Payments Customer ID, and Apple In-App Purchase receipt tokens. We never receive or store your credit/debit card numbers or CVV codes.
• Technical & Analytics Data (Consent-Gated): Anonymous visitor identifier (ot_vid), session identifier (ot_sid), page views, heartbeat intervals, referring URL, UTM parameters, browser user agent, and coarse city/country derived from IP at the edge.

We process your personal information only when lawful grounds exist under GDPR Article 6(1):

OffshoreTrainer includes a seafarer Document Vault designed to protect critical maritime certificates, discharge books, and competence records:

Our direct messaging and crewing tools connect seafarers with maritime operators:

• End-to-End Encrypted Messaging: In-app messages are sealed using pairwise X25519 ECDH key exchange and AES-256-GCM. The relay server cannot read or inspect message contents.
• Crewing Applications & CVs: When you apply to a vacancy or submit your crewing profile, your information is transmitted exclusively to the specified employer or crewing agent.
• Feature Status: Crewing and messaging components operate in designated production or pilot availability as indicated on the platform.

In compliance with the ePrivacy Directive (Directive 2002/58/EC Art. 5(3)) and GDPR:

To ensure highest standards of financial security and regulatory compliance:

• Web Subscriptions (Dodo Payments Inc.): For web-based purchases, Dodo Payments Inc. acts as the Merchant of Record (MoR). Dodo Payments collects and securely processes payment cards, calculates local VAT/sales tax, and issues official invoices. You can manage or cancel your subscription at any time using the self-service billing portal in your Account Settings.
• iOS App Subscriptions (Apple Inc.): Subscriptions purchased through the iOS application are processed by Apple Inc. as Merchant of Record under Apple Media Services Terms and Conditions. Apple handles billing, payment processing, and cancellations via your Apple ID subscriptions menu.

We partner with trusted technical providers under contractual data protection commitments:

OffshoreTrainer is operated by Yggdrasil D.O.O. from Montenegro, serving maritime professionals worldwide. When personal data is processed by our service providers outside the European Economic Area (such as in the United States), transfers are conducted in accordance with GDPR Chapter V, relying on provider-incorporated Standard Contractual Clauses (SCCs), technical access controls, or statutory adequacy decisions recognized by the European Commission (such as for Switzerland).

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Account & Training Records: Retained for the duration of your active account to allow ongoing progress tracking and certificate verification.
• Account Deletion: You can request permanent account deletion at any time by contacting info@yggdrasil-doo.me or using account settings tools. We will delete the Supabase Auth account and associated user profiles, training/exam records, direct-message envelopes, and device identifiers that we control, subject to legal retention duties and records held by independent providers. Dodo Payments customer records and Apple purchase history are controlled by those providers and must be handled through their support/privacy channels. Documents already sent in a job or crewing application may remain with the recipient employer or agency; we cannot delete copies held by third parties.
• Financial & Tax Records: Invoices and transaction records are maintained by the relevant Merchant of Record (Dodo Payments or Apple) in accordance with statutory tax and accounting retention requirements.
• Technical Infrastructure Logs: Diagnostic and security runtime logs are temporarily maintained by our hosting infrastructure (Vercel) for operational monitoring, DDoS mitigation, and error diagnosis, and are automatically overwritten or purged in accordance with standard infrastructure log retention cycles (typically 24 hours to 30 days).

Subject to applicable data protection laws, you possess the following rights:

• Right of Access (Art. 15): Obtain confirmation as to whether your data is processed and request a copy.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to Restriction of Processing (Art. 18): Restrict the processing of your data under certain conditions.
• Right to Data Portability (Art. 20): Receive your training records in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting lawful processing prior to withdrawal.

To exercise any of these rights, email us at info@yggdrasil-doo.me. We respond to verified requests within 30 days without charge.

12. Children

OffshoreTrainer is a professional maritime training service intended for adults and is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us at info@yggdrasil-doo.me so we can investigate and delete it where legally required.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or technical changes. Substantial modifications will be announced via platform notice or email before taking effect.