Privacy policy
Last updated: 6 November 2026
1. Who is responsible
Vitan AS, org. no. 914 876 303, Lokketovegen 24, 5136 Mjølkeråen, Bergen ("we") is the controller of personal data in Shiphoy (shiphoy.com). Contact: svein@shiphoy.com. We are not required to appoint a data protection officer.
2. What we process, why, and on what basis
| Category | Examples | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account data | name, email, company, sign-in method (Google, Microsoft or email code), profile image URL from the sign-in provider | create and run your account | contract (6(1)(b)) |
| Sign-in and security data | session ID, timestamps, IP address, browser | keep you signed in, prevent abuse | contract and legitimate interest (6(1)(f)) |
| Trial searches without an account | signed cookie with a counter, IP address used for rate limiting | provide 5 free trial searches and prevent abuse | legitimate interest (6(1)(f)) |
| Searches | search text and filters are processed to give you results. The search text itself is not stored, neither on your account nor in the usage data (there are no saved lists yet) | deliver the service | contract (6(1)(b)) |
| Usage data | time (UTC); your account ID when signed in. Use without an account is counted without any identifier: no visitor ID, no cookie and no IP address is linked to the events. What happened: sign-up (the email domain only, e.g. "company.com", never the address), sign-in, search, a vessel page viewed, result opened, contact clicked, vessel opened from the map, feedback and a used-up trial. For a search only structured fields are stored: cargo type (class), loading and discharge port as a port code, quantity range, full or part cargo, number of results and response time. Never the search text, IP address, browser information or email address | understand who uses Shiphoy and how, and improve the search and the results | legitimate interest (6(1)(f)) |
| Feedback on results | "Good match?" (yes/no) for a vessel in a search, an optional short comment you write yourself, IMO number, the search's structured summary (as above) and your account ID when signed in; without an account no identifier | improve the ranking and the results | legitimate interest (6(1)(f)) |
| address, sign-in codes and service messages | send sign-in codes and necessary messages | contract (6(1)(b)) | |
| Enquiries | what you write to us | reply to you | legitimate interest (6(1)(f)) |
We use no third-party analytics or advertising tools, and we do not sell personal data. The usage data and feedback are stored only in our own database at Render in Frankfurt, are not shared with any third party, and only we see them, in aggregate on an internal page. If error monitoring (Sentry) is in use, it is configured without personal data: IP addresses, email addresses and request content are removed before anything is sent.
About vessel data: Shiphoy shows public AIS data and information from shipowners' and operators' own websites. This is about ships, not people. Where a commercial contact (e.g. a name or work email from a public website) is shown, it is processed on the basis of a legitimate interest in sharing business contacts within the industry, with source and date shown. We only show contact details published by the business itself, and you can ask to be removed.
3. How long we keep data
| Category | Retention |
|---|---|
| Account data | while the account is active. Ask us to delete the account (contact us) and we delete it within 30 days |
| Searches | the search text is not stored; the structured search events are usage data (below) |
| Usage data | 13 months, then deleted automatically (daily). If we delete your account, the usage data loses its link to the account |
| Feedback on results | kept longer, but after 13 months the link to the account is removed automatically (daily); the answer, comment, IMO and the search's summary are kept. If we delete your account, your feedback is deleted |
| Sessions | until sign-out or expiry (max 7 days, renewed while you use the service). The session record in the database holds the IP address and browser information (user agent) from sign-in and follows the session's lifetime |
| Trial counter and IP for rate limiting | cookie: 30 days. The IP address is used to limit searches and sign-in attempts and is held only in the server's memory, for at most 24 hours (also reset when the service restarts); it is not stored in the database |
| Server logs | kept by the hosting provider (Render) under its own rules; we have no retention job of our own |
| Email logs at Resend | under Resend's own rules; we have no retention job of our own |
| Enquiries | as long as needed to handle the matter |
| Accounting records (once payment is introduced) | 5 years under the Norwegian Bookkeeping Act |
4. Processors and recipients
| Provider | Role | Location |
|---|---|---|
| Render Services, Inc. | hosting, database, background jobs | data stored in Frankfurt (EU); US company |
| Resend, Inc. | sending email | USA |
| Mapbox, Inc. | map tiles and map style. When the map loads, Mapbox receives your IP address and the map-load events needed to serve the map. We have switched off Mapbox's performance metrics collection. Mapbox may store an anonymous identifier and counters in your browser's local storage (localStorage, keys starting with mapbox.eventData), without cookies | USA |
| Functional Software, Inc. (Sentry) | error monitoring if it is in use, without personal data | EU region (Germany); US company |
Google and Microsoft are independent controllers for their part when you choose to sign in with them; we receive only name, email and, if available, profile image. The sign-in system (Better Auth) runs on our own servers and is not a separate provider.
5. Transfers outside the EU/EEA
Some providers are US companies, and Resend and Mapbox process data in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (SCCs). We have data processing agreements with the providers.
6. Your rights
You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. Write to svein@shiphoy.com; we reply within 30 days. You can ask us to delete your account. You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), but we would appreciate hearing from you first.
7. Changes
We update this policy when needed and notify signed-in users of material changes. See also the terms and the cookie notice.