Privacy Policy (early access)

1. Who is responsible

PivotScanner is run by Ryan Hill, who is responsible (the “controller” under the GDPR) for the personal data described here. Contact: support@pivotscanner.com.

Details about crew members that you enter are different: for those, you are the controller and we process them on your behalf, as set out in section 6 of our Terms of Service.

2. What we collect and why

• Your account: your email address and password (the password is stored only in hashed form). We use them to give you an account and keep it secure.
• Your company and fleet: your company name, vessel names, IMO numbers and flag States. We use them to provide the service. If you tell us how you heard about PivotScanner, we use that to learn which channels work (our legitimate interest, Article 6(1)(f)).
• Records you enter: crew and staff details such as names, nationalities, certificates and expiry dates, hours of rest and documents, plus maintenance and drill records. We process these on your behalf (Terms, section 6). Nationality is processed only for maritime regulatory requirements, such as STCW certification and flag State rules.
• Emails we send you: account emails (confirming your address, sign-in links, password resets and email changes), and reminder emails listing certificates or documents that are due, which can include crew names. Reminders go to the address set on the Notifications page (under More in the app), which is the email you signed up with unless you change it, and you can change the reminders there. We also email account holders about early access and launch, such as the announcement of the launch date (Terms, section 3).
• Messages you send us: if you write to us through the contact form, your name, email address, company (if given), subject and message; if you email one of our pivotscanner.com addresses, such as support@pivotscanner.com, your email address, your name as it appears on the email, your message and anything you attach, plus the details every email carries, such as when it was sent. We use them to answer you.
• Error reports: if something goes wrong in the app, a technical error report (such as the page, the browser and the error) may be sent to Sentry. It is set up not to attach your IP address, cookies or account details.
• Technical logs: our hosting and database providers keep short-lived technical logs, such as IP addresses and request times, to run and secure the service.

We use your account, company and fleet data, and send you emails, to provide the service you signed up for (GDPR Article 6(1)(b)). When you ask to use one of your rights (section 6), we handle your request to meet our legal obligation under the GDPR (Article 6(1)(c)). Error reports and technical logs rely on our legitimate interest in keeping PivotScanner working and secure, and other messages you send us (through the contact form or by email) on our legitimate interest in answering you (Article 6(1)(f)).

To open an account you need to give us an email address and a password, and to set it up, a company name and a vessel name. Without them we cannot provide the service. Everything else you enter is up to you.

3. On your device

PivotScanner stores two kinds of data on your device, both its own: sign-in cookies that keep you signed in, and offline storage in your browser (IndexedDB, localStorage, sessionStorage and the service worker’s caches) that lets the app work without a connection and remembers your settings, such as your language. There are no analytics, advertising or cross-site tracking cookies, so there is no cookie banner. You can clear all of this from your browser’s site settings. That also removes changes that have not synced yet, so reconnect and let them sync first.

4. Service providers

PivotScanner is free during early access: we do not ask you to pay for it. The Billing page can still open a checkout page. That page is run by Creem (Estonia), which handles anything you enter there under its own privacy policy. If you pay anyway, we refund the payment.

Your account and fleet data are stored in the EU. Supabase, Vercel, Resend and Sentry are US companies, so some data may be processed in or accessed from the US: Resend keeps records of the emails it sends (which can include crew names) in the United States, and Sentry keeps error reports there. Requests to the app also pass through Vercel’s network in other countries on their way to Frankfurt. Each of these four providers offers data protection terms that include the EU Standard Contractual Clauses; email us for a copy of these safeguards.

Email to us works differently. Apple handles email sent to our pivotscanner.com addresses, such as support@pivotscanner.com, and our replies, under its own terms (the iCloud terms and Apple’s privacy policy): we have no data protection terms with Apple. Apple generally stores this email in the United States, in its own or third-party data centers, and Apple Inc. and other Apple companies may process it. Apple’s privacy policy says that its transfers of personal data collected in the European Economic Area, the UK and Switzerland are governed by Standard Contractual Clauses, and that you can ask Apple for a copy of them at apple.com/legal/privacy/contact.

We will update this list before adding or replacing a provider.

5. How long we keep it

• Your account and records: for as long as your account is open. When you close it or ask us to delete it, we delete your account and records promptly, and within one month at the latest. Copies in database backups are overwritten when old backups are replaced, and copies on your own devices stay until you clear them (see section 3).
• Hours of rest and crew certificates: kept for as long as the account exists, not deleted on a timer, because a flag State or port State control officer can ask to see them. They are deleted with the account.
• Email send log: for as long as your account is open; it is deleted with the account.
• Messages you send us (through the contact form or by email), and our replies: until you ask us to delete them.
• Error reports and technical logs: for the short periods our providers keep them.

6. Your rights

Under the GDPR (in the EU and the UK) you can ask to see the personal data we hold about you, correct it, delete it, limit how we use it, get a copy to take elsewhere, and object to a use. You can export your records yourself at any time from the Export data page (under More in the app). For anything else, email support@pivotscanner.com from your account’s email address, or from the one you wrote to us from. We may need to confirm it is you, and we reply within one month, as the GDPR requires.

Your right to object: where we rely on our legitimate interest (error reports, technical logs, messages you send us other than requests to use your rights, and how you heard about us), you can object at any time, and we will stop unless we have compelling legitimate grounds or need the data for a legal claim.

If your employer entered your details into PivotScanner, please ask them first: they decide how your details are used, and we will help them answer you.

You can also complain to a data protection authority, for example the one in the country where you live or work.

7. Changes to this policy

We will update this policy when what we do with personal data changes, and tell you about an important change before it applies.

Last updated: 2026-10-29