Who we are
YOTCH Ltd ("YOTCH", "we", "us", "our") is a company registered in England and Wales (Company No. 17127312). We operate the YOTCH mobile application (the "App") and any associated website or services.
YOTCH is a direct crew discovery platform for the superyacht industry — technology infrastructure that enables captains, heads of department, and crew to connect with each other directly. YOTCH is not a recruitment agency and does not place seafarers on behalf of shipowners.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what your rights are. It applies to all users of the App.
YOTCH Ltd is the data controller for personal data processed through the App.
Minimum age
The App is intended for professional use only. Users must be at least 16 years of age to create an account. By creating an account you confirm that you meet this requirement.
If we become aware that a user is under 16 we will delete their account and associated data without notice.
Data we collect
- Name, email address, phone number, and profile photograph
- Uploaded CV — including employment history, vessel names and sizes, certifications, and dates of service
- Nationality, languages spoken, and preferred working location
- Availability status and geographic location (port-level, not precise GPS)
- Certifications and qualifications extracted from your CV by our AI
- AI-generated profile text and experience score
- In-app messaging content (when you receive and respond to captain messages)
- App usage data — screen views, swipe actions, response times, notification interactions
- Device information — type, operating system, app version, push notification token
- Name, email address, phone number
- Vessel name, size, type, programme, and flag
- MMSI number or management company email (for vessel verification)
- Position briefs — role, requirements, start date, quantity
- Swipe actions (flags and skips) against crew profiles
- In-app messaging content (messages sent to crew)
- App usage data — screen views, session duration, notification interactions
- Device information — type, operating system, app version, push notification token
- Payment card details or banking information — we do not currently process payments in-app
- Precise real-time GPS location — port-level detection only, with your permission
- Government identity documents
- Biometric data
How we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Name, email, phone, device info | Contract |
| Build and display your crew profile | CV, photo, certifications, location, AI-generated content | Contract |
| Verify captain and vessel identity | Email domain, MMSI, vessel name | Contract / Legitimate interests |
| AI profile generation and scoring | CV content, response data, usage behaviour | Contract |
| Enable direct messaging between captains and crew | In-app message content | Contract |
| Send push notifications | Push token, notification preferences | Contract / Consent |
| Detect user location for port matching | Approximate GPS (port-level only) | Consent |
| Improve the App — analytics and bug fixing | Usage data, crash logs, device info | Legitimate interests |
| Prevent fraud and enforce Terms of Service | Account data, usage patterns, IP address | Legitimate interests / Legal obligation |
| Comply with legal obligations | Any data necessary | Legal obligation |
Third-party services
We use the following providers to operate the App. Each processes personal data only as necessary, under contractual data processing terms with YOTCH Ltd.
| Provider | Service | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Backend infrastructure, S3 storage, SES email, CDN | Account data, profile data, CV files, images, logs | EU (London) |
| Google Firebase | Authentication, real-time database, push notifications | Auth tokens, notification data | EU |
| OneSignal | Push notifications | Device push token, notification interactions | USA ¹ |
| Google Cloud | Maps API — port detection | Approximate GPS coordinates | EU |
| Twilio (optional) | SMS OTP verification | Phone number | USA ¹ |
| AI provider | CV parsing and profile text generation | CV content — processed, not stored by provider | USA ¹ |
¹ Standard Contractual Clauses (SCCs) / UK IDTAs in place for all US transfers.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes. Crew profiles are visible to verified captains only. Vessel details remain private from crew until the captain initiates contact.
International transfers
Your data is primarily stored on AWS infrastructure in the EU (London region). Where we transfer data outside the UK or EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
- UK International Data Transfer Agreements (IDTAs) where applicable
You can request details of specific transfer mechanisms by contacting support@yotch.app.
Retention
| Data type | Retention period |
|---|---|
| Active account data | Lifetime of the account |
| In-app messages | 24 months from date of message, then deleted |
| CV and profile data | Active account lifetime. Deleted within 30 days of account deletion |
| Usage and analytics data | 13 months rolling |
| Crash logs and technical data | 90 days |
| Deleted account data | Deleted within 30 days of deletion request, except where required by law |
| Financial records (if applicable) | 7 years — UK legal requirement |
Your rights under UK GDPR
We will respond to all valid requests within one calendar month. Submit requests to support@yotch.app.
Request a copy of all personal data we hold about you. Subject line: "Subject Access Request".
Request correction of inaccurate or incomplete data. Most profile data can be updated directly in the App.
Delete your account and personal data at any time — via App settings or by emailing us. Completed within 30 days.
Ask us to restrict processing of your data in certain circumstances, for example while a complaint is investigated.
Request your personal data in a structured, machine-readable format.
Object to processing based on legitimate interests. We will cease unless we can demonstrate compelling grounds.
Withdraw consent (e.g. location access) at any time via device settings. Does not affect prior lawful processing.
Lodge a complaint with the ICO at ico.org.uk or call 0303 123 1113.
Cookies & tracking
The YOTCH App does not use browser cookies. We use functional analytics to understand how the App is used and to improve it. This data is aggregated and is not used for advertising or sold to third parties.
- Push notifications — to alert you when a captain flags your profile or sends a message. Disable at any time in device settings.
- Location (approximate) — to detect your current port for profile visibility. Port-level only, not continuous GPS tracking. Disable at any time in device settings.
- Camera and photo library — to upload your profile photograph only. We do not access your camera or photos without explicit action on your part.
Data security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure:
- Encryption of data in transit (TLS 1.2+) and at rest
- Access controls — personal data accessible only to authorised personnel
- Three-tier captain verification to prevent fraudulent profiles accessing crew data
- Regular security testing and monitoring
- Incident response procedures in the event of a data breach
In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay and report to the ICO within 72 hours as required by UK GDPR.
Children's data
The App is not directed at children. Users must be at least 16 years of age. We do not knowingly collect personal data from anyone under 16. If you believe a user under 16 has created an account, contact support@yotch.app and we will delete the account promptly.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify users via in-app notification and update the effective date at the top of this document. Continued use of the App after notification constitutes acceptance of the updated policy.
The current version of this policy is always available within the App and at yotch.app/privacy.
Future monetisation
YOTCH does not currently process payments or collect financial data within the App. If subscription or payment features are introduced in future, this policy will be updated to reflect the additional data processing involved, and users will be notified before any such changes take effect.
Contact us
For privacy queries, subject access requests, or complaints: