BoatPartFinder.ai Logo
BoatPartFinderRIGHT PART, RIGHT NOW

Menu

Privacy Policy

Effective date: 2026-04-15 · Last updated: 2026-08-04

1. Introduction

Welcome to BoatPartFinder.ai ("BoatPartFinder", "we", "us"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data in accordance with the GDPR and the ePrivacy Directive.

For the purposes of the GDPR, we act as the Data Controller for the personal data described in this policy.

1.1 Who We Are (Data Controller)

BoatPartFinder.ai is operated by:

1.2 What We Do

We are an information and referral service. We do not sell products directly, process payments, or ship items. When you click an affiliate or referral link, you are redirected to a third-party retailer's site, which is governed by their own policies and terms.

2. Personal Data We Collect

2.1 Account and Profile Data

  • Required: Email address for authentication and a password hash (we do not store passwords in plain text).
  • Optional: Display name, full name, profile picture URL, bio, and boat ownership details (brand, model, year).

2.2 User-Generated Content and Community

  • Reviews, ratings, fitment/compatibility data, and fit notes.
  • Interactions such as "helpful" votes, wishlists, and chat/community messages.
  • Reports, flags, and feedback submitted by you.

Note: Public contributions (reviews/fitment) remain visible to other users.

2.3 Usage Data

  • Pages visited, products viewed, searches, wishlist activity, and navigation patterns.
  • Account events such as sign-up and login, and whether an event was linked to a signed-in account.
  • Affiliate/referral link clicks, including the product, retailer, timestamp, outcome, and pseudonymous click or page-view identifiers where available.

2.4 Technical and Security Data

  • Identifiers: IP address and user agent string.
  • Device Data: Browser type/version, device type, and operating system.
  • Logs: Server request logs, security audit trails, and error logs.

2.5 Cookies and Consent Records

We use cookies to maintain sessions, remember preferences, and, subject to your consent, activate optional Google Analytics. We store records of your cookie choices to comply with ePrivacy requirements.

Declining optional analytics does not stop limited cookieless operational measurement. Basic page requests, first-party page events, and outbound retailer redirects may still be recorded without setting an optional analytics cookie or reusable analytics browser identifier. This baseline helps us operate the service, detect abuse, verify retailer referrals, and measure aggregate performance.

3. How We Use Your Personal Data

3.1 Service Operation

  • To manage your account and provide community features (reviews, wishlists, chat).
  • To provide search and compatibility filtering.

3.2 Affiliate Referrals and Attribution

Our business model relies on referral links. Price and retailer links use a first-party redirect so that an outbound click attempt and its outcome can be recorded even when optional Google Analytics is unavailable or declined. We generate pseudonymous click identifiers where available to attribute referrals and prevent fraud. We do not share your name or email with affiliate networks during this process.

3.3 Operational Measurement and Reporting

We combine limited website delivery statistics, first-party site events, account events, search activity, and outbound referral records in Google BigQuery. We use Looker Studio to create aggregate operational and business reports from that data.

When you are signed in, some first-party events may be linked to your account so that related activity can be understood together. Anonymous or cookieless activity remains unlinked when no reliable account or consented visitor identifier is available. We do not treat every anonymous visit or session as a unique person.

3.4 Personalization

  • To highlight products based on your boat details or site interactions.
  • To display community reputation or contribution points.

3.5 Marketing Communications

Creating an account, accepting our Terms, or using the site does not by itself give us permission to send marketing email. Where marketing permission is required, we will request and record it separately. You may withdraw that permission at any time.

3.6 Moderation and Security

  • To detect and prevent spam, fraud, and abuse.
  • To maintain security logs and investigate reports of rule violations.

3.7 Corporate Transactions

In the event of a merger, acquisition, or sale of assets, personal data may be transferred as a business asset subject to appropriate safeguards.

4. Legal Bases for Processing (GDPR)

Data Category Purpose Legal Basis
Account Credentials Authentication Contract (Art. 6(1)(b))
Optional Profile Fields Personalization Consent (Art. 6(1)(a))
Security/Audit Logs Abuse Prevention Legitimate Interest (Art. 6(1)(f))
Optional Google Analytics Cross-session audience measurement Consent (Art. 6(1)(a))
Compliance Data Legal Requests Legal Obligation (Art. 6(1)(c))

5. Sharing and Disclosure

We share data only as necessary:

  • Processors: Supabase (Database/Auth - EU region), Vercel/Google Cloud (Hosting, operational measurement, BigQuery data warehouse, and Looker Studio reporting), Google Analytics/Tag Manager (optional analytics - USA with SCCs).
  • Affiliate Networks: Pseudonymous click identifiers only (Amazon Associates, Impact Radius, others).
  • Legal: When required by law or to protect safety and security.

6. International Transfers

Some providers (notably Google) may process data in the United States. Where an adequacy decision does not exist, we rely on Standard Contractual Clauses (SCCs) and supplementary security measures. You may request a copy of these safeguards by contacting us at privacy@boatpartfinder.ai.

7. Data Retention

  • Active Accounts: Retained while the account is active.
  • Deleted Accounts: Personal data is deleted or anonymized within 30 days.
  • Public Contributions: Anonymized (shown as "Deleted User") upon account closure to preserve community database value.
  • Raw Operational and Request Records: Retained for up to 90 days for reliability, fraud investigation, and validation.
  • Normalized Pseudonymous Analytics: Page, search, account-event, and outbound-click records retained for up to 25 months.
  • Aggregate Reports: May be retained longer when they no longer identify or single out a person.
  • Google Analytics: Event-level data follows the configured Google Analytics retention controls. Aggregate Google Analytics reports may remain available beyond that event-level period.

8. Your Rights

Under the GDPR, you have the right to:

  • Access & Portability: Receive your data in a structured, machine-readable format (JSON or CSV).
  • Erasure & Rectification: Delete or correct your data.
  • Object/Restrict: Limit processing based on legitimate interests.
  • Withdraw Consent: Revoke consent for optional analytics or marketing at any time. Withdrawing analytics consent disables Google Analytics and removes its cookies and our reusable analytics session/visitor identifiers from your browser. Limited cookieless operational records may continue as described above.

To exercise these rights, contact privacy@boatpartfinder.ai. We will respond within 30 days.

If unsatisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at https://www.imy.se/ or your local data protection authority if you are in another EU country.

9. Data Security

We implement technical measures including:

  • Encryption in transit: HTTPS/TLS 1.3 for all connections.
  • Password security: Strong one-way hashing using bcrypt (passwords never stored in plain text).
  • Database security: Row-Level Security (RLS) on all database tables.
  • Access controls: Admin functions require authentication and role verification.
  • API security: Rate limiting, CORS policies, and input validation.

In the event of a high-risk data breach affecting your personal data, we will notify you and the Swedish Authority for Privacy Protection (IMY) within 72 hours of discovery, as required by GDPR.

10. Children's Privacy

BoatPartFinder.ai is not intended for children under 13. We do not knowingly collect personal data from children under 13.

EU Users Under 16: If you are under 16 and located in the European Union, you must have permission from a parent or guardian to create an account and use our service.

If we discover that a child under 13 (or under 16 in the EU without parental consent) has created an account, we will delete it promptly. Parents may contact us at privacy@boatpartfinder.ai to request deletion of their child's data.

11. Cookies and Tracking Technologies

11.1 Essential Cookies (Cannot Be Disabled)

Purpose: Authentication, session management, security.
Legal Basis: Strictly necessary for service delivery (GDPR Art. 6(1)(b)).
Examples: sb-access-token, sb-refresh-token, CSRF tokens.

11.2 Cookieless Operational Measurement

Purpose: Service delivery, reliability, security, aggregate page measurement, and recording outbound retailer redirects.
Storage: This baseline does not set an optional analytics cookie or reusable analytics browser identifier.
Identification: Cookieless visits are not treated as known or unique people.

11.3 Analytics Cookies (Can Be Opted Out)

Purpose: Usage tracking, performance measurement.
Legal Basis: Consent (GDPR Art. 6(1)(a)).
Examples: _ga, _gid, _gat (Google Analytics).
Opt-out: Cookie settings or browser settings.

11.4 Affiliate Cookies

Purpose: Track referrals for commission attribution.
Duration: 24 hours to 90 days (varies by affiliate network).
Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)).

For a complete list of cookies and management options, see our Cookie Policy.

12. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, legal requirements, or service features.

How We Notify You:

  • Material changes: We will email all registered users at least 30 days before the changes take effect.
  • Minor changes: We will update the "Last Updated" date at the top of this policy.

Your Acceptance: Continued use of our service after the effective date of updated policy constitutes acceptance. If you do not agree to the updated policy, you should stop using the service and delete your account.

13. Governing Law

This policy is governed by Swedish law and the General Data Protection Regulation (GDPR). Any disputes will be resolved in Swedish courts.

EU Consumers: If you are a consumer habitually resident in the European Union, you retain the right to bring proceedings in the courts of your country of residence. EU consumers may also use the European Commission's Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr.

Swedish Consumers: Consumers in Sweden may also refer disputes to the National Board for Consumer Disputes (Allmänna reklamationsnämnden, ARN) where applicable.

14. Contact Us

Privacy inquiries: privacy@boatpartfinder.ai

General inquiries: info@boatpartfinder.ai

Support: support@boatpartfinder.ai

Postal address: Oish AB c/o Finnström, Dianavägen 31, 115 42 Stockholm, Sweden

Response Time:

  • Rights requests (access, deletion, etc.): Within 30 days
  • General privacy inquiries: Within 7 business days

Related Policies: