Last updated : 2026-10-05
1. Introduction
This Privacy Policy (the "Policy") describes how MOQA STUDIO, acting as data controller, collects, uses and protects the personal data of users of the website https://boatmap.app and the BoatMap application (the "Service").
We process your data in accordance with Regulation (EU) 2016/679 (the "GDPR") and the French Data Protection Act of 6 January 1978 as amended.
2. Data Controller
The data controller is MOQA STUDIO, Société par Actions Simplifiée (SAS) with a share capital of 1 000 €, registered office at 10 rue Émile Duclaux, 75015 Paris, France, registered under RCS Paris 984 885 350.
Privacy contact: hello[at]boatmap.app
3. Data We Collect
3.1 Data you provide
- Account: email address, password (stored in encrypted form), first name, last name or pseudonym, profile picture;
- Profile: navigation preferences, units, information about your boats (name, type, length, flag, etc.), biography;
- User content: reviews, photos, lists, GPS tracks, markers, routes, comments;
- Messages: when you contact us (via the contact form or by email);
- Payment: if you subscribe to Explorer on the website, the data required to process the payment is collected and processed directly by RevenueCat and its payment provider Stripe; in the mobile app, by Apple or Google. We never see or store your card number or CVV.
3.2 Data collected automatically
- Location data: your GPS position, only when you enable a feature that requires it (trip recording, map centred on you, nearby search). When you start a trip recording, the app continues to collect your location in the background, including when it is closed or not in use, in order to record your complete track; this collection stops as soon as you end the trip. GPS tracks are only saved when you voluntarily start a trip recording;
- Technical data: IP address, device identifier, model, operating system, language, time zone, application version;
- Usage data: pages visited, features used, connection dates and duration, (anonymised) error reports;
- Cookies: see the "Cookies and Trackers" section below.
4. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Creation and management of your account | Performance of the contract (art. 6.1.b GDPR) |
| Provision of features (maps, trip recording, weather, sharing) | Performance of the contract |
| Payment and billing | Performance of contract / Legal accounting obligations |
| User support | Performance of contract / Legitimate interest |
| Improvement and security of the Service | Legitimate interest (art. 6.1.f GDPR) |
| Analytics and audience measurement | Legitimate interest (art. 6.1.f GDPR) for the website's cookieless analytics; consent (art. 6.1.a GDPR) for advertising measurement in the mobile app |
| Marketing communications | Consent |
| Compliance with legal obligations | Legal obligation (art. 6.1.c GDPR) |
5. Recipients and Sub-processors
Your data is intended for authorised internal staff of MOQA STUDIO. It may be shared with the following categories of providers, acting as sub-processors:
- hosting and database provider (European Union);
- map tiles provider;
- RevenueCat, which manages subscriptions and, with Stripe, payments made on the website;
- transactional email delivery provider;
- PostHog, for product analytics, hosted in the European Union; on the website it works without cookies;
- Sentry, for crash and error reports;
In the mobile app, we also use the Meta (Facebook) SDK to measure our advertising campaigns: it reports app installs and some in-app events (sign-up, viewing the plans), and RevenueCat reports purchases to Meta. On iOS, your device's advertising identifier is shared only if you allow tracking when the app asks. Meta acts as an independent controller for its own processing.
A named list of our sub-processors is available on request at hello[at]boatmap.app. Your data may also be communicated to competent authorities where required by law.
6. Transfers Outside the European Union
Most of our sub-processors store data within the European Economic Area. Where a transfer outside the EEA is necessary, it is governed by the Standard Contractual Clauses approved by the European Commission or by any other safeguard provided for in Article 46 of the GDPR.
Some of our sub-processors are established in the United States (RevenueCat, Stripe, Sentry, Meta). Transfers to them rely on their certification under the EU-U.S. Data Privacy Framework where they hold one, and on the European Commission's standard contractual clauses otherwise.
7. Retention Periods
- Active account: your data is kept as long as your account is active;
- Deletion of the account: personal data is deleted within 30 days; GPS tracks and content you have shared may be retained in anonymised form for statistical purposes;
- Invoices and payment records: 10 years (accounting obligation);
- Technical logs: up to 12 months;
- Support requests: 3 years from the last exchange.
8. Security
We implement appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), encryption at rest, password hashing, access controls, code reviews, access logs and regular backups.
In the event of a personal data breach likely to result in a high risk for your rights, we will notify you without undue delay in accordance with Article 34 of the GDPR.
9. Your Rights
Under the GDPR, you have the following rights:
- Right of access to your data;
- Right of rectification of inaccurate data;
- Right to erasure (right to be forgotten);
- Right to restriction of processing;
- Right to data portability, including export of your GPS tracks;
- Right to object to processing based on legitimate interest;
- Right to withdraw consent at any time;
- Right to give directives regarding the fate of your data after your death.
To exercise these rights, write to us at hello[at]boatmap.app, attaching an identity document if necessary. We undertake to respond within one month.
You also have the right to lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.
10. Your Rights in the United States
If you live in the United States, including in a state with a consumer privacy law such as California, this section applies to you in addition to the rest of this Policy.
Categories of personal information we collect: identifiers (email address, account and device identifiers, IP address), commercial information (your plan and purchase history), internet and app activity (features used, crash reports), approximate and, when you enable it, precise location, and the content you add to the Service. Section 3 lists them in detail and section 4 explains why we use them.
No sale of personal information. We do not sell your personal information for money.
Sharing for advertising measurement. In the mobile app, the Meta SDK and RevenueCat send Meta information about app installs, sign-ups and purchases so that we can measure our advertising campaigns. Under some state laws this may count as "sharing" or "targeted advertising". You can opt out at any time: on iOS, decline or turn off "Allow Apps to Request to Track" in your device settings; on Android, delete or reset your advertising ID in your device settings; or write to us at hello[at]boatmap.app and we will stop it for your account.
Your rights. You may ask us to tell you which personal information we have collected about you and how we use it (right to know), to delete it, and to correct it if it is inaccurate. We will not discriminate against you for exercising these rights: you keep the same Service and the same prices.
How to exercise them. Write to us at hello[at]boatmap.app. We may ask you for information to verify your identity before acting on your request, and we will answer within the time limits set by the law that applies to you. You may use an authorised agent, who will need your written permission.
11. Cookies and Trackers
A cookie is a small text file stored on your device when you use the Service. The website does not use advertising cookies.
- Strictly necessary cookies: essential for the Service to function (authentication, language preference, security). These cannot be disabled.
- Preferences: your display preferences (theme, units, region) are stored on your device.
- Analytics without cookies: we measure how the website is used with PostHog in a mode that stores no cookie and nothing else on your device, and does not record your sessions.
- Third-party services: map tiles are loaded from our map provider, which receives your IP address to deliver them.
You can delete or block cookies at any time through your browser settings; blocking strictly necessary cookies will prevent you from signing in. In the mobile app, the tracking described in section 5 is controlled through your device settings.
12. Minors
The Service is not intended for children under 16. We do not knowingly collect data from a minor under 16 without the consent of a parent or guardian.
13. Changes
This Policy may be updated at any time. In the event of a material change, we will inform you by email or through the Service.
14. Contact
For any question relating to your personal data, please contact us at hello[at]boatmap.app or by post at MOQA STUDIO, 10 rue Émile Duclaux, 75015 Paris, France.