Privacy Policy
This policy explains what personal data YotStock collects, how we use it, who we share it with, and your rights under UK data protection law.
On this page
1Who we are
YotStock ("YotStock", "we", "us", "our") provides an AI-assisted procurement service for superyachts, operating under the trading name "YotStock". For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, YotStock is the data controller for personal data processed through the Service. You can reach us at hello@yotstock.com.
This policy covers our website at yotstock.com and the platform at app.yotstock.com (together, the "Service").
2Data we collect
2.1 Account data — the name, email address, role and vessel of crew we set up, and a securely hashed access code. We do not store access codes in plain text.
2.2 Data you create in the Service — procurement requests, specifications, RFQs, quotes, purchase orders, approvals, supplier details you provide, photographs of parts or documents you upload, invoices/receipts you log, and free-text notes.
2.3 Communications — the RFQ and message drafts prepared in the Service, supplier replies you record against a request, and any correspondence you have with us (e.g. support emails to hello@yotstock.com).
2.4 Technical & usage data — IP address, browser and device type, pages viewed, actions taken and timestamps, and an approximate location derived from IP address, used to run and secure the Service.
2.5 Website analytics — aggregated usage of our website, collected only with your consent (see section 9).
We do not currently take payments through the Service, so we do not collect card or bank details.
3How we use it & our lawful bases
Under UK GDPR Article 6 we rely on the following bases:
- Performance of a contract — to set up and run accounts, deliver the Service, draft RFQs, compare quotes, record approvals and maintain the vessel's memory.
- Legitimate interests — to keep the Service secure, prevent misuse, and improve the product (balanced against your rights).
- Legal obligation — to keep records we are required by law to keep and to respond to lawful requests.
- Consent — for optional analytics cookies and any marketing, which you can withdraw at any time.
4Who we share it with
We share personal data only with service providers ("processors") acting under contract, and only as needed to run the Service. We do not sell your data and we do not share it for third-party advertising.
Our processors fall into these categories: application and database hosting (Railway), website hosting (Netlify), AI processing to interpret requests and draft RFQs (Anthropic), website analytics provided only with your consent (Google Analytics), and our own business email (Google Workspace). Some of these providers are based outside the UK — see section 6 on international transfers. If we add a new processor (for example email delivery or, in future, payments), we will update this policy.
5Artificial intelligence
The Service sends the text and specifications of your requests to our AI provider (Anthropic) to interpret them, draft RFQs and rank quotes. This data is sent on a per-request basis and is not used to train the AI provider's models. We do not send your uploaded emails or entire mailbox to AI providers. AI outputs may be inaccurate — you are responsible for reviewing them before relying on them.
6International transfers
Some of our providers are outside the UK/EEA, mainly in the United States. Where we transfer personal data abroad, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, together with appropriate safeguards.
7How long we keep it
- Account data — for as long as your access is active, and up to 12 months after it ends for legal and dispute-resolution reasons.
- Procurement records (requests, quotes, orders, invoices) — retained while relevant to the vessel and to meet record-keeping expectations; you can request export or deletion (subject to any legal retention).
- Technical logs — typically up to 24 months.
- Backups — held on a rolling basis and overwritten in the ordinary course.
8Your rights
Under UK GDPR you have the right to: access your data; have inaccurate data corrected; request erasure; restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise any of these, email hello@yotstock.com and we will respond within one month.
9Cookies & analytics
The platform uses strictly necessary cookies for sign-in, sessions and security. On our website we use analytics only with your consent, requested via the cookie banner; you can decline without losing access. We do not use third-party advertising cookies.
10Security
We protect personal data with measures including encryption in transit (TLS), hashed access codes, access controls and least-privilege access for our team. No system is perfectly secure, but we review and improve our controls. If a breach affects your rights, we will notify you and the ICO as the law requires.
11Children
The Service is for professional crew aged 18 or over. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
12Changes
We may update this policy. The "Last updated" date will change and, for material changes, we will notify you by email or an in-product notice.
13Contact & complaints
For any privacy question or request, contact hello@yotstock.com. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.