Privacy Policy

1. Who this covers

This policy covers guests who book trips through bowline.fish, our booking widgets, or partner sites that use our API, and operators (captains and charter businesses) who use our dashboard. When you book a trip, the operator also receives your booking details and uses them under its own privacy practices. For operator data about their guests, Bowline acts on the operator's behalf to run their bookings.

2. What we collect

From guests

• Booking details: name, email, phone number, trip, date, party size, guest names on the manifest, notes you give the captain, and gift card or discount codes used.
• Payment details: handled by Stripe. We receive the card brand, last four digits, payment status and amounts, but never your full card number or security code.
• Waiver signatures: if the operator requires a waiver, the signed name, email, whether the signer is a minor and the guardian's name, the waiver text you signed, and the time, IP address and browser of the signing, kept as a record of the agreement.
• Messages: emails and text messages we send about your booking, and replies you send to support.

From operators

• Account details (name, email, password stored as a secure hash by our authentication provider), business name and contact details, vessels, trips, schedules, pricing and policies.
• Stripe onboarding happens on Stripe's own pages. We receive your Stripe account ID and status (for example whether charges and payouts are enabled), not your bank account or tax ID numbers.

Automatically

• Basic technical data our hosting provider logs for every request (IP address, browser, pages requested, time) for security and to fix problems.
• Cookies that keep you signed in, and one that remembers for 30 days which captain's tracking link you arrived from (for example a link they posted on Facebook), so that captain can see which of their links bring bookings. We do not use advertising or analytics cookies, and we do not track you across other sites.

3. How we use it

• To make, change, cancel and refund bookings, and run the manifest and check-in.
• To process payments, deposits, balances, tips and refunds through Stripe.
• To send booking messages: confirmations, reminders, dock and arrival details, waiver requests, weather cancellations and receipts.
• To recognize a returning guest so the operator pays no Bowline fee on repeat bookings.
• If you tick "send me news and offers" at checkout, to record that consent so the captain you booked with may email you. Leaving it unticked means you only get messages about your booking.
• To provide support, prevent fraud and abuse, and keep the service secure.
• To meet legal, tax, accounting and payment-network obligations.

Bowline does not use your information for advertising and we do not sell or rent it. Where laws such as the GDPR apply, our legal bases are performing the contract you asked for, our legitimate interest in running a secure service, legal obligations, and your consent where we ask for it.

4. Who we share it with

• The operator you book with, who needs your details to run the trip.
• Partner sites you booked through (such as Unreel Charters or a First Mate charter site), which receive the booking status for the booking they sent.
• Service providers who process data for us under contract: Stripe (payments), Supabase (database and sign-in), Vercel (hosting), Resend (email), Twilio (text messages) and Fastmail (support email).
• Legal and safety disclosures when required by law or to protect people, property or the service, and to a successor if Bowline is sold or merged, under this policy.

5. Text messages

If you give a mobile number, we may text you about your booking only (confirmations, reminders, weather changes). Message and data rates may apply. Reply STOP to opt out or HELP for help. We do not send marketing texts, and mobile numbers and SMS consent are never shared with third parties for their marketing.

6. How long we keep it

We keep booking, payment and waiver records for as long as the operator's account is active and for up to 7 years after the trip, because of tax, accounting, payment-dispute and liability-waiver requirements. Account data is deleted or anonymized after an account is closed, except where we must keep it for those reasons.

7. Security

Data is encrypted in transit, stored with access controls that limit each operator to its own records, and card data never touches our servers. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

8. Your choices and rights

You can ask to see, correct, export or delete your personal information by emailing support@bowline.fish. Depending on where you live (for example California, Virginia, Colorado or the EU/UK), you may have further rights, including to know what we collect, to opt out of sale or targeted advertising (we do neither), and to appeal a decision on your request. We will not treat you differently for using these rights. If your request is about a booking, we may pass it to the operator, who controls that record. We will verify your identity before acting and reply within the time the law allows.

9. Children

Bookings must be made by adults. Minors may appear on a trip manifest or waiver only as entered by their parent or guardian. We do not knowingly collect information directly from children under 13; if you believe we have, contact us and we will delete it.

10. Where data is stored

Bowline is operated from the United States and data is stored and processed in the United States. If you use Bowline from outside the U.S., your information is transferred there.

11. Changes

We will post updates here with a new date, and email operators about material changes before they take effect.

12. Contact

Privacy questions or requests: support@bowline.fish. See also our Terms of Service and Accessibility Statement.