PORTVOLUTION VMPC

Privacy Policy & GDPR Compliance Notice

Effective Date: August 11, 2026
Version: 2026.08.11_v1.1
Contact: support@portvolution.com

TECHNICAL PRIVACY & ARCHITECTURE SUMMARY (PLAIN ENGLISH GUARANTEE)

Portvolution VMPC is engineered from the ground up with an Offline-First, Zero-Ad-Tracking Clean Architecture. Unlike conventional mobile applications, we do not embed third-party marketing trackers, crash profiling analytics (such as Firebase or Facebook SDK), or data-broker monitoring tools. Your professional maritime logs, sea service records, and contract analyses are stored locally on your device and synchronized securely with encrypted cloud storage only when you log in.

1. DATA CONTROLLERS & CONTACT INFORMATION

This Privacy Policy explains how the developers of Portvolution VMPC ("Data Controllers", "we", "us", or "our") collect, use, store, and protect your personal data when you use the Portvolution VMPC multiplatform application on iOS, Android, macOS, Windows, Linux, or Web.

We are committed to strict compliance with the European Union General Data Protection Regulation (EU GDPR) (EU) 2016/679, the United Kingdom General Data Protection Regulation (UK GDPR) tailored by the Data Protection Act 2018, and applicable international data privacy laws. If you are a resident of the European Economic Area (EEA) or the UK, this policy is specifically structured to meet your respective statutory data protection rights.

Age Eligibility: Portvolution VMPC is intended solely for individuals 18 years of age or older and is not directed at minors. We do not knowingly collect personal data from anyone under 18. If we become aware that an account belongs to a minor, we will delete the associated account and personal data. Because access is restricted to adults, this policy does not rely on the special conditions for children's consent under GDPR Article 8.

The application is operated independently by its co-founding developers. For all legal inquiries, GDPR subject access requests, data rectification, or account deletion requests, please contact our dedicated support channel:

Email: support@portvolution.com
Response Timeframe: Within 30 calendar days as mandated by GDPR Article 12.

2. CATEGORIES OF PERSONAL DATA PROCESSED

To provide our specialized maritime logistics and career tracking services, we process only the data strictly required for technical operation and professional functionality:

Identity & Account Data: Email address, authentication credentials, and user profile metadata managed securely via Supabase Authentication. If you sign in with Google, the identity data Google shares at authentication (email address, basic profile information) is processed under this same category.
Full Name (optional): If you choose to enter your full name in Settings, it is stored on our servers but used exclusively to personalize the PDF career reports you generate within the app. It is never shown to other users or shared with any third party.
Professional Maritime Records (private): Seafarer career statistics, active voyage logs, rank/title, port call histories, contract parameters, sea time calculations, and cargo details inputted directly by the user. This data is visible only to you and is never shared with other users.
Community-Generated Content (public): Port reviews and ratings ("insights"), port chat messages, and the nickname you choose to display alongside them. This content is visible to other users of the app. It also includes a "port familiarity" indicator (e.g. "In port," "Been here," "Never here") shown next to your nickname in Port Chat, calculated automatically from your own port call history — never from live GPS location or presence.
Geolocation Data: GPS coordinates (latitude/longitude) obtained from your device to identify nearby maritime terminals, calculate port proximity, and cluster port call visits on interactive maps. This is unrelated to, and never used to power, the community features described above.
Technical & App State Metadata: Local application logs, device platform identifiers, and encrypted session tokens required for maintaining offline-first persistence.

A note on identity protection: nowhere in Portvolution VMPC — including in Port Chat — is your real identity disclosed to other users. What other users see is strictly the nickname you have chosen (or a system-generated placeholder), which carries no inherent link to your real name or identity. Your email address is visible only to you and to the developer/administrator of the service, never to other users.

3. LEGAL BASIS FOR PROCESSING (GDPR ARTICLE 6)

Processing Activity	Category of Data	GDPR Legal Basis
Account Creation & Cloud Sync	Email, Encrypted Password / JWT Token	Art. 6(1)(b) Contract Performance: Necessary to provide core app functionality and multi-device syncing.
Voyage & Career Tracking	Contract terms, port calls, sea time logs	Art. 6(1)(b) Contract Performance: Core feature execution requested by the user.
Terminal Proximity & Maps	Device Geolocation (GPS)	Art. 6(1)(a) Consent: Explicit OS-level permission granted via iOS/Android prompts.
Biometric App Unlock	Local Biometric Verification Boolean	Art. 6(1)(f) Legitimate Interest: Ensuring local device data security without transmitting biometric signatures.

4. DATA STORAGE & SECURITY ARCHITECTURE

Portvolution VMPC implements a rigorous dual-layer data storage model to maximize security and minimize data exposure:

Local Storage (Offline-First): Your voyage data is persisted locally in an encrypted SQLite database (sqflite) and local key-value storage (shared_preferences_foundation). High-security credentials, such as authentication JWT tokens from Supabase, are stored exclusively in the device's hardware-backed keychain (iOS Keychain / Android Keystore via flutter_secure_storage).
Cloud Synchronization: Data is transmitted over industry-standard TLS/HTTPS encryption to our secure backend infrastructure powered by Supabase.

CRITICAL BIOMETRIC AUTHENTICATION NOTICE

Portvolution VMPC utilizes biometric authentication (FaceID on iOS via NSFaceIDUsageDescription and Fingerprint/Biometrics on Android via USE_BIOMETRIC) solely to restrict unauthorized physical access to the app on your device. We do not collect, read, store, or transmit your facial recognition or fingerprint data. All biometric validation occurs locally within your device's operating system Secure Enclave/TEE, which simply returns a success or failure boolean to the app.

5. THIRD-PARTY PROCESSORS & SUB-PROCESSORS

We maintain a "zero unnecessary exposure" policy. We do not sell data, nor do we share data with advertising networks. The following third-party services are integrated into Portvolution VMPC:

Processor Name	Role & Purpose	Data Shared	Location / Compliance
Supabase, Inc.	Cloud Backend, Authentication, Database Hosting	Email, encrypted auth tokens, synced voyage & contract data	AWS / Google Cloud (EU Standard Contractual Clauses & UK International Data Transfer Addendum, fully EU/UK GDPR Compliant)
CARTO / OpenStreetMap	Interactive Map Tile Delivery (`basemaps.cartocdn.com`)	IP address and map viewport tile coordinates during map browsing	CartoDB Inc. (No advertising tracking, strictly visual tile serving)
Mapbox	Satellite header images per port (Static Images API), generated server-side from port coordinates	Public port latitude/longitude only — no personal user data	Mapbox, Inc.
Anthropic (Claude Haiku model)	Automated content moderation of port insights and Port Chat messages	The text content you submit in an insight or chat message	Anthropic, PBC (USA)
DeepL	On-demand translation of port insights, when you tap "Translate"	The text content of the insight being translated	DeepL SE (Germany)
Google (Sign in with Google)	Optional authentication method	Email address and basic profile information, if you choose this login method	Google Ireland Ltd.
Resend	Delivery of transactional emails (account confirmation, password reset, security notifications)	Your email address	Resend, Inc.
Google Gemini	Generates the automated "Botvolution" port guides (overview, logistics, welfare information) shown on port pages	No personal user data — only public port names/UN-LOCODEs, researched offline by the developer, never triggered by or containing any individual user's data	Google Ireland Ltd. — see Section 8 for the AI-generated content notice

6. DATA RETENTION POLICY

Private data (voyage logs, contracts, port calls, cargo, vessel records): retained only for as long as your account is active, and deleted in full when your account is deleted — whether at your own request or due to prolonged inactivity, as described below.

Community content (port insights, ratings, and Port Chat messages): this content remains part of the shared record other seafarers rely on for that port, and is not deleted when you delete your account. What changes is your link to it: your displayed nickname is replaced with a randomly generated, non-identifying placeholder, and your account is permanently disconnected from that content. From that point on, this content is no longer personal data about you.

Account deletion at your request: email support@portvolution.com. We complete the corresponding data deletion / content de-identification described above within 30 days of your request.

Inactive accounts: if your account shows no activity for 18–24 months, we will email you a notice. If there is no response within 30 days, we send a final notice; if there is still no response within a further 7 days, your account is scheduled for deletion. As with a self-requested deletion, the actual data deletion and content de-identification is completed within 30 days of that point.

Security & administrative logs (e.g. IP addresses tied to login/security events, and administrator action logs) are retained separately from your visible account data, for a rolling period of 12 months, after which they are deleted.

7. USER RIGHTS UNDER GDPR (ARTICLES 15–22)

As a data subject, you retain absolute control over your personal information. You may exercise any of the following rights at any time by emailing support@portvolution.com:

Right of Access (Art. 15): Request a complete export of all personal data and voyage logs associated with your account.
Right to Rectification (Art. 16): Modify or correct inaccurate maritime logs, port visits, or contract entries directly within the app or via support.
Right to Erasure / "Right to be Forgotten" (Art. 17): Request permanent deletion of your account and all associated private data, per the Data Retention Policy in Section 6. (Note: Locally cached SQLite data will be wiped upon app uninstallation).
Right to Restriction of Processing (Art. 18): Request that we temporarily limit how we use your data while a dispute about its accuracy or lawfulness is resolved.
Right to Data Portability (Art. 20): Portvolution VMPC natively supports exporting your career statistics and voyage reports into structured local PDF files via our built-in reporting engine.
Right to Object (Art. 21): Object to processing based on our legitimate interests, as described in Section 3.
Right to Withdraw Consent (Art. 7): You may revoke location or biometric permissions at any time through your device's system settings without affecting core offline functionality.
Right to Lodge a Complaint (Art. 77): If you believe your data protection rights have been violated, you have the right to lodge a complaint with your national data protection supervisory authority, in addition to — not instead of — contacting us directly.

8. AI-GENERATED CONTENT

Certain content in Portvolution VMPC — specifically the "Botvolution" port guides (overview, logistics tips, welfare information) — is generated by an AI model (Google Gemini), researched and published by the developer, and is not submitted by users. Generating this content does not involve or process any of your personal data. See Section 4 ("AI-Generated Content Disclaimer") of the Terms & Conditions / EULA for the full disclaimer and its limitations.