Privacy policy
Last updated: 2026-10-24
This website (shipdocs.app) is an informational portal. Below is how we handle your data.
What data do we collect?
This website itself collects no personal data. No third-party tracking cookies or analytics are used.
If you contact us by email or phone, we use that information solely to answer your question.
Business emails from ShipDocs (outreach)
Our website itself collects no personal data. We do occasionally send a business email to companies in inland shipping and the ports, to bring ShipDocs and our apps to their attention. Below you can read what we use for this and what rights you have.
Who is responsible?
ShipDocs, Middelweg 211, 1911 EE Uitgeest, the Netherlands, Chamber of Commerce (KvK) 95207341. You can email questions to info@shipdocs.app.
What data do we use?
Your name, your business email address and the name of your company. Nothing more.
Where does it come from?
From public sources, such as your company's website. In our first email we tell you where we found your address.
What do we use it for?
To email you once or occasionally about ShipDocs software that suits your company.
On what basis?
On our legitimate interest in promoting our business commercially (GDPR Art. 6(1)(f)). We only email business addresses and comply with the rules on unsolicited email in the Dutch Telecommunications Act (art. 11.7).
How long do we keep it?
If you don't respond, we delete your data no later than 12 months after our last email. If you unsubscribe, we keep only your email address on an unsubscribe list. That way we can be sure we won't email you again.
Unsubscribing and objecting
To unsubscribe, simply reply to the email with "unsubscribe" (or "afmelden"), or send an email to info@shipdocs.app. This costs you nothing. You can always object to the use of your data for these emails. We will then stop immediately (GDPR Art. 21(2)–(3)).
Do we share your data?
No. We don't sell it and don't give it to others for their own purposes.
Your rights
You may access, correct or delete your data, and you may ask us to restrict its use (GDPR Art. 15–18). Email us and we will handle it within one month. If you are not satisfied with how we handle it, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
The applications
The individual applications (BargeFlow, Barge Port Reporter, Reisplanner, Bemanningssterkte and MARAD Weeklijsten) have their own data processing and terms. MARAD Weeklijsten, for example, deliberately stores no personal data.
Reisplanner (www.reisplanner.app)
Reisplanner is a ShipDocs product. When you use www.reisplanner.app, ShipDocs is responsible for your personal data (controller within the meaning of the GDPR).
Who is responsible?
ShipDocs, Middelweg 211, 1911 EE Uitgeest, the Netherlands
Chamber of Commerce (KvK) 95207341 · VAT NL005138041B29
Email: info@shipdocs.app · phone +31 20 369 5765
ShipDocs has no data protection officer; we are not required to have one (Art. 37 GDPR). Please send privacy questions to info@shipdocs.app.
What data do we use, for what purpose, on what legal basis and for how long?
| Data | Purpose | Legal basis (Art. 6(1) GDPR) | Retention |
|---|---|---|---|
| Planning without an account: departure, destination, waypoints, vessel details (dimensions, draught, speed) and departure date that you enter | Calculating the route and showing water levels, tides and weather | (f): our legitimate interest in offering a working free planner that you use yourself | We do not store this. Your guest trips (up to 3) and settings are kept only in your own browser (localStorage) until you clear them |
| Account: email address, password (stored only in encrypted/hashed form), display name, sign-up date, last active, sign-in and security records (including time and IP address of sign-in) | Creating your account, signing in, securing it and preventing abuse | (b): performance of the contract | Until you have your account deleted, plus up to 30 days in encrypted backups. An account without an active subscription that has not been used for 24 months is deleted after a warning by email at least 30 days in advance |
| Saved trips, vessel and preferences: trip name and description, start and end point, route, status, vessel profile and route preferences | Keeping your trips, opening them on any device, printing voyage plans and (Pro) exporting them as RTZ | (b) | As long as your account exists or until you delete them yourself, plus up to 30 days in backups |
| Connections with programs and AI assistants (API tokens): the name you give the token, an irreversible code (hash) of the token, creation, last-used and revocation dates, and short-lived pairing codes | Letting a program you authorise plan on your behalf | (b) | Tokens until you revoke them or delete your account; revoked tokens remain visible in your overview until your account is deleted. Pairing codes expire after 15 minutes |
| Subscription (Pro) and invoices: status, trial period and end date, Mollie customer, mandate and subscription IDs, payment amounts and dates; your billing address (first and last name, street and house number, postcode, city, country and the email address the invoice is sent to (your account's email address at the time you take out Pro); if you sign up as a business, also company name and VAT number or company registration number) and, for each paid month, the invoice (invoice number, amount and VAT). Your bank or card details are seen and stored by Mollie, not by us | Taking out Pro, collecting the monthly charge, reminding you before the trial ends, creating an invoice for each paid month and emailing it to you, and our VAT accounts | (b) (performance of the contract); for invoices to business customers and for bookkeeping (c) (legal obligation: Arts. 34c, 34g and 35a Dutch VAT Act 1968; retention obligation Art. 52(4) Dutch General Tax Act, AWR) | Subscription data until 30 days after the subscription ends. Your stored billing address until your account is deleted. Invoices (with the billing address as shown on the invoice) and other data that belongs in our accounts: 7 years (Art. 52(4) AWR), even if your account is deleted earlier |
| Trial used: a code we calculate from your email address with a secret key (not the address itself) and the date you started the trial | Preventing the one-time trial (Article 5.1 of the terms) from being used more than once | (f) our legitimate interest in preventing misuse of the trial; you may object to this (Art. 21 GDPR) | 24 months after the start of the trial, even if your account is deleted earlier |
| Check of your VAT number (VIES), only if you sign up as a business from another EU country: your VAT number and country code, and what VIES returns: whether the number is valid, the date of the check, the consultation number and, if your tax authority provides them, the name and address linked to the number | Determining whether we may reverse charge VAT (Article 6.1 of the terms) and being able to prove this to the Dutch Tax Administration later | (c) legal obligation (Arts. 6(1), 35a(1)(d) and (m) and 37a Dutch VAT Act 1968; retention obligation Art. 52(4) Dutch General Tax Act, AWR) | 7 years, with the invoice records (Art. 52(4) AWR), even if your account is deleted earlier |
| Country of your payment method: only the country code Mollie provides with your payment (the country of your bank account or card; for PayPal we determine no bank or card country in this processing), not your account or card number | Checking that you reside or are established in the European Union (Article 6.1a of the terms) and being able to show the Dutch Tax Administration in which country we charged VAT | (c) legal obligation (Art. 6h Dutch VAT Act 1968; Arts. 24b and 24f Implementing Regulation (EU) No 282/2011; retention obligation Art. 52(4) Dutch General Tax Act, AWR) and (b) (performance of the contract) | 7 years, with the invoice records (Art. 52(4) AWR), even if your account is deleted earlier |
| Withdrawal: your statement (name, email address, contract, date and time, text of the statement), our acknowledgement of receipt and the refund | Carrying out your withdrawal, refunding you and accounting for it in our records | (c): legal obligation (Art. 6:230oa and 6:230r Dutch Civil Code; tax record-keeping obligation, Art. 52(1) and (4) Dutch General Tax Act) | 7 years after the refund, even if your account is deleted earlier |
| Cancellation: your cancellation, date and time, and our confirmation | Carrying out your cancellation and being able to show that we did | (b) and (f) (evidence) | 2 years after the subscription ends |
| Feedback: your message, the page and language from which you sent it and, if you provide it, your email address | Answering your question and improving Reisplanner | (f): answering questions and improving the product | 12 months after it has been dealt with |
| Technical data: IP address, browser, time, requested page | Delivering the site, fixing faults, preventing attacks and abuse (including a limit on the number of requests per minute) | (f): a secure, working site | The request limit keeps your IP address only briefly in working memory. Our database logs are kept for at most 1 day. Cloudflare keeps network and security data under its own policy |
| Security check (Cloudflare Turnstile and bot protection) at sign-up, sign-in, the feedback form and on the network: technical characteristics of your browser and connection (including IP address, browser, TLS characteristics) | Stopping bots and abuse | (f): securing accounts and forms | We only keep whether the check succeeded. See also "Cookies" |
| Visitor statistics (Cloudflare Web Analytics): page visited, referring site, country, browser and load times | Measuring how the site is used and how fast it is | (f): improving the site | We only see aggregated figures. No cookies are set for this |
We do not sell your data, do not use it for advertising and do not build profiles. There is no automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
You are not obliged to provide data. Without an email address you cannot create an account, and without payment you cannot take out Pro. Planning routes works without an account; with a free account you can save trips and print voyage plans without a watermark.
Who receives your data?
Processors. These parties process data only on our instructions.
| Party | Purpose | Location | Transfer outside the EEA and safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, accounts and sign-in. Supabase sends the emails for your account through our own mail server (see Hetzner) | Storage in the EU: Frankfurt (AWS eu-central-1) | Access from outside the EEA (administration, support, sub-processors) based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Cloudflare, Inc. (USA) | Hosting of the website and server functions (Cloudflare Pages), network, security, Turnstile and Web Analytics | Global network; processing as close to you as possible | USA: EU-US Data Privacy Framework (Art. 45 GDPR); in addition, EU Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend, USA) | Sending all transactional Reisplanner emails: Pro confirmation, the reminder before the trial ends, confirmation of withdrawal, cancellation and account deletion, and the feedback form (sender info@shipdocs.app or feedback@shipdocs.app) | Sending from the EU (Ireland, eu-west-1); account and log data in the USA | USA: EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Mollie B.V. (Amsterdam), Mollie Invoicing | Creating, numbering, storing and emailing invoices to you. For this Mollie receives your billing address (name or company name, address, country, email address and, if you sign up as a business, VAT number or company registration number), the amount, the VAT, the invoice language, the payment the invoice relates to and our account ID for you (as an identifier and in the metadata), so that payment, invoice and account stay linked. For invoices Mollie is our processor (Mollie Invoicing terms including data processing agreement) | EU (Mollie and its sub-processors for invoices: Storecove, Google Cloud Platform and Mollie Business B.V., all in the EU) | No |
| Hetzner Online GmbH (Germany) | Hosting our own mail server (mail.shipdocs.app). We use it to receive your emails to info@shipdocs.app. In addition, Supabase sends the emails for your account (email address confirmation, sign-in links, password reset) through this server | Nuremberg, Germany | No |
| GitHub, Inc. (USA) | Nightly database backup. The backup is created in a temporary GitHub environment and encrypted after creation and packaging (AES-256). Only the encrypted file is kept, for 30 days, and is then deleted automatically | USA/worldwide | Transfer to the USA on the basis of the EU-U.S. Data Privacy Framework and/or standard contractual clauses |
Independent controllers. These parties receive data and decide for themselves what they do with it; their own privacy policy applies.
| Party | Purpose | What they receive | Location |
|---|---|---|---|
| Mollie B.V. (Amsterdam) | Payment with the payment method you choose at Mollie (for example iDEAL or a credit card), your authorisation for the monthly charge (a SEPA mandate for iDEAL, a card authorisation for a card, for another method the authorisation you give there) and the monthly charge. Mollie is a supervised payment institution and is itself responsible for the payment (Mollie privacy statement). Your own bank, card issuer or other payment service also processes your data in doing so, under its own responsibility. For invoices Mollie acts as our processor (see Processors) | Your email address, the amount and the description, our account ID for you (in the metadata and shortened in the subscription description, to link payment and account), the language and the time at which you accepted the terms and requested the immediate start (as evidence with the mandate), and the country code of your billing address (in the metadata, to compare it with the country of your payment method), the VAT treatment and a reference to our VAT check (not your VAT number itself); you give your bank or card details directly to Mollie | EU |
| Cloudflare, Inc. | Turnstile: Cloudflare also uses the security signals itself to improve bot detection (Turnstile Privacy Addendum) | Technical characteristics of browser and connection | Worldwide; USA based on the Data Privacy Framework |
| OpenStreetMap Foundation (United Kingdom) | The map: your browser fetches map tiles from tile.openstreetmap.org | Your IP address and the map area you view | UK (adequacy decision of the European Commission) |
If you sign up as a business from another EU country, we send your VAT number and country code, together with our own VAT number, to VIES, the European Commission's system (DG Taxation and Customs Union) through which your country's tax authority confirms the number. The Commission and that tax authority process this for their own statutory tasks, within the EU. See the VIES website.
We fetch water levels, tides, discharge, bridges, locks and notices to skippers through our own server from Rijkswaterstaat, EuRIS and vaarweginformatie.nl. We fetch the weather forecast along your route through our own server from MET Norway (Norwegian Meteorological Institute, Oslo, Norway). We only send locations, routes and coordinates, not your IP address or your account. Norway is part of the EEA; there is no transfer to a country outside the EEA.
MarinePlan (Netherlands): route calculation. Through our own server we only send: the start and end point and the waypoints of your route; the type, dimensions (length, beam, draught and height above the water), speed, weight and fuel consumption of your vessel; your route preferences and the departure time; when you search for a location, the search term and a map position; to place a point on the nearest waterway or look up the name of a place, a map position; and your browser's language setting. Your IP address and account details are not shared.
Otherwise we only give data to others where the law requires us to, for example to the Dutch Tax Administration.
Cookies and local storage
Reisplanner sets no tracking or advertising cookies and we use no cookie banner, because everything below is strictly necessary or has little or no impact on your privacy (Art. 11.7a(3)(a) and (b) Dutch Telecommunications Act).
- In your browser (localStorage/sessionStorage): your sign-in session, language, light/dark theme, whether you have already seen the introduction and an announcement, your guest trips, the number of free prints without an account, and temporarily a voyage plan you are drafting. This stays on your device. When you sign out, we clear route and vessel data from your browser.
- Cloudflare security: Cloudflare may set the strictly necessary cookies
__cf_bm(bot protection, expires after 30 minutes of inactivity) andcf_clearance(proof that you passed a security check). Turnstile reads technical characteristics of your browser to recognise bots. See Cloudflare Cookies. - Statistics: Cloudflare Web Analytics works without cookies or local storage and does not track you across websites. If you do not want to be counted, use a content blocker; you can also object via info@shipdocs.app.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interest (Art. 21).
You delete saved trips yourself in the app. If you want your account deleted or a copy of your data (for example as a JSON file), email info@shipdocs.app from your account's email address. That copy also includes your withdrawal statements, your billing address and a list of your invoices. If your billing address is no longer correct, email the correct address to info@shipdocs.app (Art. 16 GDPR). You can also delete your account yourself, in your profile under Account. If you delete your account, we also delete you as a customer at Mollie, which cancels your mandate and subscription. Mollie itself keeps your payments under its own legal obligations (see Mollie's privacy statement). We keep your invoices for 7 years in our own accounting records (legal retention obligation); Mollie also keeps them itself, including after your account is deleted.
We respond within one month (Art. 12(3) GDPR). If your request is complex or we receive many requests, this can be extended by two months; we will tell you so within the first month.
If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU country where you live or work.
Security
We protect your data with appropriate measures (Art. 32 GDPR), including encrypted connections (HTTPS), per-user isolation in the database (row-level security), passwords stored only as hashes, encrypted backups, a request limit and a security check against bots.
Changes
If we change anything important in this block, we update the date below. For major changes we email account holders in advance.
This English text is a translation. If it differs from the Dutch version, the Dutch version prevails.
Last updated: 24 October 2026
Your rights
You have the right to access, correct and delete any data we process about you. To exercise these rights, contact info@shipdocs.app.