Privacy Policy

1 Who We Are

CanalClear ("we," "us," "our") provides maritime compliance software for validating customer-entered filing data and generating submission-ready documents and packages. Current public capability status is listed at /authorities. Our platform is available at canalclear.org.

Depending on the relationship and processing activity, CanalClear may act as a controller for data collected directly from an individual or as a processor/service provider for vessel and filing data entered by a customer. The role and terms should be confirmed for the applicable account and jurisdiction.

Data Controller Contact:
Email: privacy@canalclear.org
Subject line: "Privacy Inquiry"

2 Data We Collect

We collect the following categories of data:

Category	Examples	Source
Account data	Name, email address, company name, phone number	Registration & lead forms
Vessel & fleet data	Vessel name, IMO number, flag state, vessel type, cargo class, tonnage, call sign, hull ID	User input during filing
Compliance data	VUMPA submissions, PCSOPEP documents, SCA Transit Requirement Sheets, hazmat declarations, ISPS notifications	User input & generated filings
Payment data	Billing name, last 4 digits of card, billing address, subscription tier	Stripe (we do not store full card numbers)
Usage data	Pages visited, features used, filing activity, error events	Automatic (server logs, analytics)
Technical data	IP address (hashed for storage), browser type, device type, session ID	Automatic (HTTP headers)
Communication data	Email content when you contact us or respond to product emails	Direct communication

Note on vessel data: Vessel information (IMO numbers, cargo manifests, VUMPA filings) may constitute commercially sensitive or regulated data. We treat this data with the highest level of confidentiality. It is not intended for sale or advertising use.

3 How We Use Your Data

To provide the service: Generate, validate, and store compliance filings for your vessels and fleet.
To manage your account: Authentication, subscription management, billing, and support.
To send product communications: Onboarding emails, filing reminders, regulatory update alerts, and subscription notices. You may opt out at any time.
To improve the platform: Aggregate, anonymized analytics to understand how features are used and prioritize development.
To comply with legal obligations: Record-keeping required by applicable law, responding to lawful government or regulatory requests.
To prevent fraud and abuse: Monitoring for suspicious activity and enforcing our Terms of Service.

We do not sell your personal data. We do not use your vessel data or compliance filings for advertising; any other processing is described in this policy and applicable provider terms.

4 Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we rely on the following legal bases under GDPR Article 6:

Processing Activity	Legal Basis
Delivering the compliance filing service	Performance of a contract (Art. 6(1)(b))
Billing and payment processing	Performance of a contract (Art. 6(1)(b))
Product update emails and filing reminders	Legitimate interests (Art. 6(1)(f)) — keeping subscribers informed about their active filings
Marketing emails (newsletter, new features)	Consent (Art. 6(1)(a)) — opt-in at registration
Security, fraud prevention, abuse detection	Legitimate interests (Art. 6(1)(f))
Legal obligations and regulatory compliance	Legal obligation (Art. 6(1)(c))
Analytics and platform improvement	Legitimate interests (Art. 6(1)(f)) — aggregate and anonymized

5 Third-Party Services

We use the following configured service providers or tools to operate the platform. Availability, processing terms, and regions can change; each provider operates under its own documentation:

Service	Purpose	Data Shared
Stripe	Payment processing & subscription management	Billing name, email, payment card (tokenized), billing address
Cloudflare / R2	Infrastructure hosting, CDN, file storage	Generated documents, uploaded files, network traffic
Render	Application hosting and deployment	Server logs, application data at rest
Neon / PostgreSQL	Database hosting	All structured user and vessel data
Google Analytics	Website traffic analytics	Anonymized page views, device/browser type, geographic region
Postmark	Transactional email delivery	Recipient email address and email content

We do not permit any third-party service to use your personal data for their own marketing, advertising, or analytics purposes beyond what is necessary to provide the service to us.

6 Data Retention & Deletion

We retain your data only as long as necessary for the purposes described in this policy, and in accordance with applicable law:

Data Type	Retention Period
Account & profile data	As described in the applicable account and deletion workflow
Compliance filings & vessel records	Only where a separate legal or contractual obligation applies; otherwise subject to the applicable deletion workflow
Billing records	7 years (financial/tax compliance)
Server & access logs	As configured for the relevant operational record
Analytics data (anonymized)	As configured for the relevant analytics system
Marketing email preferences	Until opt-out or account deletion

Deletion requests: You may request deletion of your personal data by emailing privacy@canalclear.org. We will review requests and respond within a reasonable period, subject to identity verification and applicable legal or contractual retention obligations.

Important: Some records may be subject to legal, contractual, or customer-directed retention. This policy does not create a universal seven-year retention promise. We will assess deletion requests against the applicable obligation and workflow.

7 Your GDPR Rights

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

Right of Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete personal data.

Right to Erasure

Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.

Right to Portability

Receive your data in a structured, machine-readable format and transfer it to another controller.

Right to Restrict Processing

Ask us to pause processing of your data in certain circumstances.

Right to Object

Object to processing based on legitimate interests, including direct marketing.

Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent, without affecting prior processing.

Right to Lodge a Complaint

Lodge a complaint with your local data protection authority (e.g., the relevant EU supervisory authority).

To exercise any of these rights, email privacy@canalclear.org with the subject line "GDPR Request." We will review rights requests within a reasonable period and may need to verify your identity before fulfilling the request.

8 Cookies & Tracking

We use cookies and similar technologies to operate and improve the platform. Here is what we set:

Cookie	Purpose	Duration	Type
`cc_token`	Authentication — keeps you logged in to your account	Session / 30 days	Strictly necessary
`cc_sid`	Anonymous session identifier for usage analytics	1 year	Analytics (functional)
`cc_utm`	Remembers campaign source (UTM parameters) for referral attribution	30 minutes	Analytics (functional)
`_ga / _gid`	Google Analytics — anonymized pageview and traffic tracking	Per the current Google Analytics configuration	Analytics (third-party)
`cc_cookie_consent`	Stores your cookie consent choice	1 year	Strictly necessary

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in. Disabling analytics cookies will not affect your ability to use the platform.

Google Analytics is configured with IP anonymization enabled. We do not use advertising, targeting, or cross-site tracking cookies.

9 International Data Transfers

CanalClear uses third-party hosting, database, storage, email, analytics, and payment services. Processing location depends on the provider and current configuration and may include the United States or another jurisdiction.

Where a transfer outside the EEA/UK occurs, the applicable transfer mechanism depends on the provider, jurisdiction, and current contract. Contact us if you need a review of available safeguards before using the service.

Transfer safeguards, including SCCs or adequacy mechanisms, are considered where applicable and where supported by the relevant provider documentation.
Adequacy decisions — where the receiving country has been deemed to provide adequate protection by the European Commission.
Provider-specific privacy and transfer terms apply to provider processing.

You may request a review of relevant transfer information by emailing privacy@canalclear.org; availability depends on the applicable provider and contract.

10 Security

We implement industry-standard security measures to protect your data:

Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher (HTTPS).
Encryption at rest: Sensitive data (OAuth tokens, credentials) is encrypted using AES-256-GCM before storage.
Access controls: Strict role-based access. Production data access is logged and audited.
Payment security: Card data is never stored on our servers. Stripe handles all payment card processing and is PCI-DSS Level 1 certified.
Parameterized queries: All database interactions use parameterized statements to prevent SQL injection.

If you discover a security vulnerability, please report it responsibly to security@canalclear.org. Do not publicly disclose potential vulnerabilities before contacting us.

No system is perfectly secure. If a personal-data incident triggers a notification duty, we will notify affected parties and authorities as required by applicable law.

11 Children's Privacy

CanalClear is a professional B2B software platform intended for maritime industry professionals. We do not knowingly collect personal data from individuals under 16 years of age. If you believe a minor has submitted data to us, contact privacy@canalclear.org and we will promptly delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "Last updated" date at the top of this page. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

We will not retroactively reduce your rights under this policy without your explicit consent.

13 Contact

For any privacy-related inquiries, rights requests, or complaints:

Email: privacy@canalclear.org
Subject line: "Privacy Inquiry" or "GDPR Request"
Response time: We aim to acknowledge privacy inquiries within a reasonable period. Rights requests are handled subject to applicable law, verification, and retention obligations.

You also have the right to lodge a complaint with a supervisory authority. In the EU, this is the data protection authority in your country of residence. In the UK, this is the Information Commissioner's Office (ICO).

Contents