Privacy Policy

1. Who we are and what this policy covers

AeonSea LLC, a North Carolina limited liability company ("AeonSea," "we," "us," or "our"), provides aeonsea.com and related web applications, desktop applications, APIs and software services (collectively, the "Services"). This Privacy Policy explains the personal information we collect, use, disclose, protect and retain when people use or interact with the Services.

The Services support marina reservations and management, marine repair and service work, charter and yacht operations, boat listings, marine jobs, workforce records, Restaurant and Bar POS, restaurant online orders, retail POS, warehouse and tool-room systems, contracts, messaging and other enabled functions. Our Restaurant and Bar POS can be used by participating marina or charter operators; this does not mean AeonSea itself serves or sells alcohol.

A "Business" is a third-party marina, charter operator, hospitality merchant, marine service company, employer, retailer, brokerage or other organization that uses the Services. Some Businesses control information about their customers, passengers, workers and applicants. Section 6 explains the respective roles. This notice is not a substitute for separate consent where law requires it or for an individual Business's own legally required notice.

2. Our privacy commitments

We do not sell personal information. We do not sell, rent, or trade customer contact lists, private vessel records, messages, employee records, or other personal information to data brokers or other parties for their unrelated purposes.

We do not share personal information for cross-context behavioral advertising or targeted advertising based on activity across unrelated businesses, websites, or applications. We do not authorize advertising networks to build those profiles through our Services. Operational disclosures to a business you choose, a payment provider, or a service provider are addressed below; they are not unrestricted permission for advertising use.

Access must have a purpose. We use personal information to deliver and support requested services, protect the platform, administer our business relationship, and meet lawful obligations. Private business records are not a general customer-data pool for unrelated businesses. We limit collection and disclosure to information reasonably needed for the stated purpose.

Private information is not general-purpose AI training material. We do not use private customer or business content to train general-purpose AI models or authorize providers to use that content to train models for their own unrelated purposes. Section 17 explains the distinction between operating an authorized feature and training a model.

Your choices matter. We separate public content from restricted records, distinguish transactional messages from marketing, and provide a way to request access, correction, or deletion. Retention required for a transaction, another person's rights, or law is explained rather than treated as unlimited permission to keep everything.

3. Information we collect

Account and security records. We collect name, contact details, username, business affiliation, access permissions, settings, legal-policy acceptances, account recovery details and authentication records. These may include password hashes, MFA configuration, sign-in events, session or token information and security audit records. We do not store account passwords as readable plaintext.

Vessel, marina, charter and service information. Depending on your actions, we receive vessel identity, registration and dimensions, owner or operator relationship, reservation details, trip dates, slip or berth assignments, passengers or crew, service and parts history, work orders, estimates, electronic approvals, invoices, uploaded records, messages and location information. A vessel-related record can also be personal information when it identifies or is linked to a person.

Restaurant, bar, retail and hospitality transactions. Where Restaurant and Bar POS, online ordering or retail functions are used, we process such details as product and menu selections, order timestamps, charges, discounts, taxes, gratuities, refunds, payment and fulfillment status, merchant identity and receipt details. Some voluntarily supplied order instructions, including food allergies, dietary needs or accommodation requests, may reveal sensitive information. Certain operators may record that a restricted-sale eligibility or age check occurred; any identity documents must be handled through the appropriate authorized workflow rather than ordinary free-text notes. We do not automatically receive all records kept by the merchant outside AeonSea.

Payments and business verification. We may process transaction references, amounts, billing contact information, payment-method tokens, limited card or bank details received from processors, chargeback data, payout status and connected Business verification information. Sensitive payment credentials and some identity information may be collected directly by Stripe or another designated provider; the data flow depends on the integration. Section 8 provides more detail.

Business and employment information. Enabled tools can involve staffing, shifts, time entries, tips, permissions, tool checkouts, crew assignments, resumes, references, training and licensing information, employment applications and contracts. The Business or employer determines many of these purposes and is responsible for its independent use and legal notices.

Content and communications. We process messages, service requests, reviews, public listings, photos, videos, application attachments, customer-support inquiries, moderation reports and electronic signatures and acknowledgements where used. Public content and restricted records are handled differently.

Technical, measurement and location information. IP address, browser and device type, user-agent, page and API requests, referring page information, timestamps, approximate IP-derived location, security events, error diagnostics and operational performance measurements may be collected. We measure some listing impressions and page/detail views for operational understanding. We receive submitted delivery, berth and service locations and, where an enabled feature requests it, device location with required permission. Section 9 explains cookies and measurement.

Sensitive or third-party information. Identity documents, protected employee records, precise locations, limited accessibility or food-allergy notes and similar information require special care. Do not put full card numbers, banking passwords, medical records, government identification scans or unrelated sensitive information into unrestricted messages or public listings. Only provide another person's information when you have the appropriate authority and notice.

4. Where information comes from

We receive information directly from you; automatically from your device and use of the Services; and from Businesses, employers, crew administrators, transaction participants, or other people acting with authority. For example, a marina may enter a reservation made by telephone, and a service shop may add a work order before its customer has an AeonSea account.

We also receive relevant information from payment processors, financial institutions, service providers, and integrations you or an authorized Business enable. Business-contact or listing information may come from public business sources or an introduction you request. Such information is not automatically a verified personal profile or permission for unrestricted marketing.

When records are linked to an existing account, the association must have a reasonable basis and respect access permissions. A claimed match, vessel identifier, or shared email address does not by itself authorize disclosure of someone else's private records. Contact us about an incorrect association.

5. How we use information

We use personal information to create and maintain accounts, verify identity, authenticate sessions, enforce business and user permissions, support the product features that participants request and maintain records needed for those operations.

We use reservation, vessel, charter and service records to communicate requests, coordinate the responsible operator's work, document authorization, provide receipts, support invoices and refunds, resolve disputes and maintain appropriate customer or vessel histories. Hospitality records support menu and order management, Restaurant and Bar POS, payment routing, tips, receipts and associated fulfillment by the Business; AeonSea does not use those transactions to sell targeted advertising profiles.

Operational data is used to protect systems, investigate security events and fraud, diagnose service problems, measure reliability and understand listing or product usage. We may analyze aggregate or appropriately de-identified statistics but do not treat information as anonymous solely because reports hide names.

We also use information for subscription administration, billing, required notices, lawful reporting, customer support, protection of rights and fulfillment of legal duties. Marketing is subject to Section 10. We do not use private workforce, vessel, payment, support or restaurant guest information to train an unrelated general-purpose AI model.

6. Businesses, permissions, and vessel histories

AeonSea processes some information for its own purposes, such as account administration, platform security, support, product operation and lawful compliance. A Business may independently determine why and how its staff, customers and visitors' information is collected. When AeonSea processes information solely under a Business's valid instructions, we act as that Business's service provider or processor for that activity. The relationship depends on the actual purpose, contract and law.

Only the participants reasonably needed to complete an authorized transaction receive information in that workflow. A marina may need boat and arrival details; a service shop may need relevant service history; a charter operator may need crew and passenger details; a restaurant or bar may need the items and instructions necessary to fulfill an order; and an employer may need an application. That does not grant them blanket access to an individual's full account, payment details, unrelated employment records or the customer data of other Businesses.

An existing business relationship is not an unrestricted email-marketing list. Contacts may still be disclosed through an accepted transaction, a document intentionally shared, a support interaction, or a legal requirement. Businesses remain responsible for their own privacy notices, lawful instructions, permissions and any information they independently export or retain.

A vessel ownership transfer is not automatic permission to disclose the prior owner's private contact information, payment details, personal communications or a former service provider's confidential notes. Appropriate transferable maintenance facts and restricted person-specific records must be kept distinct. For Business-controlled information, we may facilitate a privacy request with the responsible Business while retaining responsibility for any processing we independently control.

7. When we disclose information

Transaction parties. We provide relevant information to the Business involved in the marina booking, charter, repair, restaurant or bar transaction, POS sale, order, listing, recruitment process or other requested activity. Sharing is limited to the transaction and authorized role; applying for one job does not publish your application to every employer.

Service providers and payments. Infrastructure, hosting, communications, support, monitoring and payment providers may process the data reasonably needed to perform the services engaged. Payment processors can have separate independent compliance and fraud-prevention purposes (Section 8). Providers operating on our behalf are expected to observe appropriate confidentiality, security and use restrictions.

Maps, weather and integrations. Enabled mapping or geocoding services such as Mapbox, weather feeds, merchant accounting integrations and similar services can receive coordinates, searches, technical request details or authorized business records required to operate the chosen function. Their direct collection and independent activities may be governed by their own notices. A disabled integration does not automatically delete records already lawfully held by the recipient.

Public content, support and legal matters. Information intentionally placed in public listings or reviews can be publicly visible (Section 11). We may share relevant information with professional advisers, insurers, auditors, regulators or law enforcement for legitimate claims, legal process, incident response and protection from fraud, subject to appropriate limitations. An acquisition or reorganization may involve protected transfers to a successor bound by applicable privacy duties; this is not a standalone authorization to sell private contact lists.

We do not sell, rent or trade personal information to data brokers or advertising networks, or share it for cross-context behavioral advertising. Where disclosure is required by valid process or law, we assess the scope and provide notice when permitted and appropriate.

8. Payments and Stripe

AeonSea supports transactions using Stripe and Stripe Connect. Depending on how a payment is presented and configured, Stripe may receive card and bank information directly, and AeonSea or a connected Business may receive transaction identifiers, payment status, limited payment-method details, billing information, disputed amounts and settlement or payout data necessary to support the workflow.

Stripe also processes verification, fraud-control, payment and regulatory information for its own purposes. Merchant-of-record and data-controller/processor roles vary by transaction arrangement; the use of Stripe does not itself mean AeonSea receives no financial personal information or has no obligations. Customers may review Stripe's privacy information at https://stripe.com/privacy.

For Restaurant and Bar POS and other merchants, AeonSea processes order and settlement records only as needed for authorized transactions, reconciliation and operational functions. We do not use card, tip or purchase histories for unrelated advertising. Each merchant independently remains responsible for the payment records and disclosures it controls. A privacy request to AeonSea does not automatically delete records that a bank, processor or Business must lawfully keep.

9. Cookies, monitoring, and device permissions

Essential first-party cookies. Our reviewed AeonSea first-party cookies serve account and security purposes rather than advertising. `AeonSea.Web.Auth` maintains the signed-in website session; `X-AeonSea-UI` supports authenticated API access; and antiforgery cookies help prevent forged requests. Their duration depends on the deployed session and security configuration and can be inspected using browser cookie controls. Blocking essential cookies can prevent login, authentication or completion of protected workflows.

Other browser and application storage. The Services may use browser session/local storage or authorized offline-device storage for user preferences, application state, pending transactions and selected supported offline features. Clearing that storage is not the same as deleting server-side records. Storage used for listing measurements must be assessed separately from essential authentication technologies.

Operational measurement. AeonSea may count listing impressions and detail-page activity, measure application performance and review errors to maintain and improve the Services. Such information may include event time, page or listing identifier, tab/session state, device or network metadata, and associated account or Business identifier where needed for the authorized purpose. Aggregate reporting does not, by itself, make individual events anonymous. We do not use Marketplace measurement for unrelated cross-site advertising profiles.

Monitoring providers. We use New Relic for performance diagnostics, error investigation and operational visibility. The telemetry actually transmitted depends on instrumentation and can include server and browser request information, session identifiers, errors and performance measures. We restrict sensitive-content capture according to operational configuration and legal requirements. If an additional feature that records or reconstructs browser interactions, such as Session Replay, is activated, its actual capture scope, protections and required notice or choices must be addressed before use; this general notice alone does not authorize indiscriminate recording of passwords, payment data or private communications.

Third-party components. Stripe payment elements, Mapbox or other mapping components, and other enabled providers may receive technical details when loaded or used and may set their own cookies or storage where their features require it. A review of AeonSea's first-party authentication cookies does not characterize every third-party component. Their own privacy notices may apply to processing they independently determine.

Disclosure and controls. We describe necessary storage even when advance cookie consent is not legally required. We do not use advertising cookies for cross-context behavioral advertising. Where optional technology or other processing requires consent, it must be enabled only with that consent; where applicable law provides an exception or an opt-out approach, we provide the required information and control. You can adjust browser storage, device permissions and optional settings, although essential-feature blocking may impair function.

Privacy preference signals. We apply our no-sale and no-cross-context-advertising practices regardless of whether a browser preference signal is sent. Where applicable law requires recognizing a universal opt-out signal, including Global Privacy Control, we honor it for the covered processing. Legacy browser "Do Not Track" is not treated as a separate deletion or technical-troubleshooting opt-out. Contact us about a particular cookie, storage or provider used by your enabled feature.

10. Communications and marketing choices

We send administrative notices related to authentication, billing, receipts, reservations, charters, service estimates, POS transactions, order confirmations, staff operations, security or legal compliance where reasonably required by the relationship and law.

AeonSea promotional email requires an appropriate request, subscription or other lawful authorization; each marketing message offers the applicable unsubscribe method. Sending a support request or placing a restaurant or marina order does not automatically subscribe a person to unrelated promotional messages. We may retain minimum opt-out and suppression details to honor preferences.

A Business using the platform to send email, telephone or SMS messages is responsible for complying with applicable marketing, employment and communications laws, including required consent and opt-out handling. A Business's commercial messages are not automatically AeonSea marketing messages; platform participation does not permit spam.

11. Public content and information you share

Information you deliberately publish in a public listing, profile, post, comment, review, or other public feature can be viewed, linked, copied, and indexed by people outside AeonSea. Public business listings, boat-sale listings, and job postings may be distributed through enabled discovery or search functions. Private messages, applications, credentials, and transaction records do not become public merely because the related Business or vessel has a public listing.

Review the selected audience before posting. Photos, videos, and attachments may reveal names, faces, addresses, vessel locations, or embedded metadata. Do not assume those details have been automatically removed. Group membership or access to a listing is not necessarily a promise of confidentiality from other participants.

You can request removal of content we control, subject to applicable rights and lawful retention. We cannot guarantee deletion of copies independently made by other people, search engines, or external services, but will take steps required by law concerning recipients and controlled copies. A user choosing to share personal information publicly does not eliminate all applicable privacy rights.

12. Security and authorized support access

We use reasonable administrative, technical and organizational measures proportionate to the data and activity. These include account authentication, password hashing, business and role access controls, selected application-level encryption of contact or profile information, protected network connections, and operational and security logging. Different record types, caches, attachments, exports and end-user devices may have different protections; we do not represent that every field is end-to-end encrypted.

Authorized AeonSea personnel or service providers may access information only for a reasonably necessary support, operational, security or legal purpose. Where a protected support-unlock process is used, that process limits the permitted scope and duration and records appropriate actions. We do not promise that support access always requires the affected person's real-time approval or that no infrastructure operator could technically process protected information.

Key management capabilities, including rotation, are used according to operational procedures; this policy does not promise a particular weekly key-rotation schedule. Monitoring does not guarantee immediate discovery of incidents or uninterrupted service. Businesses must separately protect devices, personnel access, exported records and payment terminals.

If an incident triggers a legal notification obligation, we provide the required notification to the appropriate Business, person, authority or other party within the applicable standard. No technology can prevent every unauthorized event, but that does not excuse legal or contractual duties.

13. Retention, deletion, and business exits

We retain personal information only for as long as reasonably necessary for the stated purpose, an applicable agreement, or a lawful obligation. Relevant factors include the type and sensitivity of the information, the continuing relationship, transaction status, legitimate recordkeeping requirements, security needs, and applicable claim periods. Different categories can have different retention periods.

Account and profile information is retained while the account is maintained and as reasonably necessary to close it, address a request, or meet a lawful exception. Vessel, booking, work, and purchase histories are retained to provide the authorized history and administer the associated transactions; they are not a justification for indefinite retention of unrelated personal information.

Invoices, payment references, executed agreements, and approval evidence may need to remain for accounting, tax, warranty, dispute, or other legal requirements after an account closes. We retain only information appropriate to those purposes and restrict its further use. A completed transaction does not require keeping every associated support message or optional profile field for the same duration.

Business-controlled workforce and operational records are retained under lawful instructions and the applicable data agreement, subject to our independent obligations. Diagnostic logs, support cases, and moderation records are retained for the period reasonably needed to investigate and resolve the issue, maintain security, and document necessary actions. Precise location and sensitive documents are limited to their disclosed purpose and applicable legal needs. Marketing preferences, consent evidence, and minimal suppression records may be retained to document and honor choices.

Our Terms provide a Business with a 30-day post-termination period to request an export of its authorized, then-available records. That is a contractual export window, not a promise that every record is deleted on day 31 and not a deadline for exercising statutory privacy rights. A Business's export does not include other Businesses' records or unrelated personal information. A customer-facing record may also remain available in a separate active personal account where authorized and lawful.

Deletion from active systems may occur before protected backup copies expire through their normal retention cycle. Retained backup data remains restricted and is not used as an active source for marketing or ordinary account activity. If a backup is restored, applicable deletion and restriction instructions must be reapplied. We follow any law requiring faster removal or a different treatment of backups.

Deleting your account does not automatically erase another party's lawful transaction or employment records, undo a completed agreement, or cancel an existing booking. We address deletion requests record by record where necessary, explain applicable exceptions, and notify providers or other recipients when required. Records no longer needed are deleted or appropriately de-identified rather than retained merely because they might someday be useful.

14. Your privacy choices and requests

You may request access to your personal information, correction of inaccurate information, deletion, and a portable copy where available or required. Depending on the law that applies to you and the processing, you may also have rights to know the sources, purposes, and recipients; restrict or object to processing; withdraw consent; limit uses of sensitive information; opt out of sale, targeted advertising, or covered profiling; and appeal a decision on your request. Our Section 2 commitments apply independently of whether a particular statute's coverage threshold is met.

Submit a request to the privacy email or through the public Contact page identified in Section 20. State the request, your relationship to the Services, and enough information to locate the relevant account or record. You do not have to buy a subscription or create an account to make a request. Existing account controls may also let you update information or change visibility directly.

For access, correction, deletion, or export, we may reasonably verify identity and authority to avoid disclosing or deleting another person's information. Verification must be proportionate. Do not send passwords, full payment credentials, or identity documents in an ordinary initial email. We will provide a suitable route if additional verification is necessary. A legally recognized opt-out signal or an opt-out request that does not require identity verification is not conditioned on providing identification documents.

An authorized agent may submit a request with the authority required by applicable law. We may request evidence of that authority and, where permitted, confirmation from you. We use request-verification information for that process and appropriate recordkeeping, not marketing.

We respond within applicable legal time limits and explain any permitted extension or lawful reason a request cannot be fully completed. For example, covered U.S. state-law access and deletion requests commonly have a 45-day response period, while applicable European data-protection requests generally require a response within one month, subject to lawful extensions. We apply the actual deadline for your request rather than treating these examples as universal rules.

Requests are handled without charge unless applicable law permits a reasonable fee, which we explain in advance. We do not unlawfully discriminate or retaliate for exercising privacy rights. Deleting information genuinely necessary for a requested service may prevent that service from continuing; it is not a penalty for exercising a right.

To seek review of a refusal, contact the same privacy address with "Privacy Appeal" and describe the decision. We explain the result and provide information about contacting the appropriate regulator where required. You may complain to your state attorney general or competent data-protection authority without first completing our internal process.

15. Additional U.S. privacy information

Depending on where an individual lives, the information involved and applicable thresholds and exemptions, U.S. privacy laws may give rights to know or obtain personal information, correct errors, request deletion or portability, limit some sensitive-data uses, opt out of sale or targeted advertising, and appeal a denial. We apply those rights to covered processing without charging an unlawful fee or unlawfully discriminating for exercising them. Section 14 explains how to submit and verify requests.

Categories addressed by this notice include identifiers and contact details; account and authentication information; payment and commercial transaction information; internet and device activity; approximate or precise location in enabled workflows; photos, reviews, messages and uploaded materials; work and applicant records; and limited sensitive information such as identity-verification data or voluntarily submitted dietary/allergy notes. Their sources, uses, disclosures and retention criteria are explained in Sections 3 through 13.

We do not sell personal information or share it for cross-context behavioral advertising, including information about individuals we know are younger than 16. We do not use sensitive personal information to infer unrelated characteristics for advertising. We process applicable recognized opt-out preference signals for activities covered by law. If a lawful choice or specific notice is required for a regulated activity, we provide it before that processing.

For California residents when the CCPA applies, relevant rights include access to categories and specific information, correction, deletion, applicable sensitive-information limitations, information about business-purpose disclosures, and protection from unlawful retaliation. We do not disclose information to third parties for their independent direct marketing in circumstances covered by California's "Shine the Light" law. Our no-sale and no-advertising-sharing statements describe our operating commitment; they are not a representation that every optional third-party module has undergone independent certification.

If AeonSea is subject to a jurisdiction's detailed prior-12-month reporting, notice-at-collection, consumer-health-data, biometric, employment-monitoring or automated-decision rules, the additional notices and disclosures required for that actual activity apply. Requests and appeals can be submitted through the contact channel in Section 20.

16. International processing

AeonSea is based in the United States. Depending on enabled providers and the person's location, information may be processed within the United States or other countries where those providers operate. We do not promise data residency in a particular country or certification under an unspecified cross-border transfer framework.

Where EU, UK or other international privacy laws apply to the particular processing, we respect their applicable rights, lawful bases and transfer rules. A person's account, Business relationship, employment interaction, consent or transaction may create different permitted bases. We provide any required additional local contact details, transfer information, or feature-specific notices where applicable. Neither use of the platform nor this general notice is blanket permission for an unlawful transfer.

17. AI-assisted and automated features

If an AI-assisted feature is offered, the feature must identify its purpose and explain any additional processing before you use it. Answering a question using information you are authorized to access is different from using that information to train a general-purpose model. Our Terms and this policy do not authorize general-purpose training on private customer or Business content.

An authorized AI workflow may process the question, limited relevant records, and the response to deliver the requested function and maintain its security. A third-party model provider must be disclosed where used, and its access must be limited to the authorized purpose under appropriate data protections. An account's permissions do not expand because an automated assistant is used. We do not treat a public-facing chatbot as authorization to send every Business's records to a model.

The platform and payment providers may use automated rules for availability, workflow routing, fraud checks, or account protection. This is not a representation that every payment or security decision is made by a person. You can request review of an AeonSea restriction through Section 20; a Business or processor may be responsible for reviewing its own independent decision. A feature involving legally regulated automated decisions requires the applicable additional notice, choice, and safeguards before use.

18. Children

Ordinary AeonSea accounts are intended for adults age 18 or older, consistent with our Terms. Access by an employee or crew member below 18 requires a separately approved arrangement and any required notices or permissions before access. The Services are not directed to children under 13, and we do not knowingly collect personal information directly from a child under 13 through a child-facing account or service without a lawful basis and required safeguards. An adult supplying limited dependent or passenger information does not create a child account and must have authority to do so.

Contact us if you believe a child has improperly submitted personal information. We will investigate and delete it or take other action required by applicable law. An age statement in this policy does not replace any required parental consent or protections for children's information.

19. Changes to this policy

We identify the effective date and version at the beginning of this policy. We provide appropriate notice of material changes, using account, email, or other legally appropriate channels, and obtain any additional consent required before a materially different use. A change does not retroactively authorize a use that was prohibited when information was collected. Simply continuing to use the Services is not a substitute for required consent. We keep prior versions available on request where reasonably available or legally required.

20. Contact us

AeonSea LLC — Attention: Privacy, North Carolina, United States.

Privacy questions, requests to access/correct/delete information, complaints, appeals, and questions about cookies or vendors may be submitted through https://www.aeonsea.com/contact. Begin the message with "Privacy Request" or "Privacy Appeal" and identify the relevant account, Business or transaction without including passwords, complete payment credentials or sensitive identity documents. The public form is accessible without signing in.

When a request concerns records independently controlled by a marina, charter operator, restaurant, bar, employer or other Business, we may ask for information needed to identify or contact the responsible Business. We remain responsible for the information and purposes we control. Where a particular law requires additional request methods, a physical address or a different contact route, we will provide them for the applicable activity.