Privacy Policy

Last updated 27 October 2026

This policy explains what Musterlist ("we") does with personal data when you use Musterlist: the website, the app, the Channel Manager and the pages we send to your clients and guests. Write to us through our contact page with any question. [Company registration number, VAT number and a privacy email address, to be completed.]

Who is responsible

• We are the controller for the website, for the accounts of the people who sign in, for their companies' subscriptions, and for messages sent through our contact form.
• Your company is the controller for what it puts into Musterlist about its clients, guests, crew and yachts: charters, preference sheets, proposals, itineraries and bookings. We process that data only on its instructions, to provide the service, under our Terms and a data processing agreement. [DPA to be attached.]

If you are a guest or a client of a company that uses Musterlist, that company decides what is collected about you and why. Ask it first; we will help it answer you.

What we keep, and why

• Accounts: name, email, company, role, a hashed password, which team a person belongs to, and the time, IP address, device and browser of each sign-in. Why: to run your account and keep it secure (our contract with you, and our legitimate interest in security).
• Subscriptions: the plan, the number of yachts or members, and the state of the subscription. Card details go to Stripe, never to us. Why: our contract with you, and the tax law that requires invoices to be kept.
• Booking systems: the logins your company gives us for CYA, Booking Manager (MMK) and Nausys, stored encrypted, and the yachts and bookings we read with them. Why: to provide the Channel Manager your company asked for.
• Charters and guests: what your company and its guests enter: names, contact details, dates, preferences, and, when the company asks for them, passport and health details. Passport and health details are encrypted, shown only with a reason that is recorded, and deleted after the charter on a schedule the company sets (by default 90 days, never more than 180). The rest of the guest data is deleted by default 365 days after the charter, never more than 730. Who opened, revealed or exported a charter's guest data is recorded, with when, why, and from which IP address and browser; those addresses are removed with the charter's guest data. Why: on behalf of your company, which decides the purpose.
• Proposals and itineraries sent to clients: when someone opens a shared proposal or itinerary, we record the time, IP address and browser (at most once an hour per address), so the broker can see it was opened. When a client asks for an estimate, we keep what they typed and their IP address. Why: on behalf of the broker's company.
• Alerts on your phone: if you turn on alerts in the Channel Manager app, your browser gives us an address to send them to. We stop using it when you remove that device, or when the browser tells us it no longer accepts alerts.
• AI assistant: how many questions each person asked this month, never the questions themselves.
• Contact form: what you write is emailed to us and not stored in Musterlist. We keep the email as long as we need it to answer you. Why: our legitimate interest in answering, or the steps before a contract you asked for.
• Technical logs: our servers keep error and access logs, with IP addresses, for [14 days, to be confirmed], to keep the service running and secure. We do not log passwords, booking-system logins or guest-link codes.

What we do not do

• No advertising, no tracking or analytics cookies, no selling or sharing of data for marketing.
• No profiling and no decisions about you made only by a machine.
• No guest-sheet link is stored in a readable form: only a fingerprint of it.
• We do not use your company's data to train AI models, and our AI provider does not either. [To be confirmed against Anthropic's terms.]

Who else handles it

We share personal data only with the providers we need to run the service, each bound to protect it:

• Stripe and Link sell the subscription on our behalf, take payment and send invoices. They receive the company's name, the owner's email and payment details. Stripe is its own controller for payments.
• Anthropic answers the questions brokers type into the AI research assistant, and helps write itinerary summaries. Only what is typed, or the itinerary's days, is sent.
• Mapbox draws the maps of itineraries; your browser loads the maps from Mapbox, which sees its IP address.
• CYA, Booking Manager (MMK) and Nausys, with your company's own accounts, for the Channel Manager and for yacht search.
• The push services of your browser (for example Google, Apple or Mozilla) carry the alerts you turned on. They see that an alert was sent, not what it says in a readable form.
• An AI assistant you connect yourself (such as Claude or ChatGPT) can read the Channel Manager's yachts and bookings, never change them, until you disconnect it. What it does with that data is between you and its provider.
• A calendar you subscribe (such as Google Calendar) with the Channel Manager's private calendar link fetches your bookings from that link until you turn the link off.
• Our hosting and email providers, to run the service and send its emails. [Hosting and email providers, and the countries the data is kept in, to be completed.]

We may also disclose data when the law requires it, or to protect the service and its users from fraud or abuse.

Outside the European Economic Area

Some of these providers are in the United States or reach data from there (Stripe, Anthropic, Mapbox). Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses. [To be checked provider by provider.]

How long we keep it

Guest data follows the deletion schedule above. Account and company data is kept while the account is open; when a company leaves, its data is deleted within [90 days, to be confirmed], except invoices, which the law requires us or Stripe to keep [for 5 years in Greece, to be confirmed]. Backups are overwritten within [30 days, to be confirmed].

How we protect it

Connections are encrypted. Booking-system logins and guests' passport and health details are encrypted in the database. Each company sees only its own data, and inside a company each person sees only what their role allows. Guest links open only with the charter's code, which only a fingerprint of is stored.

Your rights

Under the GDPR you can ask to see, correct, export or delete your personal data, to restrict how it is used, or to object to it. Where we rely on your consent, you can withdraw it at any time. We answer within one month. A guest whose data a company holds should ask that company first; we help it answer.

You may also complain to your data protection authority. In Greece that is the Hellenic Data Protection Authority (www.dpa.gr).

Cookies

We use only the cookies the service needs to work: no tracking or advertising cookies. The Cookie Policy lists each one.

Children

Musterlist is for businesses, and accounts are for adults. A guest list may name children travelling with their families; the company that runs the charter is responsible for collecting that data lawfully.

Changes

We will tell account owners by email before a change that matters takes effect, and show the date of the last change at the top of this page.