Legal
Última actualización: 1 de abril de 2026
The data controller responsible for this platform under the General Data Protection Regulation (GDPR) and applicable data protection law is IT Solid Solutions, the company behind Decktrace. For data protection enquiries, contact hello@decktrace.io.
Decktrace is a platform that converts General Arrangement plans into structured vessel area catalogs with stable identifiers and an embeddable interactive viewer. This Privacy Policy describes what data we collect, how we use it, the legal basis for each processing activity, and the choices you have.
The short version: Your GA plan files and vessel catalog data belong to your organization. We do not sell personal data. We do not store your operational data — inspections, maintenance records, voyage logs, and compliance results live in your own systems. Decktrace provides the visual cataloging layer.
Under GDPR, every processing activity must have a lawful basis. We rely on the following:
This policy applies to anyone who accesses the Decktrace website (decktrace.io), creates an account, uses the web application, calls our API, or embeds the Decktrace viewer in their own platform. By using the platform you accept the practices described here.
When you register or join an organization we collect your name, work email address, organization name, and billing contact. Legal basis: contract (Art. 6(1)(b)) — necessary to create your account and issue invoices.
To use Decktrace you upload General Arrangement plans (PDF or image). We store these to process them into interactive catalogs. You also create vessel area definitions: names, stable identifiers, geometry, deck assignments, and classification tags. All catalog content belongs to your organization. Legal basis: contract (Art. 6(1)(b)) — necessary to provide the core service.
Our servers automatically log IP address, browser type, operating system, referrer URL, and request timestamps when you access the platform. These logs are retained for a maximum of 30 days, after which IP addresses are anonymized. Logs are never used for marketing or profiling. Legal basis: legitimate interests (Art. 6(1)(f)) — technically error-free operation and security of our systems.
If you contact us by email or through the contact form, we store your name, email address, IP address at time of submission, and the content of your message. This data is deleted when the conversation is concluded; metadata is deleted within 7 days of the conversation closing. Legal basis: legitimate interests (Art. 6(1)(f)) — responding to your request; or contract (Art. 6(1)(b)) where the purpose is entering into or performing an agreement.
We do not collect or store your operational maritime data: inspection results, maintenance records, defect logs, voyage data, and compliance reports remain in your own systems unless you explicitly build an integration that sends them to us. We do not collect payment card details — all billing is handled by Stripe.
We do not use your data to train AI models without your explicit consent. We do not send marketing emails without opt-in. We do not sell or rent personal data.
We share data only with the sub-processors necessary to operate the platform. All are bound by Data Processing Agreements (DPAs):
We may disclose data if required by law, court order, or to protect the rights and safety of our users. We notify account holders of such disclosures where legally permitted.
You may request copies of the Standard Contractual Clauses we have in place with US sub-processors by contacting hello@decktrace.io.
Our primary infrastructure is hosted in the EU. Where data is transferred outside the EU — for example, to Stripe or Amazon CloudFront in the United States — we ensure equivalent protection by relying on Standard Contractual Clauses (SCCs) adopted by the European Commission, or the EU-US Data Protection Framework where the relevant provider participates.
When you embed the Decktrace viewer in your own application, the viewer does not set third-party cookies on your users' devices. Access control is handled via share tokens passed as URL parameters or HTTP headers. Your end users' interactions with the embedded viewer are not tracked by Decktrace.
All data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted using AES-256. Access is enforced at the database level so organizations cannot access each other's data. See our Security page for a full overview.
Under GDPR you have the following rights regarding your personal data:
To exercise your rights, contact hello@decktrace.io. You can download your vessel catalog at any time from the platform. Account deletion can be requested by email.
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority in your EU member state. A list of EU data protection authorities is available at edpb.europa.eu.
We do not send unsolicited commercial messages (spam, cold emails, or robocalls). We only contact individuals who have explicitly opted in to receive communications or with whom we have an existing business relationship that permits contact. To report suspected abuse, contact hello@decktrace.io.
We will post updates to this policy on this page with a revised date. For material changes we will notify account holders by email at least 14 days in advance. Continued use of the platform after changes take effect constitutes acceptance.
General privacy questions: hello@decktrace.io
Data protection and legal matters: hello@decktrace.io