Privacy Notice

This Privacy Notice sets out the details of how Bluewater Cruising ("we", "us", "our") as data controller, collects and processes your personal data obtained directly from you, or through our website located at Bluewatercruising.com or our other online platforms and social media channels which, for the purposes of this privacy notice, shall be collectively referred to as ("the Website").

For the purposes of this Privacy Notice, personal data shall mean any information that can be used to identify an individual whether directly or indirectly ("Personal Data").

Please read through the content of this Privacy Notice carefully and ensure that you understand it. If you do not understand the content of this Privacy Notice or do not accept or agree with it then you must stop using the Website and/ or accessing our other online platforms, social media groups and any other associated groups or pages immediately. If you have already provided us with any Personal Data, then you must contact us immediately.

By accessing the Website and providing us with your Personal Data you are warranting that you are over 18 years of age. This Website is directed to individuals who are at least 18 years of age. The Website is not intended to be used by anyone under the age of 18 and we do not collect any Personal Data or information from anyone under 18 years of age in compliance.

If you have any questions about this Privacy Notice or require more information concerning our privacy and data protection practices, please contact us at support@bluewatercruising.com.

What personal data do we process, why do we process it, and how do we collect it

We may process Personal Data that you provide to us by subscribing to a newsletter or email list, requesting information through a contact form, or by any other communication via email, text or through our Website.

We may also process your Personal Data through the use of cookies or other tracking software on our Website. Please refer to our separate cookie policy for further information.

We record which pages of our websites you view and, if you sign up or fill in a form, link those page visits to you.

When we process your Personal Data we will comply with relevant data protection laws and principles such as the General Data Protection Regulation (EU Regulation 2016/679) ("GDPR"), which means that your data will be used lawfully, fairly and in a transparent way, kept securely and only for as long as necessary for the purposes we have told you about.

We shall only collect and process your Personal Data for purposes that are clearly outlined prior to you providing us with your data, or for a legitimate reason.

Whenever we process your Personal Data we do so on the basis of a lawful condition this will either be because you have given your consent for us to process your Personal Data, where we are under a contractual or legal obligation, or where it is in our legitimate interests to do so.

We do not carry out automated decision making or any type of automated profiling.

The types of Personal Data which we process will vary depending on your own specific circumstances but typically can include:

• Personal Information: which may include your name, date of birth, email address, phone number, business contact details, correspondence address, IP address. We shall process this data for the purposes of communicating with you and keeping our records on the lawful grounds of legitimate interest;
• Customer or Client Information: should you purchase goods and/or services from us then we may process information in connection with your purchase, and the supply of that purchase, as well as keeping appropriate records. Such information may include your Personal Information, billing address, delivery address, credit card or other payment details and we shall process it on contractual grounds;
• Messaging Consent: We collect opt-in consent separately for transactional and promotional SMS messages. Consent is obtained through online forms, including booking pages, lead magnet downloads, and event registrations. Users must actively check consent boxes before submitting their details.
• User Information: this may include comments or statements that you may make or post via our Website, online platforms or social media channels, images, documents or videos that you share on or through our Website or through any of our pages or other online platforms, and information concerning your use of our Website or other online platforms such as your browser information, pixel ID, page views, pages visited, number of visits and where appropriate log-in details. We shall process this information to analyse and monitor usage and content of our Website and other platforms and channels to ensure the content is relevant to you, to support our administration and record keeping requirements, and to maintain security of our systems on legitimate interest grounds;
• Promotional Information: this may include information you provide in connection with any promotions, marketing, or advertising from us or our third parties. We shall use this information to provide relevant offers and advertisements, competitions and promotions and other free resources and to monitor our promotional activity, keep records and compile analytics on legitimate interest grounds.

Where we contact you through email, we shall ensure that our emails clearly display the location of the sender and include clear options for you to opt-out from receiving contact from us in accordance with the CAN-SPAM Act.

Special Category Data

We do not collect any special category data about you. This is data relating to your health, race or ethnicity, political opinion, religious or philosophical beliefs, trade union membership, genetics, biometrics, sex life or sexual orientation. We do not process any data relating to criminal offences and convictions.

Disclosure of Personal Data

We may use any of the following external service providers to support our business and may share your Personal Data with those third parties:

Go High Level, Zoom, Google, Stripe, Kajabi, Whatsapp, Facebook, ManyChat

We understand that all of these third parties have appropriate technical and security processes in place to protect your data.

We may also share your Personal Data as follows:

• where it is necessary for external service providers who have been engaged by us to assist in the provision of services to our clients and customers;
• where it is required by our professional support teams;
• where we are required by a government body or legal obligation or to protect our rights;
• where it is required in connection with the sale or purchase of any business or assets;
• with any other member or company of our group.
• where required to deliver opt-in SMS notifications (transactional or promotional) through our messaging provider.

Where we have outsourced a function or activity to an external service provider, we will only disclose Personal Data that the service provider needs to undertake that function or activity, and we require external service providers to agree to keep your Personal Data secure in accordance with the relevant law.

We agree not to share your Personal Data with any third party for that third party's marketing purposes unless we have obtained your consent to do so.

Transfer of Personal Data

Our Website is located within Indonesia and your data will be processed in Indonesia. We comply with the Internet laws applicable to that country.

We may also transfer your Personal Data to a third-party service provider which requires your Data to be transferred outside of the EEA. Where your Data is transferred outside of the EEA by our third-party service providers, we understand that they comply with the following standards relating to the security of your Personal Data:

• GHL use the EU Model Contract which governs the lawful transfer of data from the EEA to countries outside of the EEA. In respect of any payment or financial information Infusionsoft also complies with the Payment Card Industry Data Security Standards;
• Facebook complies with the General Data Protection Regulation and is certified under the Privacy shield for data transfers;
• Google complies with the General Data Protection Regulation and is certified under the privacy shield for data transfers. Google also complies with the Payment Card Industry Data Security Standards;
• Paypal relies on Binding Corporate Rules approved by competent Supervisory authorities;
• Stripe is certified under the EU-US Privacy Shield as well as EU Standard Contractual Clauses and Binding Corporate Rules.
• Zoom is certified under the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield;
• Dropbox is certified under the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield;
• Whatsapp is certified under the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield

Where we transfer Personal Data to parties not listed above that are outside of the EEA then we will ensure that at least one of the following conditions is met:

• You have given your express consent;
• The country has an approved adequate level of protection for personal data;
• It is legally required;
• It is authorised by the relevant data protection authority.

Data Security

We take the protection of your Personal Data seriously and have taken suitable and reasonable steps to protect the Personal Data we hold from misuse, loss, unauthorised access, and any modification or disclosure.

We limit access to your Personal Data to those employees, agents, contractor or third parties who have a business need to know. They will only process your Data on our instructions and must keep it confidential.

If you are submitting Personal Data over the internet that you wish to remain private, please note that while attempts are made to secure information transmitted to this site, there are inherent risks in transmitting information across the internet. If you prefer, we can arrange for you to submit your Personal Data through alternative means. Please contact us to discuss alternative methods.

Data Retention

We will not keep your Personal Data for longer than is required with regard to the purpose for which it was collected by us or provided by you including any legal or record keeping requirements and will take reasonable steps to destroy or permanently de-identify your Personal Data when it is no longer required.

Your Rights in Relation to the Data We Hold

To ensure the information we hold about you remains accurate please contact us using the email address above if at any time your personal details change.

Where you have provided your consent for us to process your Personal Data you can withdraw that consent at any time. Should you wish to do so please contact us at the above email address.

How to delete your data

Last updated: 2026-10-11.

If you have messaged us on Instagram or Facebook Messenger, you can ask us to delete that conversation and the data we hold because of it.

Email support@bluewatercruising.com and tell us the Instagram handle or Facebook name the messages came from. We take deletion requests by email only, not by direct message.

What we hold

We keep these conversations in our own database: your messages, a contact record for you, our replies, and our assistant's log of the conversation. If you later gave us an email address or phone number, we also hold a lead record in our member system. GoHighLevel and ManyChat, the messaging tools connected to our Facebook Page and Instagram account, also receive the conversation.

What we delete, and how fast

Within 30 days of your request, we delete your messages, the contact record made from them, our replies, and any lead record created from that conversation. We delete them in our own systems and in GoHighLevel and ManyChat.

What we cannot delete on request

• Anything we must keep for legal or accounting reasons, such as a purchase record if you also bought something from us.
• Our encrypted backups. A backup cannot be edited, so copies in it are not deleted on request. Backups expire on a schedule, the oldest after about 6 months.
• Meta's own copy of the conversation. We cannot delete it. Use the controls in Instagram or Facebook to remove it.

Links to Other Sites

The Website may contain links to other sites. We are not responsible for the privacy practices of those websites and have no knowledge of whether cookies or other tracking devices are used on any such linked sites. If you have any concerns regarding the privacy of your information you should ensure you are aware of the privacy policies of those sites before disclosing any personal information.

Changes to this Privacy Notice

We reserve the right to alter or amend this Privacy Notice without any prior notice to you. Should our Privacy Notice be altered, the new Privacy Notice will be posted on the Website.

Your first use of our Website after the date of any amendments or alterations will constitute your acceptance of such changes therefore, we recommend you review this Privacy Notice regularly to keep informed of any changes.

Facebook Group Capture (Chrome extension)

Last updated: 2026-10-21 (comments in the group).

What this extension is

Facebook Group Capture is an internal tool built and used by Blue Water Cruising. It runs in the Chrome browser of a Blue Water Cruising staff member who manages the company's Facebook group. It is not distributed to the public and has no other users.

What it does

About once an hour, the extension opens the Blue Water Cruising Facebook group's member-requests page in the signed-in staff member's own Chrome. For each pending request to join the group, it reads:

• the requester's name,
• their Facebook user id and profile URL,
• the answers they gave to the group's membership questions (which may include an email address or phone number, if the group's questions ask for one).

It sends this to Blue Water Cruising's own server, which stores it and decides whether to approve or decline the request. Only after the server has confirmed the request is stored and given a decision does the extension act on Facebook by clicking Approve or "Decline with feedback" with the wording the server supplied. If the server does not answer, or answers unexpectedly, the extension does nothing and the request is left for a later run.

Once a day at the set time, or when a staff member clicks Run now, it opens the group's pending posts page, where posts wait for an admin's approval. For each pending post it reads the author's name and Facebook user id, the post's text, the links in it, and whether it shares another post or carries a photo or video. It sends this to the same server, which stores it and decides whether to approve the post, decline it with a short message saying why, or leave it for a staff member to look at. As with requests, the extension acts only after the server has stored the post and decided.

To decide whether a post's text breaks a group rule (for example selling, spam, or asking for crew), the server sends the post's text only to Anthropic's Claude model and reads back a one-word answer. The author's name and id are never sent to Anthropic. A post waiting for approval may not yet be visible to group members.

Comments in the group

On one staff member's computer the extension runs in a separate comments-only mode. At the start of each of her shifts (twice a day), it reads the group's recent-activity feed, opens the group posts that have new comments (at most 10 posts), and reads up to 50 comments on each: the comment's text, the text of the post it is on, the commenter's name and Facebook ID, when it was posted, and whether Blue Water Cruising's Page has already replied. It sends these only to Blue Water Cruising's own server, so staff can reply. A reply may be drafted with the help of an AI service; a staff member reviews and posts every reply. In this mode the extension does not open the admin pages, and does not approve, decline, post or comment. Its only clicks are to show more comments and replies.

What data is collected, and why

• Name: to identify the request and, if approved, to contact the person as a new member
• Facebook user id and profile URL: to act on the correct request, and to avoid capturing the same request twice
• Membership question answers (may include email address, phone number): these are the group's own screening questions; Blue Water Cruising uses the answers to decide whether to approve the request, and, for approved requests, to follow up with the new member
• A pending post's author name and Facebook user id: to act on the correct post, to decide each post once, and so the group manager can mark someone who keeps breaking the rules
• A pending post's text, links, and whether it is a share or has a photo or video: to decide whether the post follows the group's rules
• A comment's text, the text of the post it is on, the commenter's name and Facebook ID, its time, and whether the Page replied: so staff can reply to comments in the group

This data is sent only to Blue Water Cruising's own server (db.yachtos.app, operated by Blue Water Cruising). The extension sends it nowhere else; the server sends a pending post's text, and nothing else about it or its author, to Anthropic to judge it against the group's rules, as described above. It is not sold. It is not used for advertising. The data is used to decide join requests and welcome approved members, and to decide whether pending posts follow the group's rules, and to help staff reply to comments in the group. Blue Water Cruising also keeps a repeat-offender record with a person's Facebook ID and name and the staff member who marked them. Staff can add people to or remove them from this record. This record is used when deciding how to handle that person's later pending posts.

The extension itself does not read, use or store anyone's data except the group's pending join requests and pending posts and, in comments-only mode, the comments described above. It has no access to Facebook messages, friends lists, or any posts or comments other than those described above, or anything outside the group's member-requests and pending posts pages and, in comments-only mode, the group's recent-activity feed and the posts it opens.

What the extension does not do

• It does not post, message, comment, or send friend requests on Facebook. On the group's pending posts it only approves, or declines with Facebook's own feedback box.
• It does not collect data from any Facebook page other than the one configured group's member-requests and pending posts pages and, in comments-only mode, the group's recent-activity feed and the posts it opens.
• It does not run on any page the staff member browses. It only reads pages it opens itself: the group's member-requests and pending posts pages, or in comments-only mode the group's recent-activity feed and the posts with new comments. Member requests are checked about once an hour. Pending posts are checked once a day at the set time, or when a staff member clicks Run now.

Retention and access

Captured requests, posts and comments are stored on Blue Water Cruising's own server. Only Blue Water Cruising staff can access them. Each installation keeps its key in the browser and sends it to the company server to authenticate which installation is calling. The server stores only the key's fingerprint, not the key itself.

Who to contact

Questions about this policy, or a request about your own data if you have applied to join the group: chris@bluewatercruising.com.