Draft dated 25 October 2026. Contact readiness, provider safeguards and retention arrangements remain to be confirmed before publication.
Privacy Policy
How HejBoat handles inquiries, accounts, listing information and technical data.
1. Who is responsible and how to contact us
The controller is HejBoat v/ Christian Oliver Seehusen, Otto Brandenburgs Vej 72, 2450 København SV, Denmark. Our website is https://hejboat.com. For all privacy and data-subject enquiries, contact legal@hejboat.com.
2. What HejBoat does
HejBoat helps people discover boats and send inquiries. We do not process renter payments or complete bookings. Operators handle any subsequent arrangements. Browsing does not require an account. Inquiry forms ask for your name, email address, message and number of guests, with an optional preferred date. Avoid including sensitive personal information or information about other people that is not needed for your request.
3. Real listings, demo listings and other forms
Submitting the inquiry form on a published listing stores your name, email and message in Supabase, with the preferred date and guest count appended to the message, the listing reference, receipt time and status. This also happens on published demo listings: demo does not mean the form is a simulation. Those inquiries go to HejBoat through administrator-owned listings, not fictional operators, and do not book a demo boat. The older sample boat pages and general contact form only validate entries in the browser and show a simulated confirmation; they do not submit those form entries to HejBoat. The current listing inquiry handler uses a public connection and does not attach your signed-in account identifier.
4. Who can see an inquiry and how replies work
HejBoat platform administrators can read inquiries in the administration inbox. The account that owns the listing's provider can also read its inquiries under the current access rules. For real listings this can be the actual operator; therefore access is not exclusively limited to HejBoat administrators. Published demo listings currently belong to an administrator. Inquiries are not publicly displayed. When an inquiry is submitted, the boat operator receives an email and a notification in their HejBoat Dashboard. An administrator or owner can later open a reply in their email application, containing your address and inquiry details, and choose to send it. That correspondence is then handled by their email service. We have not verified all email providers used for these manual replies.
5. Accounts and provider information
If you create an account, Supabase Auth handles your email, password authentication, account identifiers and session information. Sign-up confirmation and password recovery use its authentication email service. Your display name and language preference may be saved in your profile. Provider profiles can include a name, provider type, registration information, address, contact name, email and phone number. We use these details to maintain accounts, associate boats and listings with their provider, manage authorized access and review listings. Email sign-in is enabled, sign-up is open and email confirmation is required in the publicly readable Supabase settings checked on 25 October 2026. All listed social providers are disabled. The SMTP provider, delivery and session limits remain unverified.
6. Public listings, photographs and revisions
Published listings show boat and offer details, location and pickup information where supplied, prices, descriptions, photographs and captions, together with the provider's display name and verification indication. These can be personal data, especially for private owners or identifiable people in photographs. Do not put private contact details or unauthorized photographs in public listing text. The public site does not need to display your account email or provider contact fields. Imported source contact metadata is stored separately with owner and administrator access. Pending changes are reviewed separately; the current public version remains until approval, when the approved listing information and image references change together while retaining the listing address. New revision uploads are private before approval, but original uploads in the public boat-images storage can be fetched by anyone who has their URL even before a listing is published. Removing an image reference does not necessarily delete its file. Search engines and other visitors may retain copies of information already published.
7. Why we use data and our provisional legal bases
We use inquiry details to respond to your request and let the relevant operator follow up, account details to provide account and listing services, and technical data to operate and protect the service. Our provisional GDPR basis is Article 6(1)(b) where processing is necessary to provide the service you request or take steps at your request, and Article 6(1)(f) for proportionate platform administration, business contact handling and security. The legitimate interests are running a reliable marketplace, preventing misuse and managing communications and listing reviews. These assessments remain to be finalized. A required checkbox on an inquiry form is not a blanket legal basis for all processing. Consent, if needed for a separate optional purpose, must be specific and withdrawable. We do not identify automated decisions producing legal or similarly significant effects in the current application.
8. Browser storage, external resources and technical data
The browser stores a language preference, authentication session information and local navigation or draft-related state so you can return to the account flow. Logging out ends the application session but is not an account deletion request. Google Fonts is loaded from Google servers for Fraunces and Manrope, and boat and destination images are loaded from Supabase storage. Requests to these services expose technical connection data such as your IP address and browser information. Hosting and authentication services may also handle request and security logs. Our source audit did not find an application-installed marketing analytics tracker; that is not a guarantee that hosting sets no cookies or processes no analytics. The actual cookie, hosting analytics and log retention configuration still needs confirmation. A read-only visit to the unchanged production website on 25 October 2026 observed cookies named __dpl and __cf_bm. Their provider-defined purposes and lifetimes still require verification; the local preview visit set no cookies. In eligible embedded Lovable previews, authentication storage is also exchanged with the Lovable editor through origin-checked messages. The protected administrator demo preview offers a manual email action to an existing personal Google Mail mailbox; it does not automatically submit an inquiry.
9. Providers and international processing
The website uses Lovable hosting and Supabase for database, authentication and image storage. The deployment is built for a Cloudflare Worker runtime; the full hosting service chain and contractual roles still need verification. Google receives font requests. Manual email replies involve the sender's chosen email service, and authentication messages involve the configured Supabase email delivery service. A database region described as eu-central-1 does not establish that all support, logs, backups or other processing stays in the EU or EEA. We have not verified accepted data processing agreements, the full subprocessor list or safeguards for transfers outside the EEA. We therefore cannot promise EU-only processing or that particular transfer safeguards have been put in place.
10. How long data is kept
Retention should depend on whether an inquiry is still being handled, whether an account or listing remains active, whether information is needed to resolve a dispute or meet an applicable legal obligation, and whether security records remain necessary. Fixed retention periods and an operational deletion procedure have not yet been adopted. Closing or marking an inquiry as spam does not delete it. There is no user-facing account deletion or automatic inquiry purge in the audited application. Revision image files may be retained after a reference is removed to protect existing published listings. We do not promise automatic deletion or a specific backup or log expiry period. Requests for erasure must be assessed individually, including public copies, linked records, retained files and provider backups. Please send all privacy and data-subject requests to legal@hejboat.com.
11. Your rights and complaints
Subject to the GDPR's conditions, you can ask for access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests. Where a specific processing activity relies on consent, you can withdraw that consent without affecting earlier lawful processing. Please send all privacy and data-subject requests to legal@hejboat.com. We may need proportionate information to verify your identity; do not send identity documents unless requested through a suitable channel. We must normally respond within one month, with any permitted extension explained. You can complain to the Danish supervisory authority, Datatilsynet, through https://www.datatilsynet.dk/borger/klage. An operator handling correspondence for its own purposes may also be independently responsible for that processing.
12. Publication and changes to this notice
This text describes the audited preview as at 25 October 2026; it has not been published as a final policy and is not a statement that the unchanged production website has the same features. Before publication we must verify a working contact process, service provider and transfer arrangements, retention and rights-handling procedures, and the final purpose-specific legal assessments. Material changes to data use will require an updated notice and, where necessary, further information or a new legal basis. A version date will identify the notice in force.