Privacy Policy

1. Our commitments to your data

Four commitments anchor this policy and apply to every plan tier:

• Encrypted in transit. All web and API traffic to the Platform uses TLS. Data moves between your browser, our servers, and our subprocessors over encrypted connections.
• Encrypted at rest. Sensitive contact fields (such as email address, name, phone, address, and IP), and the integration credentials you connect to your workspace, are stored using AES-256-GCM field-level encryption with keys held outside the application database.
• We do not sell your data. We do not sell, rent, license, or share personal information for cross-context behavioral advertising. There is no “data” revenue line of business at Triton Technical, LLC and there never will be.
• We do not access your data except to operate the Service. We do not read your contact lists, your message content, or your engagement events for any purpose other than providing, securing, supporting, and improving the Service for you, and complying with law. We do not use Customer Data to train our own models, and we do not use it for our own marketing.

These commitments are described in operational detail in the sections that follow.

2. Who we are and how to contact us

YMS360 Engage (the “Service”, “Platform”, “we”, “us”) is operated by Triton Technical, LLC, a Washington limited liability company.

Registered address: 530 Industry Dr, Seattle, WA 98188, United States.
Phone: +1.206.453.6120
General contact: alec@yms360.com
Privacy and data-rights requests: alec@yms360.com

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and comparable laws, Triton Technical, LLC is the legal entity responsible for the Service.

3. Scope: our two roles (controller and processor)

This Service plays two different legal roles for personal information, and this policy describes both.

2.1 When we act as the controller

We act as the controller for personal information we collect and decide what to do with ourselves. That includes:

• information about visitors to engage.yms360.com;
• information about people who sign up for, administer, or pay for a workspace on the Platform; and
• information about business contacts and prospects in the yacht-management and superyacht-services sector that we use to market our own products and services.

2.2 When we act as a processor for our customers

When a customer (a “Tenant”) uploads, imports, or otherwise sends personal information about their own recipients (their contacts, leads, subscribers, vessel owners, and so on) through the Platform so the Tenant can run marketing or sales campaigns to those people, the Tenant is the controller of that data and we are the processor. We process that data on the Tenant's documented instructions under our Terms of Service.

If you are a recipient of a campaign sent through the Platform by one of our customers and you have questions about how your personal information is being used, please contact that customer first. We will assist them in responding to your request as described in section 11.

4. Categories of data we collect

4.1 Visitor and site data (we are controller)

• Website usage measured without cookies: pages viewed, referring page, browser user-agent, general device type, time on page, scroll depth, and which links or buttons were selected. Where an identifier is needed it is a hash that changes daily, so it cannot follow a visitor between days or between sites — see section 6.2.
• A keyed, irreversible hash of your IP address (used to count unique visitors approximately and to separate automated traffic). We do not retain the raw IP address in our website-analytics store. Raw IP may appear briefly in ordinary server and security logs, and is stored encrypted where it forms part of a contact record.
• Messages you send to the chat assistant on our websites, and the replies it gives — see section 6.3.
• Information you submit through public forms on our marketing site (for example, the “Request access” and “Contact” forms): name, business email, company, vessel/fleet details, and the contents of your message.

4.2 Account, workspace, and billing data (we are controller)

• Account and user-profile information: name, business email, password hash, role/permissions, login timestamps, and audit-log entries about administrative actions.
• Tenant / workspace information: company name, sending domain, plan tier, integration credentials (stored encrypted at rest), and configuration choices.
• Billing information necessary to administer a paid plan, where applicable. We do not currently process payment-card data ourselves; if we introduce card billing through a payment processor, we will update this policy and the subprocessor list in section 8 before doing so.

4.3 First-party marketing contact data (we are controller)

• Business-contact information about people we identify as relevant prospects in the yacht-management and superyacht-services sector, such as name, role, employer, business email, business phone, vessel association, and the source from which the contact was obtained.

4.4 Customer-uploaded recipient data (customer is controller; we are processor)

• Contact data uploaded or synced by a Tenant: typically name, business email, role/title, employer, mailing preferences, custom fields the Tenant chooses to maintain, and vessel association.
• Campaign-engagement events generated when those recipients interact with a Tenant's emails: opens, clicks, bounces, complaints, unsubscribes, and form submissions.
• Suppression-list entries (see section 10) generated when a recipient unsubscribes, hard-bounces, or complains.

4.5 Vessel data

• The Platform stores information about vessels that the customer enters or imports — name, IMO, MMSI, type, owner / manager association. AIS vessel-position tracking is opt-in per vessel: position ingestion only runs for vessels whose MMSI has been added to the workspace by the customer. AIS broadcasts are public maritime data about vessels, not direct personal information about identifiable individuals. To the extent vessel data can be linked to a natural person (for example, an owner or captain), that link is treated as personal information.

5. How we collect data and the legal bases we rely on

We collect data three ways:

• Directly from you — when you submit a form, create or sign in to an account, configure a workspace, contact us, or subscribe to our own communications.
• Automatically — when you use the Service or open / click an email we send (see section 6 on tracking).
• From our customers — when a Tenant uploads or syncs their own recipient lists into the Platform.

Where GDPR or UK GDPR applies, the legal bases we rely on are:

• Performance of a contract — to provide the Service to account-holders and Tenants, take steps to enter into a contract, and bill for paid plans.
• Legitimate interests — to operate, secure, debug, and improve the Service; to prevent abuse and protect deliverability; and to run our own B2B marketing to business contacts in the maritime sector, weighed against those contacts' rights and expectations.
• Consent — where required by law (for example, certain marketing communications in jurisdictions that require opt-in, or non-essential cookies / tracking). Consent can be withdrawn at any time.
• Legal obligation — to comply with applicable law, including anti-spam, accounting, and law-enforcement obligations.

When we process customer-uploaded recipient data as processor, the legal basis for processing that data toward the data subjects is the Tenant's responsibility as controller. Our Terms of Service require Tenants to have a lawful basis and proper consent or opt-out mechanism before sending.

6. Tracking technologies

The Platform uses several tracking technologies. Each is described below.

6.1 Cookies and similar technologies

We use only a small number of cookies that are strictly necessary to make the Service work — to keep you signed in, to remember your workspace selection, and to protect against cross-site request forgery. We do not use marketing cookies, advertising cookies, third-party analytics cookies, or any other non-essential tracking cookies — on this Platform or on any of our websites. We do not use cookies for analytics at all (see 6.2).

Specifically, engage.yms360.com sets a single session cookie (yms_session, expiring after two hours) that holds your sign-in session and a cross-site-request-forgery token. It is first-party, Secure, HttpOnly (so it cannot be read by any script, including ours) and SameSite=Lax. It contains an opaque session identifier — not a profile, and not an advertising or visitor identifier. Our public marketing website (yms360.com) sets no cookies at all.

We also use a small amount of browser session storage (which is not a cookie, and is erased when you close the tab) to keep a chat conversation together while you are reading a page, and to group interactions within a single visit for the analytics described in 6.2.

6.2 Website analytics — cookieless

We measure how our own websites are used so we can improve them. This is done without cookies and without any persistent identifier, from two sources:

• Server request logs. Our web servers record each request — the page path, response status, referring page, browser user-agent, and time. The requesting IP address is converted to an irreversible keyed hash before it is stored; we do not retain the raw IP address in our analytics store. The hash lets us count unique visitors approximately and distinguish automated traffic; it is not used to identify anyone.
• First-party page analytics on some of our sites, which record the page viewed, referring host, general device type (desktop / mobile / tablet), how long a page was in view, how far it was scrolled, and which links or buttons were selected. Where a visitor identifier is needed to group a visit, it is derived by hashing the IP address and user-agent together with a secret that changes every day. The practical effect is deliberate: the same person appears as a different, unlinkable value tomorrow, so we cannot build a profile, recognise returning visitors, or follow anyone between sites.

We do not use advertising or third-party analytics services on our websites, we do not share this data with anyone for advertising, and this analytics data is never linked to your account, to a marketing contact record, or to any email you receive. Traffic we identify as automated (bots and crawlers) is excluded from reporting. Links we record have any query string removed before storage, and mailto: / tel: links are reduced to the link type so no address or number is retained.

6.3 Website chat assistant

Some of our websites offer an AI chat assistant that answers questions about our products. We store the conversations — the messages you send and the replies you receive — so we can see what visitors ask and where our published information is unclear or missing. The messages you type are sent to our AI provider (Anthropic; see section 8) to generate a reply.

Chat conversations are not linked to your identity: no cookie is used, the conversation is grouped only by a temporary identifier held in your browser's session storage that is erased when you close the tab, and we do not connect conversations to a contact record, an account, or your browsing history. We do not store your IP address alongside the conversation. Please do not enter sensitive personal information, credentials, or confidential details into the chat — use the contact form or email instead. Retention is described in section 10.

6.4 Email open and click tracking

Emails sent through the Platform may include a 1×1 tracking pixel that records when the message is opened, and links may be rewritten through a tracking redirector that records clicks. These events are stored against the recipient record so the sending Tenant can see engagement on their campaigns. Recipients can suppress further messages from a Tenant using the one-click unsubscribe link in every marketing message (see section 10).

6.5 Lead scoring

The Platform computes a “lead score” for contact records based on signals such as email opens, clicks, form submissions, and recency of activity. Lead scoring runs against contact records owned by the Tenant (when we are processor) or against our own marketing contacts (when we are controller). It is used to prioritize outreach; it is not used to make legally significant automated decisions about a person.

6.6 AIS vessel-position tracking

AIS vessel-position tracking is an opt-in feature that only runs for vessels whose MMSI the customer has explicitly added to their workspace. For those vessels, the Platform subscribes to the public AIS broadcasts and stores the resulting position, speed, and heading against the vessel record. AIS data is broadcast publicly by the vessels themselves using internationally standardised maritime equipment, and is not collected from individuals. We do not enable AIS tracking for vessels the customer has not added, and we do not share the customer's vessel list with anyone other than the AIS subprocessor identified in section 8.

6.7 Do Not Track

Our websites load no advertising or third-party analytics scripts for any visitor, whether or not a “Do Not Track” signal is sent, so there is no non-essential tracking to disable. The cookieless measurement described in 6.2 is first-party, carries no persistent identifier, and is what tells us which pages are worth keeping.

6.8 Connected email accounts (Gmail and Microsoft 365)

You can connect your own Google Workspace / Gmail or Microsoft 365 mailbox so the Platform can send one-to-one email as you, from your real address, with replies arriving in your own inbox. This is optional, and is set up — and can be removed — from your account settings. When you connect a mailbox:

• We request the narrowest access that performs the task. For Google this is the gmail.send scope, which lets the Platform send mail on your behalf and grants no ability to read, search, organize, or delete anything in your mailbox. For Microsoft 365 we request the Microsoft Graph permissions needed to create and send a message as you and, where you enable reply capture, to match incoming replies to the specific messages the Platform sent.
• We use this access only to send the messages you or your automated sequences compose, to place a copy in your Sent items, and to record which sent message a reply belongs to. We do not otherwise read your mailbox, we do not use your mailbox content to train any model, and we do not use it for our own marketing.
• To deliver a message, its content is transmitted to your mailbox provider (Google or Microsoft; see section 8), which sends it from your account.
• Your authorization tokens are stored encrypted at rest (section 12). You can disconnect a mailbox at any time from your settings, which revokes the Platform’s access and, for Google, asks Google to drop the grant.

Google API Services — Limited Use. The Platform’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements.

7. How we use and share data

We use personal information to:

• provide, secure, support, and improve the Service;
• operate accounts and workspaces, and bill for paid plans;
• send transactional communications (security alerts, billing, service notices);
• run our own B2B marketing to business contacts in the maritime sector, subject to applicable law and to your right to opt out;
• detect, investigate, and prevent abuse, spam, and security incidents; and
• comply with our legal obligations and enforce our agreements.

We do not sell, rent, license, or share personal information for cross-context behavioral advertising. We do not run a data-broker business and we do not use Customer Data to train our own AI models.

We do not access Customer Data — the contact records, message content, or engagement events you put into the Platform — except as necessary to operate, secure, support, and improve the Service for you, or to comply with law. Specifically, that means access by a small, audited group of operators only when needed to respond to a support request, investigate a security incident, fix a bug, or follow a binding legal order. We do not look at it for our own marketing, do not sell it, and do not share it with anyone outside the subprocessor list in section 8.

We share personal information only with:

• our subprocessors, listed in section 8, who provide infrastructure or service components on our behalf under written terms;
• the Tenant whose workspace the data belongs to, when we act as processor;
• professional advisors (e.g. lawyers, accountants, auditors) under duties of confidentiality, where reasonably necessary;
• acquirers or successors in connection with a merger, acquisition, financing, or asset sale, subject to confidentiality and to this policy continuing to apply; and
• authorities, when we are required by law to do so or to protect rights, safety, or property.

8. Subprocessors

The following third parties process personal information on our behalf to deliver the Service. We require each subprocessor to provide a level of protection consistent with this policy.

We will give Tenants reasonable advance notice of material changes to this list (such as adding a new subprocessor or changing the processing region of an existing one) so Tenants have an opportunity to evaluate the change.

9. International data transfers

The Platform is operated from the United States, and several subprocessors listed in section 8 are based in the United States. If you access the Service from the European Economic Area, the United Kingdom, or another jurisdiction with data-export rules, your personal information may be transferred to and processed in the United States.

Where required, we rely on the European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two controller-to-processor) and, for transfers subject to UK GDPR, the UK International Data Transfer Addendum to those clauses, to provide an appropriate safeguard for these transfers. We apply supplementary measures — including the encryption-at-rest and encryption-in-transit measures described in sections 1 and 12 — to reduce the risk associated with transfers to jurisdictions with broad government-access regimes.

10. Retention

We keep personal information for as long as we need it for the purpose for which it was collected, plus any period required by law, after which we delete or anonymize it. In particular:

• Account and workspace data is retained for the life of the workspace plus a reasonable wind-down period after termination. Tenants can request earlier deletion subject to legal-hold requirements.
• Audit and security logs are retained for a period proportionate to investigation and compliance needs.
• Suppression-list entries — addresses that have unsubscribed, hard-bounced, or complained — are retained indefinitely on the workspace so we can continue to honor the opt-out. Removing a suppression record would re-expose the recipient to messages they have already opted out of, which is exactly the harm anti-spam laws are designed to prevent.
• Campaign-engagement events (opens, clicks) are retained for as long as needed to support a Tenant's reporting and lead-scoring, and may be aggregated or anonymized over time.
• Website server request logs (section 6.2), which contain a hashed IP address rather than a raw one, are retained for 90 days and then deleted.
• Website chat conversations (section 6.3) and on-page interaction events such as link and button selections are retained for 180 days and then deleted.
• Cookieless page-view statistics (section 6.2) are kept as a long-term record of how our own sites are used. Because the visitor identifier in that data is derived from a secret that changes every day, rows more than a day old cannot be linked to one another or back to a person, so we retain them as historical usage statistics rather than as information about an individual.

11. Your rights and how to exercise them

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to our processing of your personal information, and to withdraw consent you have previously given. To exercise any of these rights, email alec@yms360.com. We may need to verify your identity before acting on a request.

If you are a recipient of a campaign sent through the Platform by one of our customers, the customer is the controller of that data and is the right first stop for an access, correction, or deletion request. If you are unable to identify or reach the relevant customer, contact us and we will route the request to them and support them in responding.

If you are in the EEA or the United Kingdom, you also have the right to lodge a complaint with your national data-protection authority.

12. Security

We apply administrative, technical, and physical safeguards intended to protect personal information against loss, misuse, and unauthorized access or disclosure. Current measures include:

• TLS in transit for all production web and API traffic;
• field-level AES-256-GCM encryption at rest for sensitive contact fields (such as email address, name, phone, address, and IP address) and for integration credentials, using keys held outside the application database;
• password hashing with bcrypt, server-issued session cookies, configurable session lifetimes, and per-tenant data isolation;
• role-based access control, least-privilege internal access, audit logging of administrative actions, and bounce / complaint circuit-breakers to protect deliverability;
• regular dependency updates and review of subprocessors.

No system is perfectly secure. We do not represent that the Service is immune from compromise. If we learn of a personal-data breach that affects you, we will notify you and the relevant authorities to the extent required by law.

13. Children's data

The Service is a business-to-business product for the maritime industry. It is not directed to children under 16, we do not knowingly collect personal information from children, and we do not provide accounts to children. If you believe a child has provided us with personal information, please contact alec@yms360.com and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will give reasonable advance notice — for example, by posting a notice on the marketing site, sending an email to workspace administrators, or both — before the changes take effect. Continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

Governing law for this policy follows the choice of law set out in our Terms of Service: the laws of the State of Washington, United States, with venue in King County, Washington.