HALYard Beta — Privacy Notice

Version: 0.2 draft · July 2026

1. Who we are

HALYard is provided by AcroSource AB - 556767-6266 - ("we", "us"), a company registered in Sweden. We are the data controller for personal data processed in the HALYard beta.

Contact for privacy matters: privacy@acrosource.se

2. What this covers

This notice applies to the HALYard beta application (macOS, Android, iOS) and its backend services during the closed beta period. The beta is offered free of charge to invited testers.

3. Data we process

Category	Examples	Why
Account data	Email address, display name	To create and secure your account
Vessel data	Boat name, model, engine, specifications, service records you enter	To provide vessel-specific assistance
Documents you upload	Manuals, certificates, service records (content and extracted text)	So the AI assistant can answer questions from your vessel's documentation
Location and voyage data	GPS/NMEA position tracks, voyage logs, log entries with sensor snapshots (speed, depth, wind, heading), man-overboard events	Core app functionality: voyage logbook, chart display, safety features
Assistant interactions	Chat messages, voice input transcripts, AI responses	To provide the assistant; to debug and improve answer quality
Voice audio	Microphone audio captured when you use voice input	Transcribed to text on our servers.
Diagnostics	Per-interaction technical records (which processing path ran, retrieval results, sensor snapshot at the time), app logs	Debugging and quality improvement
Feedback reports	Reports you submit in-app, including the recent conversation transcript and technical diagnostics, with the preview shown to you before sending	Reviewed by us to fix problems
Crash and error data	Crash reports and errors via Sentry, with personal identifiers scrubbed before transmission	Stability
Device data	App version, platform, device model	Support and debugging

We do not collect payment data during the beta. The beta is not directed at persons under 18.

4. Location data — specific commitments

Position tracks are among the most sensitive data we hold. During the beta:

Voyage tracks and positions are stored in the EU (see §6) and are visible only to your account (enforced by row-level security).
Track and position data are excluded from any aggregated or "fleet" analysis unless you explicitly opt in to sharing.
Track data is not included in feedback-report diagnostics.

5. Legal bases (GDPR Art. 6)

Performance of a contract (Art. 6(1)(b)): providing the app you signed up to test — account, vessel data, voyages, documents, assistant interactions.
Legitimate interests (Art. 6(1)(f)): debugging, crash reporting, improving AI answer quality using diagnostics and feedback you submit. You may object at any time.
Consent (Art. 6(1)(a)): device location access (requested in-app via the operating system; withdrawable in OS settings), and any future optional data sharing.

[VERIFY with counsel: the assignment of bases above, and whether a Legitimate Interests Assessment should be documented for diagnostics.]

6. Where data is processed, and by whom

We use the following processors:

Processor	Purpose	Location	Safeguard
Supabase	Database, authentication, storage	EU (Stockholm region, eu-north-1)	DPA executed (PandaDoc, July 2026) incl. SCCs; Transfer Impact Assessment on file
Railway	Backend application hosting	EU (Amsterdam region)	DPA executed (July 2026) incl. SCCs; subprocessors per trust.railway.com
Anthropic (Anthropic Ireland, Ltd. as EEA contracting entity)	AI model processing of assistant conversations (chat text and relevant vessel context are sent to the Claude API to generate responses)	United States	DPA with Standard Contractual Clauses, incorporated into the accepted Commercial Terms of Service (dated copies on file, July 2026). API inputs/outputs are not used for model training and are retained only briefly for safety purposes per Anthropic's terms
Sentry	Crash and error reporting (identifiers scrubbed client-side)	European Union (EU)	DPA per sentry.io/legal/dpa, incorporated into terms (dated copy on file, July 2026)

We do not sell personal data and do not use it for advertising. We maintain an internal processor register (service, data categories, region, DPA status, transfer mechanism) as part of our records of processing activities.

7. Retention

Account, vessel, voyage, and document data: for the duration of your participation in the beta, plus 30 days, or until you delete it or request deletion.
Per-interaction diagnostics: retained while the beta runs, and deleted with your account or on request. We plan to introduce automatic scrubbing of free-text fields in these records.
Feedback reports: retained while relevant to open issues, reviewed periodically.
Crash data: per Sentry retention settings.
If the beta ends or your account is removed, associated personal data is deleted within 30 days, except where law requires longer retention.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, and receive a copy of your data, to restrict or object to processing, and to withdraw consent where processing is based on consent. Contact [privacy@acrosource.se].

You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY, www.imy.se) or your local supervisory authority.

9. Security

Data in transit is encrypted (TLS). Access is scoped per user via database row-level security. Crash reports are scrubbed of personal identifiers before leaving the device. The beta is pre-release software; despite our safeguards, you acknowledge it may contain defects (see the Beta Agreement).

10. Changes

We may update this notice during the beta; material changes will be announced in-app or by email, with the current version always available at https://www.halyard.se