Privacy Policy

Last updated: March 1, 2026

1. Introduction

CharterAI ("we", "us", or "our") operates the CharterAI platform, a cloud-based software service for the maritime shipping industry. This Privacy Policy explains how we collect, use, store, and protect information when you use our website, platform, and related services (collectively, the "Service").

CharterAI is operated by a company incorporated in Germany as a GmbH. As such, we are subject to the European Union General Data Protection Regulation (GDPR) and applicable German data protection laws.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the Service.

2. Data Controller

The data controller responsible for your personal data is:

For any questions or concerns regarding data protection, you may contact us at the email address above.

3. Data We Collect

We collect and process the following categories of data:

3.1 Account Information

When you register, we collect your name, email address, and organization name. If you sign up via Google OAuth, we receive your Google profile information (name, email, profile picture) as authorized by you.

3.2 Email Data

When you connect your email account (Gmail or Microsoft Outlook/Office 365) via OAuth 2.0, we access your emails for the purpose of identifying and extracting maritime shipping information. We do not store your email password. Access is granted through industry-standard OAuth 2.0 authorization, and you may revoke this access at any time.

We access email metadata (sender, subject, date) and email body content to classify and extract structured data fields relevant to maritime commerce, such as vessel names, cargo details, port names, laycan dates, and commercial terms.

Extracted structured data is stored in our database associated with your organization. You may request deletion of your data at any time.

3.3 Usage Data

We may collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, device information, and IP address. This data is used to improve the Service and ensure its security.

3.4 Payment Data

Payment processing is handled by Stripe, Inc. We do not store credit card numbers or full payment details on our servers. We may store limited billing information such as subscription plan, billing status, and invoice references. Please refer to Stripe's Privacy Policy for details on how they handle your payment data.

4. How We Use Your Data

We use the data we collect for the following purposes:

• To provide, operate, and maintain the Service, including parsing and classifying email content, extracting structured data, and presenting it to you through our dashboard.
• To manage your account, organization membership, and subscription.
• To process payments and manage billing through our payment processor.
• To communicate with you regarding your account, service updates, and support requests.
• To improve, develop, and optimize the Service based on aggregated and anonymized usage patterns.
• To comply with applicable legal obligations.

5. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on the following legal grounds:

• Contract performance: Processing is necessary to provide the Service you have subscribed to, including email parsing, data extraction, and related features.
• Legitimate interest: We may process data for purposes such as improving our Service, preventing fraud, and ensuring platform security, where such interests are not overridden by your rights.
• Consent: Where required, we obtain your explicit consent before processing, such as when you connect your email account via OAuth. You may withdraw consent at any time.
• Legal obligation: We may process data to comply with applicable laws, regulations, or legal proceedings.

6. Data Sharing

We do not sell, rent, or trade your personal data to third parties.

We may share data in the following limited circumstances:

• With trusted third-party service providers who process data on our behalf, to the extent necessary to provide the Service.
• Within your organization, as the Service is designed for team-based use. Members of the same organization may access shared data as determined by the organization's settings and roles.
• If required by law, court order, or governmental request.
• In connection with a merger, acquisition, or sale of assets, subject to the acquiring entity honoring this Privacy Policy.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained while your account exists. You may request account deletion at any time.
• Extracted structured data (cargo, vessel, and other maritime records) is retained while your organization's account is active. You may request deletion of specific records or all data.
• Email metadata and content used for processing may be retained for a limited period to support the extraction pipeline. You may request earlier deletion.
• Billing records may be retained as required by applicable tax and accounting regulations.

Upon account deletion or your request, we will delete or anonymize your personal data within a reasonable timeframe, except where retention is required by law.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Database access is restricted through Row Level Security (RLS) policies, ensuring organizational data isolation.
• Email account access is managed through OAuth 2.0 — we do not store your email password.
• Access to production systems is restricted to authorized personnel.

While we take reasonable steps to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

9. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: You may request that we limit how we process your data in certain circumstances.
• Right to data portability: You may request to receive your data in a structured, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@charterai.co. We will respond within 30 days, as required by law.

You also have the right to lodge a complaint with a supervisory authority. In Germany, the relevant authority depends on the federal state in which we are established.

10. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions.

By using the Service, you acknowledge that your data may be transferred to and processed in jurisdictions outside the EEA.

11. Cookies & Tracking

Our website may use essential cookies to maintain your session and preferences (such as language and theme selection). We do not currently use third-party advertising or analytics cookies.

If we introduce analytics or non-essential cookies in the future, we will update this policy and provide you with appropriate notice and consent mechanisms.

12. Children's Privacy

The Service is intended for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

14. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us: