Privacy Policy

1. Who we are

SailorNotebook ("we", "us") operates the SailorNotebook web application. For the personal data you store in your account, SailorNotebook acts as the data controller. You can reach us at sailornotebook@tutamail.com for any privacy matter.

2. What data we collect

Account data: your email address, password (stored only as a secure hash by our authentication provider), preferred language and account role (seafarer or company).

Professional records you choose to add: identity details, passport and visa information, seaman's book entries, STCW and other certificates, licences, flag documents, sea service history, work experience, education, special skills, and vaccination or medical fitness documents — including scanned copies you upload.

Company account data: company name, contact person, country and phone number.

Crew records: on which company's ship you serve or served, in what rank, and since when.

Technical data: basic logs (IP address, browser type, timestamps) generated by our hosting and security infrastructure.

3. Why we process your data

To provide the service: storing your records, tracking document expiry dates, and composing your maritime CV.

To share your CV with employers — only at your request, when you apply to a job posting, accept an invitation, or explicitly send your CV to a company.

To prepare the port entry/departure crew list (IMO FAL Form 5) of the ship whose crew you are part of, and the other port-entry crew lists authorities require (e.g. the vaccination list and the crew currency declaration) — see "Port crew list".

To secure accounts, prevent abuse, and comply with legal obligations that apply to us.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who we share it with

Maritime companies on SailorNotebook: a company sees your CV and records only when you apply to its posting, accept its invitation, or send it your CV. When you confirm that you are crew on a company's ship, that company and the ship's master can also use the identity details needed for port crew lists. You decide; we never list your profile to companies without an action from you.

Service providers (processors) acting on our instructions: Google Firebase / Google Cloud Platform (authentication, database, file storage), Netlify (hosting of the web application and its server functions), Resend (transactional email delivery, e.g. sending your CV by email at your request) and Sentry (error monitoring). These providers process data on servers outside Turkey.

Authorities, where the law requires us to disclose data.

5. Port crew list (IMO FAL Form 5)

When you confirm that you are part of the crew of a company's ship, that company's authorised users and the ship's serving master can use SailorNotebook to prepare the crew list (IMO FAL Form 5) that authorities require when the ship enters or leaves a port. The list contains: your name, your rank, your nationality, your date and place of birth, your gender, and the type, number, issuing state and expiry date of the identity document chosen for the list (passport or seaman's book). The other crew lists authorities require at port entry can be prepared in the same way: the vaccination list given to the port health authority contains your name, your rank, your nationality and your date and place of birth; the crew currency declaration given to customs contains only your name and your rank. These details are taken from the records you entered in your own profile. SailorNotebook does not read, store or print any health information for these lists: health columns such as vaccination dates are printed blank and filled in by hand, on paper, by the master. The amounts on the currency declaration are printed blank as well; each person fills in and signs their own line. Your details are included only while you are active crew on that ship.

The only purpose is to prepare these lists that authorities require for port entry and departure formalities. The company or master who prepares a list on SailorNotebook hands it themselves to port authorities, the port health authority, immigration and passport control, customs and the ship's agent. SailorNotebook does not send it to them; at that stage the company and the master are responsible for your data.

Legal basis: port states require these lists under international shipping and health rules (the IMO FAL Convention and the World Health Organization's International Health Regulations) and their own laws. This processing is necessary so that the company and the master can meet that obligation, and to perform the contract you are party to as a seafarer (KVKK art. 5/2-ç and 5/2-c; GDPR art. 6(1)(c) and 6(1)(b)). It therefore does not rely on separate explicit consent.

Each list is generated on demand. SailorNotebook does not keep the lists, their PDFs or their Excel files on its servers. On the web, the file is downloaded only to the computer of the person who prepared it. In the mobile app, the PDF sits in the app's temporary folder so that it can be shared, and is deleted when another list is prepared or the screen is closed. From then on, the downloaded or shared file is kept by the company and the master. To detect misuse, we record only who prepared which list, for which ship, port and date, and how many people it contained. That record contains none of your identity details and is deleted after 24 months.

When the ship calls at a port abroad, the list is given to that country's authorities, which means your data is transferred abroad. The company or master makes that transfer as part of port formalities. If the company you work for is established outside Turkey, making the list available to that company is also a transfer abroad.

It is up to you to keep your identity details in your profile up to date; a wrong entry in your profile will be wrong on the list too. Once you leave a ship, your details no longer go into that ship's new lists. The rights described under "Your rights" apply to this processing as well. However, because the list is a legal requirement, you cannot stop your identity details from being included while you serve on board. You can correct inaccurate data and ask us for which ship and when a list was prepared.

6. How we protect it

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to your records is restricted by authentication and per-account security rules. Uploaded documents are not publicly accessible.

7. Retention and deletion

We keep your data for as long as your account is active. You may delete individual records at any time from within the app.

You have the right to delete your account and the data in it. When you ask us to delete your account (via the app or by writing to sailornotebook@tutamail.com), we remove your personal records and uploaded documents, except for minimal data we must retain to meet legal obligations.

8. Your rights

Depending on the law that applies to you (including the GDPR and the Turkish KVKK), you have the right to access the data we hold about you, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format.

To exercise any of these rights, contact sailornotebook@tutamail.com. We will respond within the period the applicable law requires.

9. Changes to this policy

We may update this policy as the service evolves. We will post the updated version here and revise the effective date; for material changes we will notify you in the app or by email.