Privacy Policy

01Who we are

This Privacy Policy explains how [Company legal name] (“Ship Hours”, “we”, “us”), a company based in India with its registered office at [Registered address], collects, uses, shares and protects personal data when you use the Ship Hours website, waitlist and club (the “Service”).

Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described here, and you are the Data Principal. Where the EU or UK GDPR applies, we are the “controller”. Where California law applies, we are the “business”.

This policy should be read alongside our Terms & Conditions.

02What we collect

We collect only what we need to run Ship Hours. Depending on how you use it, that may include:

Cookies

We use a small number of essential cookies and similar storage to keep you logged in, remember your settings and keep the Service secure. These are needed for the Service to work. If we use analytics or other non-essential cookies, we will ask for your consent first where the law requires it, and you can change your choice at any time. You can also block or delete cookies in your browser settings, but parts of the Service may then stop working.

We don't ask for sensitive data like health information, religion, caste, sexual orientation or financial account details. Please don't put them in your profile.

03What we don't do

04Why we use it, and our legal basis

We use personal data for these purposes:

• Running the waitlist: recording your interest, sending invites and early-access updates.
• Building your profile and matching you: processing your links and preferences to match you with relevant members and explain why you matched.
• Running sessions: scheduling, connecting video calls, reminders and follow-ups.
• Safety and trust: verifying identity, preventing fraud and abuse, enforcing our Terms, and handling reports.
• Improving the Service: understanding how Ship Hours is used, fixing bugs and improving matching. Where possible we use aggregated or de-identified data for this.
• Communicating with you: service messages, support and, if you agree, product updates. You can unsubscribe from non-essential emails at any time.
• Legal compliance: meeting legal obligations and responding to lawful requests.

Consent and legal basis

Under the DPDP Act, we process your personal data on the basis of your consent, which you give when you join the waitlist or create an account after being shown this policy. We also rely on certain legitimate uses permitted by the Act, for example where you've voluntarily provided data for a specific purpose, or where we must comply with law, a court order or a request from authorities. You can withdraw consent at any time (see “Your rights”). Withdrawing consent doesn't affect processing that has already happened, but we may no longer be able to provide the Service to you.

Under the GDPR, where it applies, our legal bases are: performance of a contract (providing the Service you signed up for), consent (for example, non-essential cookies and marketing emails), legitimate interests (keeping the Service safe, preventing abuse and improving matching, balanced against your rights), and legal obligation.

Automated matching

Matching is automated: we use your profile and preferences to suggest who you meet. It doesn't produce legal or similarly significant effects on you, and you can always update your profile, change your preferences, decline a session or contact us with questions about how matching works.

05Who we share it with

We share personal data only as described here:

• Other members. When you're matched, the people you meet can see your profile (such as name, photo, role, what you're building, what you need and your profile links) and why you matched. They will also see and hear you during the live video chat.
• Service providers who process data on our behalf, under contracts that limit their use of it to providing services to us, including:
  • hosting and infrastructure (for example, Vercel);
  • database and authentication (for example, Supabase);
  • video infrastructure providers that carry live sessions;
  • analytics and error-monitoring tools; and
  • email delivery and customer support tools.
• Legal and safety. When we believe in good faith that disclosure is required by law, court order or a lawful request from government authorities, or is necessary to protect the safety, rights or property of our members, the public or Ship Hours.
• Business transfers. If we're involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that deal, subject to this policy. We'll tell you before your data becomes subject to a different privacy policy.
• With your consent or at your direction, in any other case.

06International transfers

We're based in India, and some of our service providers store or process data in other countries, such as the United States or the European Union. When we transfer personal data outside India, we do so in line with the DPDP Act and won't transfer it to any country the Government of India has restricted.

When we transfer personal data from the EEA, UK or Switzerland to countries that are not recognised as providing adequate protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK addendum). You can contact us for more information.

07How long we keep it

We keep personal data only as long as we need it for the purposes above, or as the law requires:

• Waitlist data: until you get an account, ask to be removed, or we decide not to launch. After that, we delete it.
• Account, profile and matching data: while your account is active. When you delete your account or withdraw consent, we delete or anonymise it within 30 days, unless we need to keep some of it for a reason below.
• Session metadata: while your account is active, so we don't re-match you with the same people and can handle safety issues. After that we delete it, or keep it only in de-identified form.
• Safety reports and enforcement records: as long as reasonably necessary to protect members and prevent banned users from returning, and to deal with legal claims.
• Logs and backups: for limited periods, including any minimum period required by law (for example, under the DPDP rules). Backups are overwritten on a rolling basis.

08Security

We use reasonable security safeguards to protect personal data, including encryption in transit (HTTPS), access controls that limit who can see data, and providers with strong security practices. No system is completely secure, though, so we can't guarantee absolute security.

If a personal data breach happens, we'll notify affected users and the Data Protection Board of India as the DPDP Act requires, and other regulators where applicable.

09Your rights

Your rights under the DPDP Act

• Access: get a summary of the personal data we process about you, how we process it, and who we've shared it with.
• Correction and completion: correct inaccurate or misleading data, complete incomplete data and update your data.
• Erasure: ask us to delete your personal data when it's no longer needed for the purpose you gave it for, unless we must keep it by law.
• Withdraw consent: withdraw your consent at any time, as easily as you gave it. We'll then stop processing (and ask our providers to stop processing) your data within a reasonable time, unless the law allows or requires otherwise.
• Grievance redressal: complain to our Grievance Officer (see below). If you're not satisfied with our response, you can complain to the Data Protection Board of India.
• Nomination: nominate another person to exercise your rights for you if you die or become incapacitated.

If you're in the EU, EEA or UK (GDPR)

You also have the right to access, rectify and erase your data; restrict or object to processing (including processing based on legitimate interests); data portability; withdraw consent; and lodge a complaint with your local data protection supervisory authority.

If you're a California resident (CCPA/CPRA)

You have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of its sale or sharing (we don't sell or share it). We won't discriminate against you for exercising these rights. We collect the categories listed in “What we collect”, for the purposes in “Why we use it”, and disclose them only to the recipients in “Who we share it with”. You can use an authorised agent to make a request.

How to exercise your rights

Email us at the privacy contact in section 1, or use account settings where available. We may need to verify your identity before acting on a request. We'll respond within the time required by applicable law, and in any case within 30 days. We don't charge for reasonable requests.

10Children

Ship Hours is for adults only. You must be 18 or older to use it. Under the DPDP Act, anyone under 18 is a child, and we don't knowingly collect personal data from children. If we learn that we have, we'll delete it and close the account. If you think a child has given us personal data, please contact us.

11Your choices

• Profile: you can view and edit your profile and matching preferences, and remove profile links, at any time.
• Emails: you can unsubscribe from product updates using the link in any such email. We'll still send essential service messages while you have an account.
• Cookies: you can manage non-essential cookies through our cookie settings (where shown) and your browser.
• Leaving: you can leave the waitlist or delete your account by contacting us.

12Grievance Officer

In line with the DPDP Act and India's Information Technology rules, we have appointed a Grievance Officer to handle complaints about how we process personal data, and about content or conduct on the Service.

Please include your name, the email address linked to your Ship Hours account (if any), and a description of the issue. If you're not satisfied with the outcome, you may escalate your complaint to the Data Protection Board of India.

13Changes to this policy

We may update this Privacy Policy as Ship Hours evolves or as the law changes. We'll update the “Last updated” date at the top, and if a change is material, for example a new purpose for using your data, we'll notify you in advance by email or in the product and, where required, ask for your consent again.

14Contact us

Questions or requests about your privacy? Reach us at: