Skip to content

Legal

Privacy Policy

Last updated:

This page explains what personal data we process when you use Wingo Marine, why, and how you can exercise your rights under Regulation (EU) 2016/679 (GDPR). We do not sell data, show ads or use advertising trackers.

1.The data controller

The controller is FREEVOX S.R.L., registered office Str. Crăițelor 2B, room 2, Otopeni, Ilfov County, 075100, Romania, tax ID (CUI) 43636649, Trade Register no. J23/494/2021 (“Freevox”, “we”).

For any question or request about personal data: office@freevox.ro · +40 770 348 017 · Șos. București–Ploiești 19, Băneasa Business Center, Sector 1, Bucharest, Romania.

2.In short

  • We process only what we need to provide your account, payments, the API and alerts, plus technical logs for security.
  • You enter your card details directly with Stripe; we never see or store them.
  • Passwords are stored only as hashes, API keys only as SHA-256 hashes, webhook secrets encrypted.
  • We use only strictly necessary cookies and preferences saved on your device; traffic statistics (Umami) use no cookies and do not store IP addresses.
  • Account data is hosted in the European Union (Hetzner, Germany).

3.What data we process

Your account

Your name, email address, password (stored only as a cryptographic hash), whether your email address is confirmed, your role (user or administrator), and the creation and last-update dates. Email-confirmation and password-reset links use temporary tokens that expire.

If you sign in with Google, Google sends us your name, email address, profile picture (URL) and Google account identifier, and the OAuth tokens Google issues are kept with your account.

Sessions and security

For each sign-in we keep a session: a random token, its expiry, the IP address and the browser user agent. The IP address is also used, briefly, to rate-limit sign-in attempts and requests to the public directory.

Subscription and payments

Your Stripe customer and subscription identifiers, plan, subscription status and billing period, and any discount or plan granted by an administrator. Card and payment details are collected and processed by Stripe; from Stripe we only receive the payment confirmation and the subscription details.

Credits and API use

The credit ledger (grants, consumption aggregated per endpoint, balances) and API usage statistics. For API keys we keep the name you gave the key, its first characters (prefix), its SHA-256 hash and the dates it was created, last used and revoked — the full key is never stored.

Fleets, webhooks and checks

Fleet names, the vessels you watch (MMSI) and their labels, auto-check settings; webhook URLs, event types, the signing secret (encrypted) and the delivery log (payload sent, response code, error). The log of on-demand position checks is linked to the account that requested them.

Communication with us

Emails you send us and our replies, and the transactional emails we send you (email confirmation, password reset).

Server logs

Like any website, our servers log incoming requests: IP address, date and time, requested URL, response code, referrer and user agent. We use them for security, debugging and abuse prevention.

Traffic statistics

We use Umami, hosted on a server run by Freevox (analytics.wingo.ro). Umami uses no cookies and no local storage, does not store IP addresses and does not follow you across sites. It records aggregated data: the page visited, the referrer, browser, operating system and device type, language and country (derived from the IP at request time, without keeping the IP).

Vessel data (AIS)

The Service processes the AIS messages ships broadcast publicly: MMSI, name, call sign, IMO, type, dimensions, destination, position, speed and course. For commercial ships this is usually not personal data. For small craft and leisure boats, however, the name, MMSI and position may relate to an identifiable individual (the owner or skipper). We treat it as possible personal data: we do not try to identify the people behind vessels, do not build profiles of individuals, and you can exercise your rights — including objecting to a vessel being shown in the public directory — by writing to office@freevox.ro.

4.Purposes and legal bases

  • Creating and running your account, signing in
    Data
    Account, sessions, Google data (optional)
    Legal basis (Art. 6 GDPR)
    Performance of a contract — Art. 6(1)(b)
  • Providing the features: map, fleets, alerts, API, checks
    Data
    Fleets, webhooks, API keys, credits, delivery and check logs
    Legal basis (Art. 6 GDPR)
    Performance of a contract — (b)
  • Payments, invoicing and accounting records
    Data
    Subscription, Stripe identifiers, credit ledger
    Legal basis (Art. 6 GDPR)
    Contract — (b); legal obligation (tax and accounting law) — (c)
  • Transactional emails (confirmation, password reset)
    Data
    Email, name
    Legal basis (Art. 6 GDPR)
    Performance of a contract — (b)
  • Security, fraud and abuse prevention, rate limiting
    Data
    IP, user agent, server logs, sessions
    Legal basis (Art. 6 GDPR)
    Legitimate interest — (f): protecting the Service and its users
  • Aggregated traffic statistics
    Data
    Umami data without identifiers
    Legal basis (Art. 6 GDPR)
    Legitimate interest — (f): understanding how the site is used
  • Answering your requests
    Data
    Correspondence
    Legal basis (Art. 6 GDPR)
    Contract or legitimate interest — (b) / (f)
  • The public ship directory and AIS data
    Data
    Publicly broadcast AIS data
    Legal basis (Art. 6 GDPR)
    Legitimate interest — (f): public information about maritime traffic
  • Defending legal claims, answering authorities
    Data
    The relevant data
    Legal basis (Art. 6 GDPR)
    Legal obligation — (c); legitimate interest — (f)

We do not use your data for marketing without your consent, and we take no decisions based solely on automated processing that produce legal effects for you.

5.How long we keep data

  • Account, fleets, webhooks, API keys, credit ledger
    Period
    As long as the account exists; after a deletion request, within 30 days (except data the law requires us to keep)
  • Sessions
    Period
    Until you sign out or they expire (30 days by default with “Remember me”)
  • Email-confirmation and password-reset tokens
    Period
    Until used or expired (a matter of hours)
  • Webhook delivery log
    Period
    30 days
  • Position-check log (including the HTTP log)
    Period
    30 days
  • Payment and invoicing documents
    Period
    The periods set by accounting law (usually 5–10 years)
  • Server logs
    Period
    [DE COMPLETAT: retention of nginx/application logs, e.g. 30 days]
  • Correspondence
    Period
    As long as needed to resolve it, then at most the general 3-year limitation period
  • Vessel position history (sampled)
    Period
    7 days; each vessel’s latest position is kept until a newer one arrives
  • Raw AIS message archives (Hetzner Storage Box)
    Period
    [DE COMPLETAT: retention of the AIS archives — currently unlimited, within the allocated space]
  • Umami statistics
    Period
    Aggregated data, no personal identifiers

6.Who receives the data

We do not sell or rent personal data. We share it only with the providers we need to run the Service, under contract and only as far as necessary:

  • Hetzner Online GmbH (Germany)
    Role
    Processor — server hosting and storage (Storage Box)
    What it receives
    All Service data, hosted in the EU
  • Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA)
    Role
    Independent controller for payment processing
    What it receives
    Your email, account identifier, the payment details you enter with Stripe
  • Google Ireland Limited (Ireland) / Google LLC (USA)
    Role
    Independent controller — only if you choose Google sign-in
    What it receives
    The sign-in request
  • Email (SMTP) provider
    Role
    Processor — sending transactional emails
    What it receives
    Email address, name, message content — [DE COMPLETAT: name and country of the SMTP provider]
  • OpenStreetMap Foundation (United Kingdom) — tile.openstreetmap.org
    Role
    Map provider for the app
    What it receives
    Your browser downloads the map tiles directly: your IP address and user agent reach this provider
  • OpenFreeMap — tiles.openfreemap.org
    Role
    Map provider for the public directory
    What it receives
    Likewise: your IP address and user agent, when the map loads
  • unpkg.com (public CDN)
    Role
    Serves the MapLibre map library on directory pages
    What it receives
    Your IP address and user agent, when the script loads
  • Advisers (accounting, legal) and public authorities
    Role
    When necessary or required by law
    What it receives
    Only the data strictly needed

For on-demand position checks we use Bright Data (fetching the vessel’s public page) and Mistral AI (France — automated position extraction). They receive only vessel identifiers (MMSI, IMO) and the public page content, no data about you. AIS data comes from aisstream.io and public receiver stations; we send these sources no data about our users.

Umami runs on a server operated by Freevox, so traffic statistics do not go to third parties.

7.Transfers outside the EEA

Account data stays in the European Economic Area. Some transfers may take place through the providers above:

  • Stripe and Google (USA): under the EU-US Data Privacy Framework (the Commission’s adequacy decision of 10 July 2023), for certified companies, and the standard contractual clauses approved by the European Commission.
  • OpenStreetMap Foundation (United Kingdom): under the Commission’s adequacy decision for the United Kingdom.
  • CDNs (unpkg.com, OpenFreeMap) may serve content from locations outside the EEA; only your IP address and user agent reach them, when resources load.

8.Your rights

Under the GDPR (Articles 15–22) you have the right:

  • of access — to know what data we hold about you and get a copy;
  • to rectification — to correct inaccurate data (you can also change your name on the Profile page);
  • to erasure — to have your account and data deleted, except data the law requires us to keep;
  • to restriction of processing;
  • to data portability — to receive the data you provided in a structured, commonly used format;
  • to object — to processing based on legitimate interest, including a vessel being shown in the public directory;
  • not to be subject to a decision based solely on automated processing.

To exercise your rights, write to office@freevox.ro, preferably from your account’s email address. We reply free of charge within one month (extendable by two more months for complex requests, in which case we will tell you). We may ask for more information to confirm your identity.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania · anspdcp@dataprotection.ro · www.dataprotection.ro, or with the authority of your country of residence.

9.Data security

  • All communication with the website and the API is encrypted (HTTPS).
  • Passwords are stored only as hashes, API keys only as SHA-256 hashes; webhook secrets and sensitive settings are encrypted (AES-256-GCM).
  • The session cookie is HttpOnly and Secure; sign-in and the public directory are rate-limited.
  • Access to production data is limited to the Service’s administrators.

If a security breach puts your rights at risk, we notify ANSPDCP within 72 hours and inform you without undue delay, as the GDPR requires.

10.Children

The Service is meant for people aged 18 or over and for businesses. We do not knowingly collect data about minors. If you learn that a minor has given us data, write to office@freevox.ro and we will delete it.

11.Cookies

Which cookies and local-storage keys we use, with the purpose and lifetime of each, is set out in the Cookie Policy.

12.Changes

We may update this policy when the Service or the law changes. The date of the last update is shown at the top of the page; for material changes we will notify you by email or in the app.

This policy is available in Romanian and English; if they differ, the Romanian version prevails.