Wave & Wake Privacy Policy
Version 2.1 · Effective date: 27th July 2026 · Last updated: 27th July 2026
1. Who is responsible for your data
The data controller is Suibhne Ltd (company number 17300594), a company registered in England and Wales, trading as "Wave & Wake."
- Privacy contact: privacy@waveandwake.com
- Correspondence address: 42 Downsview, Chatham, Kent ME5 0AL
- ICO registration number: ZC203812
This policy explains what personal data we collect, why, how we use it, who we share it with (and who we don't), how long we keep it, and your rights under UK data protection law.
2. The data we collect
You give us
Account data. For a personal account: your name and email address. If you choose to sell, we ask for what is needed at that point (for example, contact details).
Business account data. If you register a business: your name, job title, business name, business address, business registration/VAT number where applicable, business email and phone, and business type.
Listing data. The details, photographs and video you add to an advert. Some listing fields, such as the Hull Identification Number (HIN), are held privately and are not shown publicly; they are visible only to you and to our administrators.
Boat location. Optional. If you choose to add it, we store the coordinates of where the boat lies, and the corresponding what3words address. This is covered in detail in section 4, because it deserves its own explanation.
Enquiries. If you contact a seller through the Site, we hold the message, the subject, and the phone number you choose to include. Your message and your contact details are passed to that seller so they can reply to you; that is the purpose of the feature. Once passed on, the seller holds your details as a data controller in their own right and must use them only to deal with your enquiry.
Authentication data. If you enable two-factor authentication, we store the data needed to verify your authenticator app. We never see or store your authenticator codes themselves.
We collect automatically
Usage and device data. How you interact with the Site, and basic technical data such as IP address, browser and device type, collected through cookies and similar technologies.
Saved activity. Your saved searches, saved favourites and recently viewed listings, so the Site works for you.
Error and diagnostic data. When something breaks, we receive a technical report so we can fix it. We have deliberately configured this to exclude personal data: the report identifies your account only by an internal reference number, and we strip out email addresses, names, IP addresses, approximate location, and the contents of anything you were submitting at the time. This data is stored in the European Union.
What we do NOT hold
Card details. We never see or store your card number. Payments are handled entirely by Stripe, and the card details go to them, not to us. We hold only a record that a payment happened, its amount, and a reference.
Photo metadata. Photographs often carry hidden metadata, including the GPS coordinates of where the picture was taken. We strip this out of every photograph before it is stored, so uploading a photo of your boat does not silently disclose where it was taken.
Children's data. Wave & Wake is not directed at children. You must be at least 18 to hold an account or advertise a boat, and we do not knowingly collect data about children.
We try to collect only what we need. If we don't need a piece of information, we would rather not hold it.
3. Why we use your data, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and manage your account | Performance of a contract |
| Publish and manage your adverts | Performance of a contract |
| Show the location of a boat on a listing and on the map, where the seller has provided it | Performance of a contract (it is part of the advert the seller asked us to publish) |
| Operate core features (search, saved items, recently viewed) | Performance of a contract / legitimate interests |
| Pass an enquiry from a buyer to a seller | Performance of a contract |
| Take payment for advertising | Performance of a contract |
| Send service and transactional emails (confirmations, expiry reminders) | Performance of a contract / legitimate interests |
| Generate an AI-assisted draft listing description, at your request | Performance of a contract |
| Keep records of your acceptance of our terms and policies | Legal obligation / legitimate interests |
| Keep the Site secure, prevent fraud and misuse, and diagnose faults | Legitimate interests |
| Improve the Site and understand how it is used | Legitimate interests |
| Send marketing (only if you opt in) | Consent |
Where we rely on legitimate interests, we have considered your rights and only proceed where our interest is not overridden by them.
4. Boat location: how it works, and what is public
This section exists because location is the piece of information most worth being precise about.
It is optional. You can list a boat without giving a location at all.
Why we ask. Buyers need to know roughly where a boat is before travelling to see it, and being able to search a map is one of the most useful things a marketplace can offer.
You decide how precise it is, and we tell you before you choose. We publish the point you place on the map, nothing more and nothing less. We do not adjust, refine or infer it.
Before you set it, the Site tells you plainly:
"This location appears publicly on the map. Place it on your mooring, or a sensible nearby spot on the same water if you prefer."
So the choice is yours and it is an informed one. If you want buyers to find the boat exactly, place the pin on it. If you would rather not publish the precise berth of a valuable and movable asset, place it on a sensible nearby point on the same water; the advert still tells a buyer what they need in order to decide whether to travel, which is the point of the feature. We deliberately do not make that decision for you, because you know your boat, your mooring and your circumstances, and we do not.
What we do not infer. A boat's location is not an indication of where its owner lives. Boats lie in marinas, moorings and boatyards, frequently a long way from their owner's home. We do not treat a boat's location as a home address and we do not use it to derive one. (Small trailered craft kept at home are the exception; if that applies to you, consider whether to give a location at all, or give the location of a nearby launch point instead.)
Who we send it to. To turn coordinates into a what3words address (and back), we send the coordinates to what3words. We do not send them your name, your email, or anything that identifies you, only the point on the map. The coordinates are also held in our search index (Meilisearch, hosted in London) so the map search works.
5. Artificial intelligence (AI)
We use AI tools in three ways, and we want to be open about it.
Building and running the Site. We use AI tools to help develop, maintain and operate Wave & Wake.
Operations. We may use AI tools for internal tasks such as drafting, support and analysis.
Product features. Some features use AI, most visibly generating a draft listing description from the details you enter, and providing price-analysis insights based on advertised-price data.
The specifics. The listing-description feature sends the listing details you have entered to Anthropic (the Claude API) to produce a draft. It does not send your name, your email or your account details. Anthropic does not use data submitted through its API to train its models. Any AI output is a starting point for you to review and edit; you remain responsible for the accuracy of your listing.
Our price-analysis insights are based on advertised-price information, not on identifying you. We do not use your personal data to train third-party AI models. No decision with a legal or similarly significant effect on you is made by automated means.
6. Who we share data with
We share personal data only where necessary, and with providers who act on our instructions under contract. They may not use your data for their own purposes.
| Provider | What it is used for | What it receives | Where the data is stored |
|---|---|---|---|
| Supabase | Our database, file storage, and sign-in | Everything you give us | London, UK |
| Vercel | Hosting the website | Requests to the Site, technical/usage data | London, UK |
| Meilisearch | Powering search and the map | Public listing content, incl. boat coordinates | EU |
| Stripe | Taking payment for advertising | Your card details (direct to Stripe; we never see them), name, email, billing details | US Company, Processes Globally |
| Resend | Sending emails (confirmations, reminders, enquiries) | Recipient email address and the message content | US |
| Cloudflare Stream | Hosting and playing listing videos | Video you upload to a listing | Cloudflare's global network |
| what3words | Converting coordinates to a 3-word address | Boat coordinates only, nothing identifying you | UK |
| Anthropic | Generating draft listing descriptions, at your request | The listing details you entered | US |
| Sentry | Error reporting, so we can fix faults | Technical error reports, scrubbed of personal data (see section 2) | European Union (Frankfurt) |
We also share data where the law requires it, for example to comply with a legal obligation or a valid request from authorities.
We do not sell your personal data.
Our partner rule (important)
We may show you clearly-labelled introductions to partners (finance, insurance, survey, transport). We do not send your personal information to those partners. If you want a partner service, you go to the partner directly, typically through their own portal, and give them your details yourself. The decision, and the data, are yours to give. From that point, the partner is responsible for your data under their own privacy policy.
7. International transfers
Our core data (your account, your listings and your files) is stored in London, UK, and our error-monitoring data is stored in the European Union.
Some providers in the table above process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law: adequacy regulations (which cover the EU/EEA), or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep data
Account data. Kept while your account is active. If you ask us to close your account, it is scheduled for deletion and held for 30 days, during which you can sign in and cancel the request. After 30 days your account and profile are permanently removed, except for the specific records described below, which we keep for the stated periods. This grace period exists so that an accidental, impulsive or unauthorised deletion can be undone.
Listing data. Your advert is yours to manage. When you delete it, or delete your account, the advert and its photos and videos are removed. We do not keep your advert after you have deleted it.
Enquiry messages. When you send an enquiry, it is delivered to the seller, who replies to you directly. We also keep a record of the enquiry (including its subject, message, and any phone number you add) to prevent spam and misuse and to help resolve any dispute. Held for 90 days from the date of the enquiry, then deleted.
Consent and acceptance records. Kept as a lasting record that you agreed to a specific version of our terms, because that is the point of holding them: 6 years after your account closes.
Error and diagnostic reports. Kept for a limited retention period by our error-monitoring provider and then deleted. They contain no personal data beyond an internal account reference.
Legal and financial records. Kept for as long as the law requires, 6 years for accounting and tax records.
When we no longer need personal data, we delete or anonymise it.
9. Your rights
Under UK data protection law you have the right to: be informed; access your data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent where we rely on it.
You do not have to ask us for a copy of your data. You can download everything we hold about you, as a file, from your account settings, at any time, including your profile, listings, payments, enquiries and saved items. You can also request account deletion from the same place (see the 30-day grace period in section 8).
You have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any right, contact privacy@waveandwake.com. We will respond within the time limits set by law.
10. How we protect your data
We take security seriously and we would rather tell you what we do than claim to be "bank-grade," which means nothing.
- Your data is held in a database where access rules are enforced per row, so one user's account cannot read another's.
- You can turn on two-factor authentication on your account. Our own administrator accounts are required to use it.
- We never see your card details; they go directly to Stripe.
- We strip GPS metadata from every photograph before storing it.
- Our error reports are scrubbed of personal data before they leave the Site.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO and, where required, you.
11. Cookies
We use cookies and similar technologies. Some are strictly necessary to make the Site work and to keep you signed in, and these cannot be switched off. Where we measure how the Site is used, we use privacy-friendly analytics that do not use cookies to track you across other websites. Embedded videos are set to their privacy modes, so they do not place tracking cookies unless you choose to play them. We do not currently use advertising or marketing cookies. If we introduce any non-essential cookies in future, we will ask for your consent first through a cookie banner, and you will be able to change your choices there at any time.
12. Changes to this policy
We may update this policy. If we make a material change we will take reasonable steps to tell you, and, where the change affects what you have agreed to, we may ask you to review and accept the updated version.
13. Contact
Questions or requests about your data: privacy@waveandwake.com.