Privacy Notice
- For an API account we keep your email address, your keys (as one-way hashes), your plan and how many credits and requests you use each day.
- If you watch vessels or ports, we keep your watch lists and email settings, send the alerts and summaries you choose through our email provider and, if you make one, keep your private calendar link.
- Payments are handled by Paddle. We never see your card details.
- One cookie only: the sign-in session. No advertising, no tracking cookies.
- Our server is in Germany. Write to hello@gangway.app to see, correct or delete what we hold.
1. Who is responsible
Motto Marine International, SARL, SIREN 941 627 929, RCS Dunkerque, 14 Rue de Furnes, 59122 Hondschoote, France, runs Gangway AIS and is the controller of the personal data described here. Contact for privacy questions and requests: hello@gangway.app.
This notice covers the Gangway AIS API, its account dashboard and its documentation. The live chart at ais.gangway.app has its own privacy notice.
2. What we keep and why
| What | Why | Legal basis |
|---|---|---|
| Email address | Your account, sign-in links, messages about your account, plan and these terms | Contract |
| Name and company | Your name, to greet you and to show in your account. Your company only if you give it (it is optional) and what you said you want to do (watch vessels and ports, the Data API or both), to open the right page first | Contract |
| API keys | Only a one-way hash and the first characters, to recognise a key and let you revoke it. A key's label if you give one | Contract |
| Plan and Paddle references | Your plan, its status and the Paddle customer and subscription numbers so a payment unlocks the right account | Contract |
| Usage totals | Credits and requests per key, per day and per month, to count credits, show your dashboard and stop abuse. We do not keep a log of each request or of what you asked | Contract |
| Single reports you buy | Each report you buy or receive with your plan: its kind, the vessel, port or period it covers, its price and any discount, the box you ticked at checkout with its wording and time, the Paddle transaction number and the report itself with its verification code so you can open it again and anyone can check its code | Contract; legal obligation for the payment records |
| Account dates | When the account was made, the last sign-in and any request to delete it | Contract; legitimate interest in security |
| Password and two-step check | Your password only as a slow one-way hash, never as typed. If you switch on the two-step check: the secret your authenticator app shares with us and your recovery codes, the codes only as one-way hashes. A count of wrong tries, to lock sign-in for a while after too many | Contract; legitimate interest in security |
| Sign-in links and sessions | Only one-way hashes. A sign-in link works once, for 15 minutes. A session lasts 30 days | Contract; legitimate interest in security |
| Internet address | Held in memory only, to limit sign-in attempts and requests per minute. Not written to our database | Legitimate interest in security |
| Server access logs | Like every web server, ours records each request: internet address, page or path, time and browser type. Keys and sign-in links are not written to the logs | Legitimate interest in running a safe service |
| Watch lists | The vessels and ports you watch, your own labels for them, the filters and alerts you choose for each and when you added them, to tell you what happens to them | Contract |
| Alert and summary emails | Your email settings (alerts at once, weekly summary, morning line-up and its hour) and the emails we send you from them. Each email holds vessel and port events, never your other data | Contract |
| Calendar link | If you make one, a private address for a calendar feed of expected arrivals at your watched ports and of your watched vessels. Anyone with the link can read the feed so keep it private; a new link stops the old one at once | Contract |
| Receiver hosts | If you host a receiver: the rough place you gave for the station (never shown), its station number, the host agreement version you accepted and when, your station's daily hours online and vessel counts, the result of our daily check, any kit request and, if you switch it on, the name to show on our coverage page | Contract |
| Emails you send us | To answer you | Legitimate interest; contract where it is about your account |
We do not sell your data. We do not use it for advertising. We send no newsletters unless you ask for them.
3. Cookies and your browser
- One cookie: the sign-in session for the dashboard. It is needed to keep you signed in so it needs no consent. It lasts 30 days, is renewed each day and ends when you sign out.
- Your light or dark choice is kept in your own browser (
gw-theme). It never reaches us. - Our pages load their fonts from Google Fonts. Your browser then asks Google's servers directly. Google then sees your internet address the way any website you open does.
- When you open checkout, the dashboard loads Paddle's checkout script from Paddle.
4. Who helps us
| Who | What they do | Where |
|---|---|---|
| Paddle.com | Our reseller and merchant of record. Paddle takes payments, charges tax, sends invoices and handles refunds. For the payment Paddle acts as a controller under its own privacy notice (paddle.com/legal/privacy). It tells us your plan and its status | United Kingdom and its own providers |
| Hetzner Online | Rents us the server that runs the API and keeps the account database | Germany |
| Resend | Sends the sign-in emails, the receipts for single reports with the report attached and the alert, summary and line-up emails you choose, on our instructions as our processor. It receives your email address and the content of each email | United States |
| Cloudflare | Our domain names and mail forwarding | United States and worldwide |
They act on our instructions, except Paddle for the payment as said above. Where a provider is outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (the United Kingdom; the EU-US Data Privacy Framework for certified companies) or on the Commission's standard contractual clauses.
5. How long we keep it
- Account, keys, plan and usage totals: while the account is open. When you ask us to delete it, we delete it within one month, except what we must keep by law.
- Watch lists, email settings and calendar link: while the account is open. A vessel or port you remove, or a calendar link you switch off or replace, is deleted from the account at once. They are deleted with the account.
- Alert and summary emails: we keep no copy of the emails we send. We note only when the last one went so nothing is sent twice. Resend keeps its delivery records as our processor, under our agreement with it.
- Sign-in links: deleted one day after they expire. Sessions: deleted when they expire.
- Internet addresses for limits: in memory, for up to one hour.
- Server access logs: 14 days.
- Emails: as long as the matter is open and a reasonable time after.
- Invoices and payment records are kept by Paddle as merchant of record, under its own rules.
6. Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to a use of it or to receive it in a common format. You can also ask for deletion of your account from the dashboard. Write to hello@gangway.app from your account email. We answer within one month.
If you are not satisfied, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of your own country.
7. Security
We keep passwords, recovery codes, keys, sign-in links and sessions only as one-way hashes so they cannot be read back from our database. Sign-in links work once. The session cookie is sent only over HTTPS and cannot be read by scripts. Access to the server is limited to us.
8. Vessel data
The API answers with what vessels broadcast about themselves over AIS: identity, position, course, speed and voyage details. This is about vessels, not about you as a customer. Our terms forbid using the Service to follow private persons.
9. Changes
We may change this notice. We publish the new version on this page with its date and tell account holders by email about important changes.
10. Contact
Motto Marine International, 14 Rue de Furnes, 59122 Hondschoote, France. hello@gangway.app