Privacy policy for Nausto
Nausto is an app for boat owners and crew: maintenance, equipment, logbook, parts, purchases and the chart. This policy explains what personal data we process when you use the app and the website nausto.no, why we do it, where the data is stored and what rights you have. The processing complies with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven).
Data controller
BABO Norge AS is the data controller for the data processed in Nausto. Send questions about privacy and requests for access, rectification or erasure to personvern@nausto.no.
What data we process, and why
- Account and sign-in: email address, password (stored only as a hash), display name and time of sign-in. Used to create and secure your account. Legal basis: the contract with you (GDPR Article 6(1)(b)).
- Last active: when you open or return to the app or the website while signed in, we record the time and whether it was on the web or in the iOS app, keeping only the latest for each. We see this in our admin tools and use it for operations and user support, for example to see whether an account is in use. Legal basis: legitimate interests.
- Your boat and your content: what you record yourself, such as the boat, equipment, meters, maintenance and history, notes, checklists, trips with places, crew and engine time, fuel, shopping lists and purchases, parts and stock, and attachments such as photos, PDFs and video. This may include information about others, for example crew or who paid for a purchase. Used to provide the service. Legal basis: the contract.
- Chart settings: your choices under Chart settings and in the chart layers, such as units, margins, route options and which layers are shown, are stored with your account and the time of each choice, so they follow you on all your devices. The camera mode, “Keep screen awake” and “Share my position” stay on the device. Used to provide the service. Legal basis: the contract.
- Language: the language you choose for the app is stored with your account and the time of the choice, so it follows you on all your devices. If you haven’t chosen one, the app follows the language of your device or browser. The language the app is shown in, including when it follows your device, is also stored in your account’s sign-in details, so emails from Nausto, such as confirmation of your email address and links to set a new password, arrive in the same language. Used to provide the service. Legal basis: the contract.
- Membership and invitations: who is a member of a boat, their role, email address and display name, and invitation links (we store only a hash of the link’s code). Used to share the boat with others. Legal basis: the contract.
- Requests and votes under Roadmap: requests you send, with title and description, and your votes on requests. Requests are shown to everyone signed in to Nausto, without your name or account, and votes are shown only as numbers. Used to prioritise the further development of Nausto. Legal basis: legitimate interests.
- Position: the chart and the instruments use the position from your device when you allow this in the operating system. The position is used only on the device and isn’t sent to us unless you turn on “Share my position” in chart settings (off by default, and the choice applies to your account on that device). Your position, speed and course are then sent to us while the chart is open, and are shown to other Nausto users together with the name, type and length your boat has in Nausto, under an alias, not with your account. While the boat is stationary in a harbour, we don’t store the position, and it isn’t shown. We store only the latest position. If you turn sharing off or sign out, it’s deleted immediately. Offline, or when the app is just closed, it’s no longer shown after 15 minutes, or after one minute in a harbour, and it’s deleted at the next clean-up after that. Legal basis: consent (GDPR Article 6(1)(a)).
- AI scanning of receipts and orders: when you ask for it, a downscaled photo of the receipt or an order document is sent via our server to Anthropic (Claude) or OpenAI (GPT), which suggests a draft you can correct before anything is saved. The server doesn’t keep the photo or document after the scan. For quotas and cost, we store the time, model, number of pages and tokens and the estimated cost of each scan, but not the content. If you enter your own API key, it’s stored encrypted. Legal basis: the contract.
- Technical logs: IP address, time, device or browser type and error messages are recorded by our service providers during sign-in, syncing, file transfer and visits to the website. Used for security, troubleshooting and operations. Legal basis: our legitimate interest in a secure and stable service (GDPR Article 6(1)(f)).
- Security check: when you sign in with a password, sign up, ask for a new confirmation email, reset a forgotten password or change your password, Cloudflare Turnstile checks that you’re a person and not a script, based on your IP address and technical signals from the browser or the app. The check doesn’t read what you type in the form. Used to stop misuse of sign-in and of the emails. Legal basis: legitimate interests. Cloudflare also uses the signals to improve the check, and is a data controller in its own right for that.
- Usage statistics: we count active accounts, boats and types of actions from server data we already have. The app and the website have no tracking or analytics tools. Legal basis: legitimate interests.
An email address and a password are needed to have an account; it’s up to you whether to record anything else. We don’t use the data for marketing, don’t sell it and make no automated decisions that have legal effects for you.
Where the data is stored, and who has access
The data is stored on your device, so the app works offline, and with our data processors. The processors process the data only on our instructions and under a data processing agreement:
- Supabase – database, sign-in and files. Servers in Ireland (EU).
- PowerSync – syncing between device and server. Servers in the EU.
- Cloudflare – the website nausto.no and the chart packs at kart.nausto.no, which the app downloads using your sign-in. Servers in the EU. Cloudflare also provides the security check at sign-in (Turnstile).
- Brevo – email from Nausto, such as confirmation of your email address and links to set a new password. Servers in the EU.
- Domeneshop – email you send to our addresses at nausto.no. Servers in Norway.
- Anthropic and OpenAI – AI scanning, only when you ask for it. Servers in the USA. The content may be kept for up to 30 days for abuse monitoring and isn’t used to train the models.
Transfers to the USA are based on the European Commission’s standard contractual clauses in the data processing agreements and, where the provider is certified, the EU–US Data Privacy Framework.
Apple delivers the app through the App Store and TestFlight and processes data about this under Apple’s own privacy terms. Crash reports are shared with us only if you’ve allowed Apple to do so.
The sources the chart is based on, and the terms for the chart, are at nausto.no/en/kart.
Other members of the boat see what is recorded on the boat. We don’t read the content of boats in normal operation; the admin tools and usage statistics show counts, the account’s email address and when it was last active, and the boat’s name. If you ask for help, we may look at your data to resolve the matter, and such actions are logged.
How long we keep the data
- As long as the account and the boat exist.
- If you delete a boat, the boat’s content and files are deleted.
- If you delete your account, your email address, password, sign-in data and when you were last active are deleted. What you have recorded in a boat that others still use remains as the boat’s history, with you anonymised as “Slettet konto” (deleted account). Your votes under Roadmap are deleted, and requests you have sent remain without any link to you.
- Backups are overwritten within 30 days. Technical logs are normally deleted by our service providers within 30 days.
Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to the processing, and to receive it in a machine-readable format (data portability). You can see and correct most of it yourself in the app. You can export your data as a single file, and delete your account, under More → Sign-in and security, or under Sign-in and security on “Add your boat” when the account has no boat; if the account uses Sign in with Apple, this is done in the app on iPhone, where Apple also withdraws the sign-in. Send other requests to personvern@nausto.no; we reply within 30 days. If you believe the processing breaches the regulations, you can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet.
Cookies and local storage
nausto.no uses no cookies or other storage for tracking or analytics. Your sign-in and the local copy of your data are kept in the browser’s storage because the service needs it to work, including offline; such storage is necessary to provide the service you have asked for. The app stores the same data locally on your device. If you delete the app or the browser data, the local copy is gone.
Changes
If this policy changes, the new version is published on this page with a new date.