Privacy Policy

The data controller responsible for your personal information is:

This Privacy Policy applies to all personal data processed through the xplor platform, including yacht discovery, crew profiles, marine services, Yi-1, and the introduction of prospective clients to yacht industry professionals.

2.1 Information you provide directly. We collect personal information when you register for an account, complete your profile, submit an enquiry, list or claim a yacht, submit verification documents, make or receive payments, contact support, or participate in surveys or promotions.

This may include: full name, email address, phone number, date of birth, nationality, government-issued identification (passport, visa), employment documentation, maritime certifications (STCW, ENG1), yacht and vessel details, banking and payment information, and any other information you choose to provide.

2.2 Information collected automatically. When you access the platform, we may automatically collect device information (type, operating system, unique identifiers), IP address and approximate location, browser type and version, usage data (pages visited, features used, time spent), referral source, and cookies and similar tracking technologies.

2.3 Financial information. For payment processing and revenue participation disbursements, we collect bank account details, payment card information, and transaction history. Payment processing is handled by our secure third-party processor, Stripe, in accordance with PCI-DSS compliance standards. xplor does not store full payment card numbers on its servers.

2.4 Enquiry data. Where you submit a charter or sales enquiry, we collect the details of your requirement, the vessels you have indicated an interest in, and a record of which professional your enquiry was passed to and when.

2.5 KYC and compliance data. To comply with applicable Know Your Customer (KYC), Anti-Money Laundering (AML), and sanctions screening requirements, we may collect and process identity verification documents, tax identification numbers, and screening results.

We process your personal data on one or more of the following legal bases:

• Contract performance. Processing necessary to perform our contract with you, including account management, responding to your enquiry, and passing your enquiry to a professional able to fulfil it.
• Legitimate interest. Processing necessary for our legitimate business interests, including platform security, fraud prevention, service improvement, and analytics — where those interests are not overridden by your data protection rights.
• Legal obligation. Processing necessary to comply with applicable laws, including UAE data protection requirements, KYC/AML regulations, tax reporting obligations, and records retention requirements.
• Consent. Where you have given explicit consent, including for marketing communications and optional analytics cookies. You may withdraw consent at any time.

We use the information we collect to:

• Create and manage your account and platform profile.
• Process charter bookings and related transactions.
• Pass your enquiry to a licensed professional able to respond to it, and maintain a record of that introduction.
• Verify your identity and credentials for programme enrolment and KYC/AML compliance.
• Send administrative communications, updates, and security alerts.
• Respond to your enquiries, comments, and support requests.
• Monitor and analyse usage trends to improve platform services.
• Detect, prevent, and address fraud, technical issues, and security threats.
• Comply with legal obligations and enforce our terms.

We may share your information in the following circumstances:

5.1 Service providers. With third-party vendors who perform services on our behalf, including payment processing (Stripe), cloud hosting, data analytics, email delivery, identity verification, and customer support. These providers are contractually required to protect your information and may only use it for the purposes we specify.

5.2 Introductions to professionals. Where you submit a charter or sales enquiry, we may pass your name, contact details and the details of your enquiry to a licensed broker, central agent or other yacht industry professional (a "Professional") so that they can respond to you. We rely on the performance of our contract with you, and on our legitimate interest in operating an enquiry service, as the lawful basis for this disclosure, and we will seek your consent first where consent is required. We pass your details only to Professionals who have executed the Standing Introduction Agreement. Once your details are passed, that Professional becomes an independent controller of your personal data, is responsible for its own compliance with applicable data protection law, and must provide you with its own privacy notice. xplor is not responsible for how a Professional subsequently processes your data. Professionals may be located outside the United Arab Emirates and outside the European Economic Area; where that is the case, the transfer mechanisms described in Section 10 apply.

5.3 Verifying introductions. We keep a record of each introduction, comprising your name, the requirement described, the date and time, and the identity of the recipient. We may contact you to confirm whether a charter or sale proceeded and with whom, in order to verify whether an introduction fee is payable by the Professional. You are under no obligation to respond, and your response has no effect on any transaction you have entered into. You may object to your details being passed to a Professional, or withdraw consent where consent is the basis relied upon, by contacting privacy@xplor.io — this will mean we cannot pass your enquiry to anyone able to fulfil it.

5.4 Legal requirements. When required by law, regulation, court order, or legal process, or to protect the rights, property, or safety of xplor, our users, or the public.

5.5 Business transfers. In connection with any merger, acquisition, sale of assets, financing, or transfer of all or a portion of our business, your information may be transferred to the acquiring entity.

5.6 With your consent. Where you have given explicit consent to share your information for a specific purpose.

We do not sell your personal information to third parties.

We use cookies and similar technologies to collect information about your activity on the platform.

6.1 Essential cookies. Required for core platform functionality, including authentication, session management, and security. These cannot be disabled.

6.2 Analytics cookies. Help us understand how visitors interact with the platform to improve user experience. These may be disabled.

6.3 Preference cookies. Remember your settings and preferences for future visits.

You can control cookies through your browser settings. Disabling certain cookies may limit platform functionality. For detailed information, see our Cookie Notice at xplor.io/cookies.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including:

• TLS encryption for all data in transit.
• Encryption of sensitive data at rest (including banking details and identity documents).
• Role-based access controls and multi-factor authentication for platform administration.
• Regular security assessments and vulnerability testing.
• Employee and contractor training on data protection obligations.
• Incident response procedures for data breach detection and notification.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is fully secure. We cannot guarantee absolute security but will notify you promptly in the event of a data breach that affects your rights, as required by applicable law.

Depending on your location and applicable data protection laws (including the EU General Data Protection Regulation and UAE Federal Decree-Law No. 45 of 2021), you may have the following rights:

• Access. Request a copy of the personal information we hold about you.
• Rectification. Request correction of inaccurate or incomplete data.
• Erasure. Request deletion of your personal information, subject to legal retention requirements.
• Restriction. Request that we restrict the processing of your data in certain circumstances.
• Portability. Request transfer of your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest grounds.
• Withdraw consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Marketing opt-out. Unsubscribe from marketing communications at any time using the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact us at privacy@xplor.io. We will respond within thirty (30) days of receiving your request. We may request identity verification before processing your request.

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

9.1 We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with legal obligations.

9.2 Specific retention periods include:

• Account data: retained for the duration of your account and for ninety (90) days after deletion, except where longer retention is required by law.
• Introduction and financial records: introduction records, invoices and payment records are retained for the tail period set out in the Standing Introduction Agreement plus three (3) years, and in any event for a minimum of seven (7) years where required to comply with tax, audit, and regulatory requirements.
• KYC/AML records: identity verification documents and screening results are retained as required by applicable UAE and international regulations.

9.3 When data is no longer required, it is securely deleted or anonymised. Anonymised data that cannot be used to identify individuals may be retained indefinitely for statistical and analytical purposes.

10.1 xplor is based in the United Arab Emirates. Your information may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards.

10.2 When we transfer personal data outside the UAE or the European Economic Area, we implement appropriate safeguards including standard contractual clauses approved by relevant authorities, adequacy decisions, or other lawful transfer mechanisms to ensure your information receives adequate protection.

10.3 Our primary data hosting is provided by services operating under industry-standard security certifications (SOC 2, ISO 27001).

Our services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@xplor.io and we will take steps to delete such information.

The platform may contain links to third-party websites or services that are not operated by xplor. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access through the platform.

13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or for operational reasons.

13.2 Material changes will be communicated by posting the updated policy on the platform and updating the effective date. Where required by law, we will notify you directly (for example, by email) before changes take effect.

13.3 Your continued use of the platform after the updated policy takes effect constitutes acceptance of the revised terms.

14.1 This Privacy Policy is governed by the laws of the United Arab Emirates, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and where applicable, the EU General Data Protection Regulation (GDPR).

14.2 Any disputes relating to this Privacy Policy shall be resolved in accordance with the dispute resolution provisions in the xplor Terms of Service.

14b.1 What we collect. If you choose to connect an Instagram Business or Creator account to your xplor listing, we collect and store your Instagram username (handle), Instagram Business Account ID, a secure access token used to retrieve your media, and the URLs and captions of your recent public posts for display on your listing page. We do not collect your Instagram password, private messages, follower lists, or any data beyond what is necessary to display your public feed.

14b.2 How we use it. Instagram data is used solely to display your recent public posts on your xplor listing page. We do not analyse, sell, or share your Instagram data with third parties. Your posts are refreshed automatically on a periodic basis using your stored access token.

14b.3 Legal basis. Processing is based on your explicit consent, given at the time you initiate the Instagram connection via our OAuth flow. You may withdraw consent at any time by disconnecting your Instagram account.

14b.4 Disconnecting. You can disconnect your Instagram account at any time from your listing management page. Disconnecting immediately deactivates your access token and removes your Instagram feed from your listing. Residual data (such as access logs) may be retained for up to 30 days before permanent deletion.

14b.5 Data deletion. To request permanent deletion of all Instagram data we hold, visit xplor.io/legal/instagram-deletion or email privacy@xplor.io. We will action all deletion requests within 30 days.

14b.6 Meta Platform compliance. Our use of the Instagram API is governed by Meta's Platform Terms and Developer Policies. We request only the minimum permissions required to display your public feed (instagram_business_basic). We do not request permissions to publish content, send messages, or access private data on your behalf.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

We aim to respond to all privacy-related enquiries within thirty (30) days.