Privacy policy

1. About this policy

This privacy policy explains how SailHQ ("we", "us", "our") handles personal data when you or your sailing club use our software. SailHQ is sailing club management software provided through the website at www.sailhq.app and the application at app.sailhq.app.

SailHQ is a trading name of HQ Software Ltd, a company registered in England and Wales under company number 17341989, whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom. HQ Software Ltd is the legal entity referred to as SailHQ throughout this policy.

Where SailHQ holds personal data on behalf of a sailing club (member records, duty history, communications inside the platform), the club is the data controller and SailHQ acts as a data processor under UK GDPR. Where SailHQ holds data about its own customers (committee admins setting up an account, billing contacts, support emails), SailHQ is the data controller. The wider compliance picture, including processor agreements and how clubs can meet their own GDPR obligations, is covered on the GDPR page.

For any privacy question, contact support@sailhq.app, or write to the Data Protection contact at HQ Software Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.

2. Personal data we collect

We only collect what is needed to run a sailing club and provide the SailHQ service. The categories below cover everything we hold:

Member registration data

Name, email, phone number, postal address, date of birth, household and family relationships, membership category, qualifications relevant to sailing (powerboat, first aid, race officer), boat ownership, and any duty preferences or exemptions you record.

Club admin data

Names and contact details of the committee members who administer the SailHQ account, account preferences, branding choices, and anything you upload during onboarding (logos, member lists, historical results).

Payment data

SailHQ does not currently take card payments through the platform. Subscription billing happens via standard invoicing. If we add a payment processor in future, we will update this policy and notify customers before any change goes live. Bank details and invoice history are kept only for as long as accounting law requires.

Support communications

Emails, in-app messages, and any attachments you send to support@sailhq.app. We keep these so we can pick up an old issue without asking you to repeat yourself.

Technical data

When you use SailHQ, we automatically collect technical information needed to keep the service running: IP address, browser type, device type, pages visited, and timestamps. These end up in usage logs and security logs. We use a small number of essential cookies - see the cookie policy for the full list.

3. Why we collect it (lawful basis)

Under UK GDPR, every piece of processing needs a lawful basis. Ours are:

• Contract: processing your data is necessary to provide SailHQ under the subscription agreement with your club. This covers member records, duty management, account access, and the rest of the core service.
• Legitimate interest: we use technical and security logs to keep the service stable, debug issues, prevent fraud, and improve the platform. We have weighed this against your privacy and limited what we collect to what is genuinely needed.
• Consent: for optional things like product update emails to club admins, you choose whether to opt in. You can withdraw consent at any time using the unsubscribe link or by emailing us.
• Legal obligation: some retention is required by UK law - accounting records, for example.

4. How we store and protect it

SailHQ runs on UK-based hosting infrastructure (Siteground UK). All traffic between your browser and SailHQ runs over HTTPS, so data in transit is encrypted. Passwords are stored as bcrypt hashes - we never see or store plain text passwords. Access to club data is controlled by role-based permissions, so committee members only see what their role needs.

The platform is backed up regularly and automatically through the hosting provider. Backups are retained on UK infrastructure in line with UK GDPR. The full security picture, including incident response and member privacy controls, is on the security page.

5. Who we share it with

SailHQ does not sell personal data and does not share it for advertising. The only third parties involved are sub-processors that help us run the service:

• Siteground: hosting and infrastructure for the SailHQ application and database, located in the UK.
• Open-Meteo: weather data feed used to display sailing conditions on club dashboards. SailHQ sends Open-Meteo your club's coordinates - no personal data is sent.

SailHQ does not currently use any other sub-processors. There is no payment processor in the platform today. If we add one (Stripe, GoCardless, or similar), we will update this policy before any data flows. We will not share personal data with anyone except where required by law - for example, a valid request from law enforcement.

6. International transfers

SailHQ data routinely stays in the UK. We do not transfer member data to non-UK jurisdictions for normal operation. If a transfer ever becomes necessary - for example, if a sub-processor processes data outside the UK - we will only do so where appropriate UK GDPR safeguards are in place (Standard Contractual Clauses, an adequacy decision, or equivalent). We will update this policy and notify clubs before any such change.

7. Your rights

Under UK GDPR you have the following rights over your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your personal data, subject to retention rules below.
• Right to restriction: ask us to pause processing while a query is being resolved.
• Right to portability: receive your data in a portable, machine-readable format such as CSV.
• Right to object: object to processing based on legitimate interest, including profiling.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time.
• Right to complain: lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Where SailHQ acts as a processor (member data held on behalf of your club), the right of access usually starts with your club admin. We will help your club respond promptly. Where SailHQ is the controller (account and billing data), email support@sailhq.app with the subject "Privacy Request" and we will respond within 30 days.

8. Retention

We do not keep personal data longer than needed. Specifically:

• Active member data: retained while the membership is active and the club's SailHQ subscription is in place.
• Lapsed members: retained for up to six years after membership ends, in line with the accounting record retention period under UK law.
• Cancelled accounts: after a club cancels its SailHQ subscription, member data is retained for 90 days to allow export or reactivation, then securely deleted unless retention is required for legal reasons.
• Technical and security logs: typically 12 months.
• Support communications: retained for as long as the club is a customer, plus a reasonable period afterwards.

9. Cookies

SailHQ uses a small number of essential cookies for things like keeping you signed in and remembering preferences. We do not use advertising or tracking cookies. The full list and how to manage them is on the cookie policy page.

10. Children and juniors

Sailing clubs commonly have junior members. SailHQ supports households and family groupings so a parent or guardian can manage a junior member's account. For members under 13, registration is via a parent or guardian, and consent is given by the parent or guardian rather than the child. We collect only what is needed for safe participation - typically name, date of birth, emergency contact, and any qualifications relevant to sailing - and we apply the same protections as for adult members.

11. Changes to this policy

From time to time we may update this policy - for example, if we add a new sub-processor or change how we handle a category of data. When that happens we will update the "last updated" date at the top of this page. Where the change is material, we will notify customers by email or through the platform before the change takes effect, so you have a chance to review it.

12. Contact

For any privacy-related question, data request, or concern:

• Email: support@sailhq.app
• Subject line: "Privacy Request - [your request type]"
• Postal address: available on request
• Response time: within 30 days, as required by UK GDPR

If you are not satisfied with our response, you can complain to the ICO at ico.org.uk.