Privacy Policy

1. What we collect

• Operator account data: name, email, organization details, and role, mirrored from our authentication provider (WorkOS).
• Customer/tenant PII: names, emails, phone numbers, addresses, vessel/RV details, and emergency contacts entered by the operator or submitted by the customer via the portal.
• Financial metadata: invoice amounts, due dates, and payment method labels (e.g. "card", "check"). Slip Skipper never stores raw card or bank account numbers — those are handled entirely by Stripe.
• Documents: contracts, insurance certificates, registrations, and photos uploaded by the operator or customer, stored in Cloudflare R2 under an org-scoped, access-controlled path.
• Usage & delivery logs: email/SMS send records (for delivery troubleshooting and plan quota enforcement) and standard web server logs.

2. How we use it

Data is used solely to operate the Software for the Client: rendering the operator dashboard, sending reminders/invoices/receipts, generating contracts, and powering the customer self-service portal. We do not sell customer or operator PII, and we do not use it for advertising.

3. Sub-processors

We share data with the following third parties strictly to deliver the Software: Neon (database hosting), Cloudflare (file storage), Stripe (payment processing and subscription billing), WorkOS (authentication), and, where the operator has connected them, Intuit QuickBooks Online and an e-signature provider. Each is bound by its own data-processing terms.

4. Your rights (GDPR/CCPA)

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. Operators can export their own organization's data at any time from Settings, and customers can request corrections through their portal or by contacting the marina operator directly, since the operator — not Slip Skipper — is the data controller for customer records. Slip Skipper acts as the data processor. A Data Processing Addendum is available on request for operators who require one.

5. Data retention & deletion

See our Data Retention Policy for how long data is kept after a subscription is cancelled, and how activity logs age out by plan tier.

6. Security

Access to operator and customer data is scoped per-organization and authorized by role. Documents are stored behind an authenticated proxy rather than a public bucket. Payment card data never touches our servers — it is handled entirely within Stripe's PCI-DSS-compliant environment.