reBOAT Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how reBOAT, Dejan Grepo, Split, Croatia ("reBOAT", "we", "us"), processes personal data when users access the reBOAT website, booking pages, iOS application, Android application and related services. operated by WEBLAB IT, vl

1. Data we process

Depending on the features used, reBOAT may process: name, email address and phone number; account and user identifiers; business and profile information; reservation, guest and purchase/transaction history; boat, tour, service, availability and other user-entered content; photographs or videos uploaded to the service; payment status and transaction references; push-notification tokens, device model, platform and app version; and precise location when a user chooses a current-location feature or when supported device/payment functionality requires location permission.

reBOAT may also process technical and security information reasonably necessary to operate, Data processed only on a user's device and not transmitted to reBOAT is not treated by reBOAT as collected server-side data. secure and troubleshoot the service

2. How data is collected

Data is provided directly by users and rental operators, Because the mobile applications contain web-based reBOAT functionality, data submitted through those in-app web views is processed in the same way as data submitted through the reBOAT web service. created through bookings and account activity, received from supported payment and authentication providers, or transmitted by the mobile applications when a user enables a feature such as push notifications or current location

3. Purposes and legal bases

We use data to create and authenticate accounts; provide booking, calendar, service, ticket, employee and customer-management features; display operator services; process and reconcile payments; provide Virtual POS and supported Tap to Pay functionality; send service and reservation notifications; provide location-based functionality requested by the user; prevent fraud and abuse; maintain security; provide support; keep legally required business and transaction records; and comply with legal obligations.

Depending on the processing activity, the legal basis may be performance of a contract, steps requested before entering into a contract, compliance with a legal obligation, legitimate interests in operating and securing the service, or consent where consent is required.

4. Payments and Stripe

Payment processing, Where card details are entered into or read by Stripe's payment interfaces and reBOAT does not receive the full payment-card number or security code, those full card credentials are handled by Stripe rather than stored by reBOAT. reBOAT may receive and retain transaction identifiers, amount, currency, status, payment references, customer details returned for a transaction, connected-account information and other records necessary to operate and reconcile the payment. Stripe Connect, Virtual POS and supported card-present/Tap to Pay flows may be provided by Stripe

5. Location

Precise location may be requested when a user explicitly chooses a current-location feature, Location access is subject to device permission controls. reBOAT does not use location for third-party advertising or cross-app advertising tracking. for example to find offers relative to the user's current position, and may also be required by supported payment-device functionality such as Tap to Pay/Stripe Terminal

6. Push notifications and device information

When push notifications are enabled, Push notification infrastructure may involve Apple Push Notification service (APNs) and Google Firebase services. reBOAT may store a Firebase Cloud Messaging (FCM) registration token together with the reBOAT user/account identifier, platform, app version and device model so that operational notifications can be delivered to the correct signed-in user

7. Photos and other user content

Rental operators and authorised users may upload photos and enter descriptions, This content is processed to provide reBOAT functionality and, where the user chooses to publish an offer, relevant content may appear on public booking or service pages. service details, reservation notes and other business content

8. Service providers and recipients

Data may be processed by service providers only as needed to provide reBOAT, We also disclose data where required by law or where reasonably necessary to protect users, prevent fraud or protect the security and integrity of the service. reBOAT does not sell personal data and does not use personal data for third-party advertising tracking. including hosting/infrastructure providers, Stripe for supported payment services, Google/Firebase for supported notification or authentication infrastructure, Google Maps services where map/location features are used, and email or communications infrastructure used to deliver transactional messages

Third-party providers process data under their own applicable terms and privacy obligations. reBOAT requires providers used on its behalf to protect personal data appropriately for the services they provide.

9. International transfers

Some service providers may process data outside the user's country or the European Economic Area. Where required by applicable data-protection law, appropriate transfer safeguards are used.

10. Retention

Personal data is retained only for as long as reasonably necessary for the purposes described in this policy. Account/profile data is normally retained while the account is active and until deletion is completed. Transaction, When retention is no longer required, data is deleted or anonymised where reasonably practicable. invoice, payment, booking, security and audit records may be retained for longer where required by tax, accounting or other law, or where necessary for fraud prevention, security, dispute resolution or legal claims

11. Account deletion and privacy rights

Users may request access, Account deletion can be initiated from the reBOAT application where available or through the public correction, deletion, restriction or portability of personal data, object to certain processing, or withdraw consent where applicable, subject to applicable law Delete Account & Data page. Additional privacy choices and request methods are available at Privacy Choices.

12. Security

reBOAT uses reasonable technical and organisational measures designed to protect personal data against unauthorised access, No internet or electronic storage system can be guaranteed to be completely secure. alteration, disclosure or loss

13. Children

reBOAT is a business and tourism-management service and is not directed to children. We do not knowingly offer reBOAT business accounts to children.

14. Changes to this policy

We may update this policy when features, The current version and its effective date will remain available at this URL. providers, legal requirements or processing practices change

15. Contact

Privacy questions and requests can be sent to info@reboat.app. Operator: WEBLAB IT, Dejan Grepo, Krbavska 20, Split, Croatia. vl