Privacy Policy – Njord Analytics

1. Introduction & Scope

This Privacy Policy explains how Njord Analytics GmbH (“Njord,” “we,” “us,” or “our”) collects, uses, and protects personal data in connection with Njord Analytics (the web service) and Njord Player (the desktop application), together the “Services,” as well as our website.

This Policy should be read together with our Terms of Service, which govern your use of the Services. Where a term is defined in the Terms of Service (such as “User Data”), it has the same meaning here.

2. Who Is Responsible (Data Controller)

The data controller responsible for your personal data is:

Njord Analytics GmbH Njord Analytics GmbH, Lise-Meitner-Str. 5, 04178 Leipzig, Germany Handelsregister: Amtsgericht Charlottenburg, HRB 201352 B Email (privacy matters): privacy@sailnjord.com Email (general support): support@sailnjord.com

2.1 Data Protection Officer

We are not required to appoint a Data Protection Officer under Article 37 GDPR, as our processing does not meet the relevant thresholds (e.g., core activities do not consist of large-scale, regular, and systematic monitoring of data subjects, or large-scale processing of special category data). If this changes, we will update this Policy accordingly. For any data protection question, contact privacy@sailnjord.com.

3. Personal Data We Collect

3.1 Account & Billing Data

Name, email address, and password (or authentication credentials) when you register;
Billing details such as billing address and VAT identification number, where applicable;
Payment method details — processed directly by Stripe; we do not store full card numbers ourselves (see Section 5);
Correspondence with us, e.g., support requests.

3.2 User Data (Sailing & Boat Data)

As described in our Terms of Service, you upload boat and sailing performance data to Njord Analytics (e.g., GPS tracks, instrument data) and may load video and performance data into Njord Player. Some of this data may constitute personal data — for example, GPS tracks reflecting an identifiable individual’s location, or video footage that incidentally captures identifiable people on board. We process this data as your processor, on your instructions, to provide the Services; you remain responsible, as between you and any third parties shown in such data (e.g., crew or guests), for having an appropriate basis to capture and upload it.

3.3 Usage & Technical Data

Log data, IP address, device/browser information, and timestamps generated by your use of the Web Service;
Error and crash reports collected via Sentry (see Section 5);
Licensing and usage records from Njord Player, including pay-per-use tallies (see Terms of Service, Sections 5–6).

3.4 Website Data

Our public website is hosted on Vercel (separately from the Services themselves, which are hosted on AWS). We use Vercel Web Analytics to understand website traffic; it does not use cookies, identifies visitors only via a short-lived hash that is discarded after 24 hours, and reports aggregated statistics that are not designed to identify an individual visitor.

We advertise the Services through Google Ads. We do not embed Google’s tracking or conversion-measurement scripts on our website, so Google does not directly collect on-site browsing behavior through sailnjord.com via our own code. If you reach our website by clicking a Google ad, the ad interaction itself is processed by Google as part of its own advertising service, governed by Google’s own privacy policy, outside our control.

4. Why We Process Your Data, and Our Legal Basis

To create and administer your account, and provide the Services — necessary for performance of our contract with you (Art. 6(1)(b) GDPR);
To process payments and manage billing, including VAT/OSS compliance — contract performance (Art. 6(1)(b)) and compliance with legal obligations such as tax law (Art. 6(1)(c));
To monitor, secure, and troubleshoot the Services (e.g., via Sentry error monitoring) — our legitimate interest in operating a reliable and secure service (Art. 6(1)(f));
To respond to support requests and correspond with you — contract performance and/or our legitimate interest in maintaining the customer relationship (Art. 6(1)(b)/(f));
To comply with legal obligations, such as retaining billing records for the periods required by German tax law — legal obligation (Art. 6(1)(c)).

We do not use your User Data for advertising, profiling, or automated decision-making with legal or similarly significant effects on you.

5. Who We Share Data With

We use the following sub-processors to provide the Services. Each is bound by a data processing agreement requiring them to protect your data and process it only on our instructions:

Amazon Web Services (AWS) — hosting and storage of the Services and User Data. Your data is stored in a database (DynamoDB) that is durably replicated across AWS infrastructure in Germany, the United States, and Australia, to support performance and availability when you access the Services from different regions. This means a persistent copy of your data exists in all three locations, not just a temporary cache.
Stripe — payment processing and billing. Stripe acts as an independent controller for certain payment-related data it processes for its own regulatory compliance purposes (e.g., fraud prevention); see Stripe’s own privacy policy for details.
Sentry — error monitoring and crash reporting for the Services. Sentry stores this data in the United States.
Vercel — hosting of our public website (not the Services themselves), including Vercel Web Analytics for aggregated, cookie-free visitor statistics (see Section 3.4).

We do not sell your personal data, and we do not share User Data with other customers or third parties for their own marketing purposes.

6. International Data Transfers

Your User Data is stored in a database that is durably replicated across AWS infrastructure in Germany, the United States, and Australia — meaning a persistent copy exists in all three locations, not only in Germany. In addition, Sentry stores error and crash report data in the United States, and Stripe may process payment-related data outside the European Economic Area as part of its global payment infrastructure.

Because this means personal data is regularly stored in countries that do not benefit from a European Commission adequacy decision — including the United States and Australia — we rely on appropriate safeguards recognized under GDPR for these transfers, such as the European Commission’s Standard Contractual Clauses, or a sub-processor’s certification under an approved adequacy framework (e.g., the EU–US Data Privacy Framework, where applicable). You may contact us at privacy@sailnjord.com for more information about the safeguards in place for a specific transfer.

7. How Long We Keep Your Data

Account and User Data: retained while your account is active. If you cancel a billing subscription, your data remains accessible in your account. Deleting an individual boat removes that boat’s data after 30 days. Deleting your account entirely must be requested and results in deletion of all boats associated with that account.
Billing records: retained for the periods required by German commercial and tax law (typically up to 10 years for certain accounting records), even after account deletion, to the extent legally required.
Technical/error logs (e.g., Sentry): error and crash report data is retained by Sentry for up to 90 days, and other technical data types (such as logs and performance data) for up to 30 days, in each case reflecting our current Sentry plan tier, after which it is deleted.

8. Your Rights

If you are located in the EEA, UK, or another jurisdiction with similar protections, you have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request erasure of your data, subject to our legal obligations to retain certain records;
request restriction of, or object to, certain processing;
receive a copy of your data in a portable format (data portability);
withdraw consent at any time, where processing is based on consent;
lodge a complaint with a data protection supervisory authority — in Germany, the authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Commissioner for Data Protection and Transparency), Maternistraße 17, 01067 Dresden, Germany.

To exercise these rights, contact us at privacy@sailnjord.com. You can also export your User Data directly via our API at any time, as described in our Terms of Service.

9. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit, access controls, and the use of reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children’s Data

The Services are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@sailnjord.com so we can take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide reasonable notice of material changes (e.g., by email or in-product notice) before they take effect.

12. Contact Us

Njord Analytics GmbH Njord Analytics GmbH, Lise-Meitner-Str. 5, 04178 Leipzig, Germany Email: privacy@sailnjord.com