Privacy Policy

1. Introduction

Cetasol, Inc. ("Cetasol," "we," "us," or "our") is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website at cetasol.co (the "Website"), use our maritime monitoring and analytics platform (the "Platform"), or otherwise interact with us.

This policy applies to all users of our Website and Platform, including customers, prospects, visitors, and business contacts. Please read this Privacy Policy carefully. By accessing or using our Website or Platform, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, additional rights and information applicable to you are described in Section 12 (International Transfers and GDPR Rights).

2. Information We Collect

We collect information in several ways: directly from you when you provide it, automatically when you use our services, and from third parties.

2.1 Information You Provide Directly

When you interact with Cetasol, you may provide us with the following types of information:

• Account registration information: Name, email address, job title, company name, phone number, and billing address when you create a Platform account.
• Contact form submissions: Name, email address, company, message content, and any other information you choose to include when you contact us through our Website.
• Payment information: Credit card details, billing address, and related payment data when you subscribe to a paid plan. Payment card data is processed directly by our PCI-DSS compliant payment processor (Stripe) and is not stored on Cetasol systems.
• Support communications: Information you provide when you submit support tickets, respond to surveys, or communicate with our team.
• Fleet and vessel data: MMSI numbers, vessel names, IMO numbers, fleet roster configurations, and operational data you upload or connect to the Platform.

2.2 Information Collected Automatically

When you access our Website or Platform, we automatically collect certain technical and usage information:

• Log data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of access, and time spent on pages.
• Device information: Hardware model, operating system and version, unique device identifiers, and network information.
• Usage data: Features used, queries made, dashboards accessed, alerts configured, and other interaction data within the Platform.
• Cookies and tracking technologies: As described in our Cookie Policy, we use cookies and similar technologies to collect information about your browsing behavior and preferences. See our Cookie Policy for full details.

2.3 AIS and Maritime Data

Our Platform processes Automatic Identification System (AIS) data. AIS vessel position data is broadcast publicly by vessels under IMO SOLAS regulations and is treated as public maritime safety data. Cetasol aggregates AIS data from licensed commercial providers and satellite networks. We do not consider public AIS position broadcasts to be personal data under applicable data protection law; however, where AIS data is linked to identifiable vessel owners or operators, we handle it in accordance with this Privacy Policy.

3. How We Use Your Information

Cetasol uses the information we collect for the following purposes:

• Platform operation: To provide, maintain, and improve our maritime monitoring and analytics services, including processing vessel data, generating alerts, and delivering API responses.
• Account management: To create and manage your account, process billing, send transactional emails (invoices, password resets, account notifications), and provide customer support.
• Communication: To respond to your inquiries, send service announcements, provide product updates, and â€" where you have opted in â€" send marketing communications about Cetasol products and maritime intelligence content.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents.
• Analytics and improvement: To understand how our Website and Platform are used, identify issues, measure feature adoption, and develop new capabilities.
• Legal compliance: To comply with applicable laws, regulations, legal process, and government requests, including export control, anti-money laundering, and sanctions screening obligations relevant to maritime operations.
• Aggregated analytics: To produce aggregated, de-identified maritime industry research and trend reports that cannot be linked to individual operators or vessels.

4. Legal Basis for Processing (EEA/UK)

For users in the EEA and UK, we process personal data only where we have a lawful basis to do so. Our lawful bases include:

• Contract performance: Processing necessary to deliver the Platform services you have subscribed to, including account management and billing.
• Legitimate interests: Processing for security, fraud prevention, service improvement, and business analytics, where our interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws and regulations.
• Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications or enabling non-essential cookies.

5. Information Sharing and Disclosure

Cetasol does not sell your personal information to third parties. We may share your information in the following circumstances:

5.1 Service Providers

We share information with trusted third-party vendors who help us operate our business and Platform, including:

• Cloud infrastructure providers (Amazon Web Services)
• Payment processors (Stripe)
• Customer support software (Intercom)
• Email delivery services (SendGrid)
• Analytics platforms (Mixpanel, Google Analytics)
• Error monitoring tools (Sentry)

These providers are contractually obligated to process data only as directed by Cetasol and to maintain appropriate security measures.

5.2 Business Transfers

If Cetasol is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of Cetasol, prevent or investigate possible wrongdoing in connection with the service, protect the personal safety of users of the service or the public, or protect against legal liability.

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account data: Retained for the duration of your account and for 3 years after account closure for audit and legal compliance purposes.
• Vessel and AIS data: Retained according to your plan tier (90 days for Starter, 2 years for Professional, configurable for Enterprise). After retention period, data is permanently deleted from production systems within 30 days.
• Contact form and support data: Retained for 2 years from last interaction.
• Log and security data: Retained for 12 months.
• Billing records: Retained for 7 years as required by applicable tax and accounting regulations.

7. Data Security

Cetasol implements and maintains technical and organizational security measures appropriate to the risk of processing personal data. These measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256
• Role-based access controls and principle of least privilege
• Multi-factor authentication for internal systems access
• Regular security assessments and penetration testing
• SOC 2 Type II compliance, reviewed annually
• Incident response procedures with defined breach notification timelines

While we take security seriously, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

8. Cookies

We use cookies and similar tracking technologies to collect and use information about you. For detailed information about the cookies we use and your choices regarding cookies, please see our Cookie Policy.

9. Third-Party Links

Our Website and Platform may contain links to third-party websites and services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites.

10. Children's Privacy

Cetasol's Platform and Website are designed for use by professionals in the maritime industry and are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use our services or provide any personal information to us. If we learn we have collected personal information from a person under 18, we will delete that information promptly.

11. Your Choices and Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal retention obligations.
• Restriction: Request that we restrict processing of your personal information in certain circumstances.
• Portability: Request transfer of your personal information in a structured, machine-readable format.
• Objection: Object to processing of your personal information based on legitimate interests.
• Marketing opt-out: Unsubscribe from marketing communications at any time using the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact us at [email protected]. We will respond to all valid requests within 30 days.

12. International Transfers and GDPR Rights

Cetasol is headquartered in the United States. If you are located in the EEA, UK, or Switzerland, your personal data may be transferred to and processed in the United States. We ensure such transfers comply with applicable data protection law using EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where required.

If you are an EEA or UK resident, you also have the right to lodge a complaint with your local supervisory authority. For EEA residents, your lead supervisory authority is determined by your country of residence. UK residents may contact the Information Commissioner's Office (ICO).

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell; to request deletion of your personal information; to opt out of the sale of personal information (we do not sell personal information); and to non-discrimination for exercising your privacy rights. To submit a request under the CCPA/CPRA, contact us at [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our Website with a revised "Last updated" date, and for significant changes, by sending an email notification to registered Platform users.

Your continued use of our Website or Platform after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy team:

Cetasol, Inc. â€" Privacy Team
Kungsgatan 8, 111 43 Stockholm
Boston, MA 02210
United States
Email: [email protected]
Phone: +1 (617) 555-3400

For EEA/UK data subjects, our EU Representative is available at the same email address with subject line "EU Representative Request."