Privacy Policy
networking.yachts · Version 1.1 · Effective date: 2 November 2026
This policy explains what personal data we process when you use https://networking.yachts (the "Service"), why, on what legal basis, who receives it, how long we keep it and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD).
1. Who is responsible for your data
1.1. The controller of your personal data is Tatiana Mikhailova, acting as an individual (the "Operator", "we", "us"), the operator and author of the Service. "networking.yachts" is the name of the Service, not a company.
1.2. Contact for any privacy question or request: inform@networking.yachts. We have not appointed a data protection officer; write to the email above.
1.3. Our local partners that help us run events (see our Terms, section 6) receive guest data only to admit guests to the events, on our instructions (section 6.2 below).
2. Data we collect
2.1. When you sign in. You sign in with Google. We receive from Google your account identifier, name, profile photo, email address and whether the email is verified (the standard "openid", "profile" and "email" permissions). We do not receive your password, contacts, connections or messages, and we cannot post on your behalf.
2.2. Your professional profile. When you sign in for an event, we prepare your guest card: title, company, city and a short "About". To do this we search public professional sources and may look up your public professional profile using your name and email address (section 4). AI tools extract and edit this information for a consistent style. You can edit your card in Settings at any time.
2.3. What you give us. Profile edits, the professional and personal interests you choose in Settings, the email for tickets and updates, the names of guests you buy tickets for, messages you send to support (including attachments), and the reason you choose when you delete your account. If you give us another person's details, please make sure they know about this policy.
2.4. Your participation. The events you sign in for, your matches and their explanations, the "likes" you give, your invite links and who signed in or bought tickets through them, and your check-in status at events.
2.5. Orders and payments. Your order (event, number of tickets, amounts, currency, booking fee, taxes, order number), payment status and the references Stripe gives us. Card details go directly to Stripe; we never see or store your full card number or security code.
2.6. Cashback and wallets. If you connect a wallet: your public wallet address and network, the signature that proves the address is yours, your cashback records and the transaction hashes of payouts. We never ask for your seed phrase or private keys.
2.7. Technical data. IP address, browser and device information, pages requested and security events, in our server logs. At your first sign-in we use your IP address to estimate your country and city once, to pre-set the event filters on your dashboard. We count visits to event pages, invite links and sign-ins on our own server to understand how people find events; we do not use third-party analytics. If you arrive by a link with campaign labels (utm_source, utm_medium, utm_campaign, utm_term, utm_content), we record these labels with the page view, your sign-in for an event and your order, to know which campaigns bring guests. Ad click identifiers are recorded only with your consent (section 10.4).
2.8. Data we do not seek. We do not ask for sensitive data, such as health, religion or political views. Please do not include it in your profile or messages.
3. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Create your account, sign you in, keep it secure | 2.1, 2.7 | Contract – 6(1)(b) |
| Show your guest card to guests of the same event; AI matching and its explanations | 2.1–2.4 | Contract – 6(1)(b) |
| Prepare your card from public professional sources | 2.2 | Legitimate interests – 6(1)(f): giving every guest a useful card without asking them to fill in forms; you can object |
| Sell tickets, take payments, send tickets, admit you to the event, handle cancellations and refunds | 2.3–2.5 | Contract – 6(1)(b) |
| Cashback and referral cashback | 2.4, 2.6 | Contract – 6(1)(b) |
| Support | 2.3 | Contract – 6(1)(b); legitimate interests – 6(1)(f) |
| Prevent fraud and abuse, protect the Service, check payments | 2.5–2.7 | Legitimate interests – 6(1)(f) |
| Count visits and campaign labels on our own server; improve the Service | 2.7 | Legitimate interests – 6(1)(f) |
| Measure which ads bring guests: ad click identifiers and the advertising cookies and tags of section 10.4 | 2.7, 10.4 | Consent – 6(1)(a), given in the cookie banner |
| Learn why people delete their accounts and improve the Service | 2.3 (the reason for deleting) | Legitimate interests – 6(1)(f) |
| Keep accounting and tax records | 2.5 | Legal obligation – 6(1)(c) |
| Keep the email of a deleted account that has paid orders, for accounting and to answer disputes and chargebacks | email, 2.5 | Legal obligation – 6(1)(c); legitimate interests – 6(1)(f) |
| Emails about new events | Consent – 6(1)(a), given by a checkbox or in Settings | |
| Emails about new guests who fit your goals | email, your matches | Consent – 6(1)(a), given by a switch in the introduction or in Settings |
| Defend legal claims | as needed | Legitimate interests – 6(1)(f) |
Where we rely on legitimate interests, we have weighed them against your rights; you can object (section 9). Messages about your account, tickets and events you joined are service messages, not marketing.
4. Profile preparation and AI
4.1. To prepare your guest card (2.2), we send your name and the professional details we already have to search services, which return public web pages and search results. To find your public professional profile, we may also send your name and email address to a professional-profile lookup service, which returns a link to your public profile and work details. We keep only professional information; contact details found in sources are discarded.
4.2. AI services extract your title, company and short bio from these sources, edit profile text for style, and compare the profiles and interests of guests of the same event to suggest matches and explain them. AI output may be inaccurate: you can edit your card, ask us to correct it, or ask a person to review it.
4.3. Matching does not make decisions that have legal or similarly significant effects on you: it does not decide whether you can buy a ticket or attend an event.
4.4. We do not sell your data, do not use it to target advertising, and do not use it to train general-purpose AI models. We ask our AI providers not to use your data to train their models where they offer this choice.
5. Data from Google
5.1. Google. If you sign in with Google, we receive your name, email address, profile photo and Google account identifier. We use them only to create and secure your account, show your name and photo on your guest card (to other guests of the same event, as first name and initial), send your tickets and service emails, and provide the other features described in this policy. We do not sell Google user data, do not use it for advertising or to build advertising profiles, and do not use it to train general-purpose AI models. People on our team see it only to help you when you ask, for security, or to comply with the law. networking.yachts' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5.2. Deleting this data. When you delete your account (Settings → Account → Delete account), we delete your name, photo, sign-in email, email for tickets and updates, guest card, interests, the link to your Google account, sessions, likes, matches, invite links and wallet. Cashback not yet sent to a wallet is lost (see our Terms, section 3.5). We keep only what section 8 lists: your orders and tickets with the details given at checkout, cashback records and check-ins, linked to an internal account number that carries no name or email; a short deletion report; and, only if you have paid orders, your sign-in email (or, for a payment that completes after the deletion, the email given at that checkout). You can also write to us. Removing the Service's access in your Google account (https://myaccount.google.com/permissions) stops future access but does not by itself delete what we already hold.
6. Who receives your data
6.1. Other guests. Guests who signed in for the same event see your guest card: first name and the initial of your family name, photo, title, company, city and "About", the Instagram and LinkedIn you add in Settings, and the explanation of why you may be worth meeting. They never see your email. Your full family name is shown only if you turn on "Show my full last name" in Settings – then it also appears on the page of your invite link.
If you agree to be an event’s special guest, anyone who opens the event page, signed in or not, sees your name as it appears on your guest card, your title, company and photo, and our line on why you may be worth meeting. We show this only with your consent. To take it down, write to us in the support chat.
6.2. Local partners. Our local partners at an event and their check-in staff receive the names on the tickets, the number of tickets, the order number and check-in status, only to admit guests. They act on our instructions and may not use the data for their own purposes.
6.3. Our team. People who administer the Service and provide support see the data they need for their tasks.
6.4. Service providers. These providers process data for us under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Fornex Hosting S.L. | Server that runs the Service, its database, support chat and backups | EEA (Germany) |
| Stripe | Payments, fraud prevention | EEA (Ireland); Stripe group outside the EEA |
| Brevo | Sending emails | EEA (France) |
| OpenRouter, and the AI model provider it routes each request to | AI: profile preparation, matching explanations | United States and other countries |
| Anthropic | AI: profile preparation, matching | United States |
| Serper; Brave Search | Searching public professional sources | not stated by the provider; United States |
| People Data Labs; FullEnrich (when enabled) | Finding your public professional profile | United States; United States |
| ipwho.is | Estimating country and city from the IP address once, at first sign-in | not stated by the provider |
| Reown (WalletConnect) | Connecting a wallet, only if you choose to | Reown, Inc. – Europe and other countries |
6.5. Independent controllers. Some recipients process data under their own privacy notices: Google (sign-in; with your consent, advertising measurement – section 10.4), Meta (with your consent, advertising measurement – section 10.4), Stripe (for its own fraud prevention and legal duties), your bank or card issuer, and the public BNB Smart Chain network (section 6.6).
6.6. Blockchain. When we send cashback, your wallet address, the amount and the transaction appear on BNB Smart Chain. This public record is visible to anyone and cannot be changed or deleted by us or anyone else.
6.7. Authorities and advisers. We may disclose data where the law requires it, or to establish, exercise or defend legal claims, to our professional advisers bound by confidentiality.
6.8. We do not sell your personal data.
7. International transfers
Some recipients are outside the European Economic Area, in particular in the United States, and our local partners may be in the country where the event takes place, such as the United Arab Emirates. We transfer data outside the EEA only on a basis allowed by the GDPR: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified US companies), the European Commission's standard contractual clauses, or, where no other basis applies, because the transfer is necessary to perform our contract with you – for example, to admit you to an event abroad (art. 49(1)(b)). Write to us for information on the safeguards for a specific transfer.
8. How long we keep data
| Data | How long |
|---|---|
| Account and guest card | While your account is active, and up to 12 months after your last activity or event; sooner if you delete your account |
| Guest list and matches of an event | Visible for 30 days after the event; then kept with your account as above |
| Orders, payments and invoices | As long as Spanish tax and accounting law requires – generally up to 6 years |
| Cashback records | As long as the related order, for accounting and to answer questions |
| Account record after deletion: an internal number with no name or email, to which your orders, tickets, cashback records and check-ins stay linked | As long as the related orders – generally up to 6 years |
| Email after deletion – only if the account has paid orders | Up to 2 years after the deletion, with the deletion report; used only for accounting and to answer disputes and chargebacks, never for marketing |
| Deletion report: date and time, internal account number, the reason you chose and your own words, if you wrote any | 2 years after the deletion |
| Support conversations | Up to 2 years after the conversation ends |
| Marketing consent and its withdrawal | While you are subscribed, and then as long as needed to prove consent |
| Your cookie choice: the choice, the version of the banner text, the time, the coded device identifier and, if you are signed in, your account | While the choice is in force, and then as long as needed to prove it |
| Campaign labels and ad click identifiers of a sign-in or an order | As long as the sign-in record or the order they belong to |
| Server logs | About 14 days; longer only for a specific security incident |
| Backups | Deleted data leaves backups as they rotate |
| Blockchain transactions | Permanent – they are public and cannot be erased |
After these periods we delete data or make it anonymous. We may keep data longer while a legal claim or dispute requires it.
9. Your rights
9.1. You have the right to access your data and get a copy, correct it, have it deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests – including the preparation of your guest card from public sources and direct marketing. Where processing is based on consent, you can withdraw it at any time; this does not affect processing before the withdrawal.
9.2. Write to inform@networking.yachts. We reply within one month; if a request is complex, we may extend this by up to two more months and will tell you why. We may ask for information to confirm your identity, but never your password or wallet keys. Requests are free.
9.3. You can delete your account yourself in Settings; section 5.2 explains what we delete, what we keep and why (GDPR art. 17(3)(b) and (e)). Unsubscribe from emails about new events in Settings or by writing to us.
9.4. You have the right to lodge a complaint with a data protection authority: in Spain, the Agencia Española de Protección de Datos (https://www.aepd.es), or the authority of the EU country where you live or work.
10. Cookies and similar technologies
10.1. Your choice. When you first visit the website, a banner asks for your cookie choice. "Reject all" and "Accept all" are equal buttons on the first screen; "Settings" lets you switch advertising and measurement on or off. You can change your choice at any time with the "Cookie settings" link in the footer of every page. We keep your choice in the cookie ny_consent for 180 days and then ask again; we also ask again if we add a provider to the list in section 10.4. To be able to prove your choice, we set a random device identifier, ny_cid, for the same period, and record in our database the choice, the version of the banner text, the time, the identifier in coded form and, if you are signed in, your account.
10.2. Strictly necessary – always on. These cookies are needed for the Service to work, so they do not require consent: signing in and keeping you signed in (up to 30 days), security of sign-in and forms, payment with Stripe, the support chat, your language and your cookie choice. On the payment page, Stripe sets its own cookies to prevent fraud. If you choose to connect a wallet, Reown (WalletConnect) uses your browser's storage to keep the connection. Staff accounts use additional necessary cookies for administration.
10.3. Our own measurement – without cookies. We count visits to event pages, invite links and sign-ins, and the campaign labels of the links people arrive by, on our own server, without cookies and without sending them to anyone (section 2.7).
10.4. Advertising and measurement – off by default. This is the only optional choice, and one consent covers every provider listed here. If you accept:
- our cookie
ny_touchremembers, for up to 30 days, which ad or link brought you, with the click identifier the ad platform added to the link (gclid,gbraidandwbraid– Google;fbclid– Meta;oppref– ChatGPT); we link it to your sign-in for an event and to your order to learn which ads bring guests; - the tags of Google and Meta set their own cookies (for example,
_fbpand_fbcof Meta) to measure our ads and show them to people who may be interested; these companies receive data about your visit as independent controllers under their own privacy policies. We do not use these tags today; we will update this section before we start.
Until you accept, no advertising cookie is set, no click identifier is kept, and the signals our site sends under Google Consent Mode v2 stay "denied". You can withdraw consent at any time, as easily as you gave it: "Reject all" in Cookie settings removes ny_touch, stops the advertising tags and records the withdrawal; withdrawing does not affect processing before it.
11. Emails
We send service emails about your account, tickets, changes to events you joined and cashback. Emails about new events are sent only if you ticked the box when signing in or turned them on in Settings. You can turn them off in Settings or with the link in any such email. Emails about new guests who fit your goals – at most one a day, with how many such guests signed in for your event and no names – are sent only if you turned them on in the introduction or in Settings; you can turn them off there or with the link in any such email (the link also stops emails about new events).
12. Security
We protect data with encrypted connections, restricted and logged administrative access, separation of test and production systems, and virus scanning of support attachments. No online service can guarantee absolute security. If a personal data breach is likely to result in a risk to you, we will notify the competent authority within 72 hours where the GDPR requires it, and inform you without undue delay where the risk is high.
13. Age
The Service is for people aged 18 and over. We do not knowingly collect data of children. If you believe a child has given us data, write to us and we will delete it.
14. Changes to this policy
We may update this policy. We will tell you about significant changes by email or on the website before they take effect. The version and effective date are shown at the top. This policy is available in English, Russian and Arabic; if the versions differ, the English version prevails, to the extent permitted by law.
15. Contact
- Tatiana Mikhailova, acting as an individual – operator and author of networking.yachts
- Email: inform@networking.yachts
- Website: https://networking.yachts