Privacy Policy

1. Introduction

CabinPick International B.V. ("CabinPick", "we", "us", or "our"), registered under KvK number 78527848, is the data controller responsible for the processing of your personal data as described in this Privacy Policy.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our maritime accommodation booking platform at cabinpick.com and related services (the "Platform").

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR), the Dutch Implementation Act (Uitvoeringswet AVG), and other applicable data protection legislation.

2. Data We Collect

We collect the following categories of personal data:

2.1 Account Information

• Full name, email address, and phone number
• Password (stored in hashed form only)
• Profile photo (optional)
• Account role (Guest, Host, or Admin)

2.2 Booking and Transaction Data

• Booking details: check-in/check-out dates, number of guests, selected extras
• Payment information processed through Stripe (we do not store full card numbers)
• Invoice and billing addresses
• Gift card purchase and redemption history

2.3 Host Data

• Vessel details: type, location, capacity, amenities, photographs
• Partner application information
• Payout details (bank account / IBAN)

2.4 AI Concierge Conversations

• Messages exchanged with our AI concierge
• Search preferences and recommendations generated
• Conversation metadata (timestamps, session identifiers)

2.5 Technical Data

• IP address, browser type, device information
• Pages visited, time on page, referring URL
• Cookies and similar tracking technologies (see Section 5)

3. How We Use Your Data

We process your personal data for the following purposes:

• Provide the Platform -- to facilitate bookings, process payments, and manage your account (legal basis: contract performance)
• Communication -- to send booking confirmations, reminders, and support responses via Resend email service (legal basis: contract performance)
• AI Concierge -- to power our AI-driven chat assistant that helps you find and manage stays (legal basis: legitimate interest)
• Payment Processing -- to process payments securely through Stripe, including refunds and payouts to hosts (legal basis: contract performance)
• Reviews and Ratings -- to display guest reviews and maintain platform trust (legal basis: legitimate interest)
• Safety and Fraud Prevention -- to detect and prevent fraudulent activity, enforce our terms, and protect users (legal basis: legitimate interest)
• Legal Compliance -- to comply with tax, accounting, and other legal obligations under Dutch and EU law (legal basis: legal obligation)
• Platform Improvement -- to analyse usage patterns and improve the user experience (legal basis: legitimate interest)

4. Data Sharing

We share your personal data only with the following parties:

• Hosts and Guests -- limited booking details are shared between the guest and host for each booking
• Stripe -- payment data is processed by Stripe, Inc., which acts as a data processor under a Data Processing Agreement (DPA)
• Resend -- email addresses and booking details are shared with Resend for transactional email delivery
• AI Service Providers -- anonymised conversation data may be processed by our AI infrastructure providers to power the concierge
• Legal Authorities -- when required by law, court order, or governmental regulation

We do not sell your personal data to third parties. We do not share data for advertising purposes without your explicit consent.

5. Cookies

We use the following types of cookies:

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Platform.

6. Data Retention

We retain your personal data for the following periods:

• Account data -- for the duration of your account, plus 12 months after deletion
• Booking data -- 7 years after completion (Dutch tax law requirement)
• Payment records -- 7 years (Dutch fiscal retention obligation)
• AI concierge conversations -- 90 days, then anonymised for model improvement
• Technical logs -- 12 months

7. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access -- request a copy of the personal data we hold about you
• Right to Rectification -- request correction of inaccurate or incomplete data
• Right to Erasure -- request deletion of your personal data ("right to be forgotten")
• Right to Restriction -- request that we limit the processing of your data
• Right to Data Portability -- receive your data in a structured, commonly used format
• Right to Object -- object to processing based on legitimate interests
• Right to Withdraw Consent -- withdraw consent at any time where processing is consent-based

To exercise any of these rights, please contact us at privacy@cabinpick.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

This Privacy Policy is governed by Dutch law. Any disputes arising from or in connection with this policy shall be submitted to the competent court in the Netherlands.