1. Who we are and what this policy covers
Controller. LUMOS OCEAN, a French société par actions simplifiée unipersonnelle with a share capital of €5,000, registered with the Grenoble Trade and Companies Register under number 948 232 608, registered office 316 route du Pellet, 38340 La Sure en Chartreuse, France (“OpenHull”, “we”). Contact for any question about personal data: legal@openhull.com · +33 6 67 53 17 04. We have not appointed a data protection officer.
Who this policy concerns. Visitors to openhull.com; people who contact us, request a demo or subscribe to our newsletter; our business contacts; and the users of OpenHull Sync, who are employees or representatives of our customers (shipowners, ship managers, operators and service providers).
Content of customer accounts. Reports, files, images and other content that customers store in OpenHull Sync may contain personal data, such as the names and signatures of divers and surveyors. For this content, the customer that owns the account decides how the data is used and OpenHull acts only on its behalf, as its processor, under the OpenHull Sync Terms and Conditions. If you are named or shown in such content, please contact the company concerned; if you contact us, we forward your request to it. The only uses of this content that we decide ourselves are described in section 4.
2. What we collect, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Providing OpenHull Sync: account creation, sign-in (including with Google), user management, sharing and support | Name, email address, organization, role, sign-in data, settings, messages exchanged with us | Contract with the customer or user; our legitimate interest in providing the service to our customers and their users | While the account is active; deleted within 90 days after the account is closed, as set out in the Terms and Conditions |
| Security, fraud prevention and proper functioning of the service | Connection logs, IP addresses, browser and device data, error diagnostics | Our legitimate interest in keeping the service secure and available | 12 months at most; logs needed to handle a security incident are kept as long as that incident requires |
| Service communications | Email address, content of service emails such as invitations, password resets and report links | Contract; our legitimate interest in informing users | While the account is active |
| Billing, accounting and payment | Billing contact, company details, invoices, payment information | Contract; legal obligation to keep accounting records | Invoices and accounting records: 10 years (Article L123-22 of the French Commercial Code) |
| Evidence and defence of our rights | Account creation data, acceptance of the Terms and Conditions, correspondence | Our legitimate interest in proving our contracts and defending our rights | Duration of the contract plus 5 years |
| Compliance with sanctions laws | Names of customers, of their representatives and of their vessels | Legal obligation; our legitimate interest in not breaching sanctions | Duration of the contract plus 5 years |
| Answering contact and demo requests from openhull.com | Name, email address, company, message | Steps taken at your request before a contract; our legitimate interest in answering | 3 years after our last contact with you |
| Newsletter | Email address, name, company | Your consent, which you can withdraw at any time with the unsubscribe link | Until you unsubscribe; we then keep your email address only on an opposition list, so that you are not contacted again, and proof of your consent for 5 years |
| Audience measurement on openhull.com (Google Analytics) | Pages visited, approximate location, device and browser data, cookie identifiers | Your consent, given in the cookie banner | Cookies: 13 months; statistics: 14 months |
| Business relations and prospecting with professionals | Name, professional email address, phone number, company, role, history of our exchanges | Our legitimate interest in developing our business; you can object at any time | 3 years after our last contact with you |
| Anonymised statistics and improvement of our AI features | See section 4 | Our legitimate interest, subject to the customer’s settings | See section 4 |
The data marked as required when you sign up is needed to create your account; without it, we cannot provide OpenHull Sync. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
3. Who receives your data
OpenHull does not sell personal data. Your data is accessible only to people who need it:
- OpenHull’s team and its independent contractors for software development and support, located in France and Canada;
- other users of OpenHull Sync, within the limits of the sharing chosen by you or your organization;
- the service providers below, which act on our instructions;
- our professional advisers, such as our accountant and lawyers, who are bound by confidentiality;
- authorities and courts, where the law requires it;
- a buyer of all or part of our business, in which case you will be informed.
| Service provider | Purpose | Location of data |
|---|---|---|
| Hetzner Online (Hetzner Cloud) | Hosting of OpenHull Sync: servers, database, logs and server backups | Finland (Helsinki) |
| Amazon Web Services (Amazon S3, AWS Backup) | Storage of files, photos and videos; database and media backups | France (Paris region) |
| Cloudflare | Network security, access control and traffic routing, when enabled | Worldwide network |
| Resend | Sending service emails | United States |
| SmartBear (Bugsnag) | Error monitoring, limited to technical diagnostics | United States |
| Google (Google Workspace) | Business email and support correspondence | European Union |
| Google (Google sign-in) | Signing in with a Google account, for users who choose it | Worldwide |
| Google Cloud (Vertex AI) | AI features, when enabled | European Union |
| Stripe | Online payment, when enabled | United States and European Union |
| IONOS | Hosting of the openhull.com website | European Union |
| Brevo | Newsletter | European Union (France, Germany and Belgium) |
| Google (Google Analytics) | Audience measurement on openhull.com, with your consent | United States |
| Web3Forms (Web3Creative) | Contact and demo request forms on openhull.com | India, United States and other countries |
Transfers outside the European Union. Our independent contractors work from Canada, which benefits from an adequacy decision of the European Commission. Where a service provider processes data in the United States, the transfer relies on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses. Transfers to other countries without an adequacy decision, such as India for our website forms, rely on standard contractual clauses. You can obtain information on these safeguards at legal@openhull.com.
4. AI features, anonymised data and model improvement
AI features. Some features of OpenHull Sync, such as AI-assisted PDF import, use Google Cloud’s Vertex AI service through an endpoint in the European Union. The documents and images submitted to the feature are sent to it to prepare draft results for the user’s review. Google does not use this data to train its own models without our permission, which we do not give. We do this on behalf of the customer, as described in section 1.
Anonymised statistics. When the “Anonymised data use” setting of an organization is on, which is the default, we process the content of its account to produce anonymised statistics and benchmarks about hull condition, fouling, cleaning and coatings. Before any analysis, we remove names, vessel identifiers, report references, free-text comments, photographs and videos, and we only use aggregated results that cannot identify a person, a company or a vessel. Once anonymised, these results are no longer personal data.
Improvement of our AI features. When an administrator switches on the “AI model improvement” setting of an organization, which is off by default, we may use the content of its account, including images, to develop and train our own AI features, such as automatic digitization and fouling recognition. Images in which a person can be identified are excluded, and we take measures so that our models do not reproduce content that identifies a person, a company or a vessel.
For these two uses, OpenHull acts as controller, on the basis of its legitimate interest in improving its services and the knowledge of hull performance, and of the authorization given by customers in the Terms and Conditions. An administrator can switch either setting on or off at any time in the organization settings, on every plan; switching a setting off applies to future processing. You can also object by writing to legal@openhull.com. Raw data used for these purposes is kept only as long as the account it comes from.
5. Cookies
OpenHull Sync uses only the cookies and browser storage that are strictly necessary to provide the service; they do not require your consent. On openhull.com, we also use Google Analytics to measure our audience, only if you accept it in the cookie banner. You can refuse as easily as you accept, and change your choice at any time with the “Cookie settings” link at the bottom of each page.
| Cookie or storage | Purpose | Duration |
|---|---|---|
| openhull_auth | Keeps you signed in to OpenHull Sync | Session, or until you sign out |
| Cloudflare access cookies, when enabled | Security and protected access | Set by Cloudflare, generally less than 24 hours |
| Local browser storage | Sign-in tokens, account type, display theme and unsaved interface drafts | Until you sign out or clear your browser data |
| Cookie banner choice (openhull.com) | Remembers your choice about cookies | 6 months |
| _ga and _ga followed by an identifier (openhull.com) | Audience measurement with Google Analytics, only with your consent | 13 months |
When you choose to sign in with Google, or to pay online once this is available, Google or Stripe may set their own cookies on their pages, under their own policies.
6. Security, your rights and changes
Security. OpenHull Sync is hosted in the European Union. Data is encrypted in transit, access to production systems is limited to authorized people with individual accounts and multi-factor authentication, and data is backed up daily.
Your rights. You can ask for access to your personal data, its correction or deletion, the restriction of its use, and to receive it in a portable format. You can object at any time to processing based on our legitimate interest, and always to prospecting. Where we rely on your consent, you can withdraw it at any time. You can also give us instructions on what should happen to your data after your death.
How to exercise them. Write to legal@openhull.com. We answer within one month and may ask for proof of identity if we have a reasonable doubt. For content stored in a customer’s account, we forward your request to that customer.
Complaints. If you believe your rights have not been respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Changes. We may update this policy. The date of the current version is shown at the top. We inform OpenHull Sync users of significant changes in the service or by email.