Privacy Policy

1. Who we are

OnlySail is an international online marketplace dedicated exclusively to sailing vessels — sailing yachts, sailing catamarans and trimarans. The platform enables private sellers and professional yacht brokers to list vessels for sale, and enables prospective buyers to discover listings, contact sellers or brokers, and save vessels of interest.

OnlySail is operated by Marketstrate LLC, a limited liability company organised in the State of Texas, United States, with its principal business address at 1818 35th St, Galveston, Texas 77550, United States (referred to in this Policy as "OnlySail", "we", "us" or "our"). Marketstrate LLC is the data controller for the personal information described in this Policy.

For all privacy-related enquiries you may contact us at ahoy@onlysail.com.

2. Scope of this Policy

This Privacy Policy explains:

• what personal information OnlySail collects about you;
• why we collect it and the purposes for which we use it;
• who we may share it with and in what circumstances;
• how we protect it;
• how long we retain it; and
• what rights you may have in relation to your personal information.

It applies to all users of the OnlySail platform, including:

• visitors to https://onlysail.com who browse without registering;
• individuals who register an account as a Private Seller or as a Professional Broker;
• prospective buyers who submit enquiries through the platform.

OnlySail offers two public account types: Private Seller and Professional Broker. There is no separate general-user registration type.

This Policy does not apply to third-party websites, services or applications reachable through links in listings or elsewhere on our platform. Those services operate under their own privacy policies, which we encourage you to review.

3. Information we collect

3.1 Account information

When you create an OnlySail account we collect:

• Full name — to identify your account and, where applicable, to display your identity on a professional broker profile.
• Email address — used for authentication, email verification, essential service communications and routing the enquiries you send or receive.
• Password — handled by our authentication infrastructure. Passwords are never stored in plain text and are processed using industry-standard hashing. OnlySail staff cannot read your password.
• Phone number — optional; used where applicable to facilitate contact or as part of your public or professional profile.
• Profile photograph or avatar — optionally uploaded by you, or received from Google where you sign in with Google and Google supplies a profile image.
• Account type — whether you registered as a Private Seller or as a Professional Broker.
• Registration country — the country you select at registration, used for localisation and to present your general market.

3.2 Professional broker information

Users who register as Professional Brokers may provide additional information relating to their professional identity:

• company or business name;
• professional role or title (for example Broker, Sales Director);
• country and general business location;
• additional business profile information that may appear on a publicly visible broker profile page where the broker has published eligible listings;
• verification-related information voluntarily submitted in connection with broker registration or profile completion.

3.3 Yacht listing data

Sellers and brokers who create listings provide information about the vessel. This may include:

• make, model and year of construction;
• technical specifications such as length, beam, draft, displacement, engine type and hours, sail area, keel type, rig and other vessel characteristics;
• asking price and currency;
• the physical location of the vessel and its country of registration;
• vessel description, equipment inventory and maintenance or condition notes;
• uploaded photographs of the vessel;
• a PDF brochure generated from, or attached to, the listing;
• video links or other multimedia references.

3.4 Buyer enquiry information

When a prospective buyer submits an enquiry about a listed vessel we collect:

• name;
• email address;
• telephone number;
• WhatsApp or other contact details, where voluntarily provided;
• the content of the enquiry message;
• the specific listing to which the enquiry relates.

3.5 Saved vessels

If you save or bookmark listings for later reference, we record the association between your account and the listings you have saved. Saved vessels are visible only to you in your account.

3.6 Listing performance data

Sellers and brokers have access to dashboards showing performance information about their own listings — for example listing view counts and enquiry counts. This information derives from interactions recorded on the platform and is presented in aggregate to the listing owner to help them understand how their listings are performing.

4. Information we receive from Google Sign-In

OnlySail offers sign-in with Google as a convenience. When you choose to authenticate with your Google account, OnlySail receives information from Google through the OAuth 2.0 protocol. We request only the following standard identity scopes, which are the minimum necessary to authenticate you:

• openid — confirms your identity with Google;
• email — provides the email address of your Google account;
• profile — provides your display name and, where available, your Google profile image.

As a result of using Google Sign-In, OnlySail may receive:

• your name as it appears in your Google account;
• your Google account email address;
• a unique Google account identifier;
• your Google profile image or avatar, where Google provides one.

OnlySail expressly does not:

• read, access or process the contents of your Gmail inbox or any email messages;
• access files or documents stored in your Google Drive;
• access your Google Contacts or address book;
• access your Google Calendar or any calendar data;
• request any sensitive or restricted Google API permissions beyond the three standard identity scopes listed above.

Information received from Google is used exclusively to create your OnlySail account where you do not already have one, to authenticate you when you sign in, and to pre-populate your account profile (name and avatar) where applicable.

We do not use information received from Google for any purpose unrelated to your OnlySail account, and we do not sell it or share it with third parties except as strictly necessary to operate the platform, as described in section 10.

5. Information collected automatically

5.1 Server logs and usage data

When you access the platform, our infrastructure may automatically record:

• IP address;
• browser type and version;
• operating system and device type;
• pages and features accessed on the platform;
• date, time and duration of access;
• referring URL;
• error and diagnostic information.

This information is used for security monitoring, fraud and abuse detection, troubleshooting and service improvement. It is not used to build marketing profiles.

5.2 Analytics — Google Analytics 4

OnlySail uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 is loaded only on the production website at onlysail.com; it is not loaded on development or preview environments.

GA4 collects usage and analytics data such as:

• pages viewed and interactions with listings and platform features;
• approximate geographic region at country or region level, derived from IP address;
• device and browser information;
• session duration and navigation paths.

GA4 works through cookies and similar client-side technologies. We do not send personal identifiers such as your name or email address to GA4, and we do not use GA4 User-ID tracking. We have not enabled Google Signals or advertising personalisation features, and we do not use GA4 data for advertising or remarketing. Analytics data is nonetheless usage data that may be indirectly linked to a device or browser, so we do not describe it as anonymous.

Analytics consent: GA4 is switched off by default. Google Analytics is not loaded and no measurement data is sent from OnlySail until you affirmatively accept Analytics in the privacy banner. You can change or withdraw that choice at any time through the Cookie settings control in the footer, which also stops any further analytics measurement. You can additionally prevent GA4 measurement by:

• installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout;
• configuring your browser to block or clear analytics cookies;
• using browser privacy features or extensions that block analytics tracking.

GA4 data is processed by Google in accordance with Google's own privacy terms. If you would like your analytics data excluded or deleted, contact us at ahoy@onlysail.com.

6. How we use personal information

We use personal information only for the purposes described in this Policy:

We do not send unsolicited marketing communications without a separate and lawful basis for doing so, and we do not build profiles about you for sale to, or use by, third parties.

7. Public listings and broker profiles

OnlySail is a marketplace. Published listings are publicly accessible, including to visitors who are not signed in and to search engines that index publicly available content.

Information that may become publicly visible when a listing is published includes:

• vessel make, model, year and technical specifications;
• uploaded photographs of the vessel and the listing brochure;
• asking price;
• the general location of the vessel (country and region, such as a port or coastal area) and country of registration;
• the vessel description, equipment details and other listing content provided by the seller or broker;
• attribution identifying the seller or broker responsible for the listing, such as a name or business name;
• professional broker profile pages — including business name, general location and profile information — where the broker has published listings that meet the current profile eligibility rules.

Information that is not intentionally made public includes:

• passwords and authentication credentials;
• internal account identifiers, session tokens and other security data;
• your email address and telephone number, unless you have deliberately included them in listing content;
• buyer enquiry content, which is shared only with the seller or broker responsible for the listing;
• saved vessels, which are visible only to you;
• moderation notes, review history and other internal administrative records;
• listing performance analytics, which are shown only to the listing owner.

You should assume that anything you type into a public listing field may be indexed by search engines. Please do not include information in a listing that you do not want to be public.

8. Buyer enquiries and communications

When a prospective buyer submits an enquiry through a listing, the enquiry information — name, email address, telephone number, WhatsApp or other contact details where provided, and the message content — is transmitted to the seller or broker responsible for that listing.

OnlySail acts as the conduit that routes that communication. Once the enquiry has been received by the seller or broker, that recipient may process the information in order to respond to the enquiry, and is responsible for handling it in accordance with the privacy obligations that apply to them. OnlySail does not control how an individual seller or broker subsequently uses information they receive.

Transactional email: OnlySail uses Resend to deliver essential transactional emails, including email verification and password reset messages. These messages are operationally necessary and are sent only in response to actions you initiate. They are not marketing communications.

9. Cookies, browser storage and similar technologies

OnlySail and its integrated services use cookies and browser storage for the following purposes:

Authentication and session management

Your signed-in session is stored in your browser by our authentication infrastructure so that you remain signed in as you navigate. This is essential; it cannot be disabled without preventing you from using authenticated features.

Listing flow state

While you are creating a listing, information you have entered may be temporarily stored in your browser's local storage so that your progress survives sign-in, email verification or an accidental navigation. It stays on your device until you submit the listing.

Language preference

Your chosen interface language (English or Spanish) is stored locally so that the site opens in the same language on your next visit.

Pending action state

If you attempt an action that requires an account — such as saving a vessel — the intended action may be held briefly in browser session storage so it can be completed once you have signed in.

Analytics

Google Analytics 4 sets cookies on onlysail.com to distinguish devices, measure sessions and record interactions. These are not necessary for the platform to function. See section 5.2, including the current status of analytics consent and how to opt out.

You can manage or delete cookies and site data through your browser settings. Clearing authentication storage will sign you out, and clearing listing flow state may discard an unsaved listing draft.

10. Service providers and data processors

OnlySail relies on a small number of third-party providers to operate the platform. They process personal information only as necessary to perform their role for us, and are not authorised to use it for their own independent purposes.

Supabase

Supabase provides the core technical infrastructure of the platform:

• authentication, including credential handling, email verification and session management;
• the database in which account information, listing data, enquiry records, saved vessels and related records are stored;
• file storage for uploaded photographs, generated PDF brochures and other user-supplied files;
• related backend infrastructure.

Personal information held by OnlySail resides within Supabase infrastructure. Supabase acts as a processor on our behalf, subject to data-processing commitments consistent with applicable law.

Google LLC

• Google Sign-In (OAuth 2.0) — authentication with a Google account. OnlySail receives only basic identity information through the standard identity scopes described in section 4.
• Google Analytics 4 — web analytics on the production website, as described in section 5.2.

Google's processing is governed by Google's own privacy policies and data-processing terms.

Resend

Resend is the transactional email delivery service used to send account emails such as email verification and password reset messages. Resend receives the recipient's email address and the content of the transactional message so that it can be delivered.

These are the only third-party services that process personal information of OnlySail visitors and account holders in the current production platform.

11. How we share information

OnlySail does not sell personal information. We share or disclose it only in the limited circumstances below.

With sellers or brokers, when a buyer submits an enquiry

The enquiry details — the buyer's name, email address, telephone number, any WhatsApp details provided, and the message — are shared with the seller or broker associated with the listing so that they can respond.

With the public, through published listings

Information contained in a published listing is accessible to all visitors, as described in section 7.

With our service providers

We share information with Supabase, Google and Resend as described in section 10, limited to what is reasonably necessary for them to provide their services to us.

Where required by law

We may disclose information to law enforcement, courts, regulators or other competent authorities where legally required, or where we have a good-faith basis to believe disclosure is necessary to protect the rights, safety or property of OnlySail, our users or others.

With professional advisers

We may share information with legal counsel, accountants, auditors or similar advisers where necessary to manage our legal and business obligations, subject to confidentiality obligations.

In connection with a business transaction

If OnlySail or a material part of its business is transferred, merged, acquired or reorganised, personal information may be transferred as part of that transaction. We would take reasonable steps to require the receiving party to honour the commitments in this Policy.

We do not share personal information with third parties for their own marketing or commercial purposes.

12. Legal bases for processing

For users in the European Economic Area, the United Kingdom or other jurisdictions that require a legal basis for processing, we rely on the following:

Performance of a contract

Where processing is necessary to provide the services you have requested — creating and maintaining your account, enabling listing creation and management, routing enquiries and providing dashboards.

Legitimate interests

Operating and improving a secure, reliable marketplace, detecting and preventing fraud and abuse, maintaining platform integrity and managing our business. Where we rely on legitimate interests we assess that they are proportionate and not overridden by your rights.

Compliance with legal obligations

Where we must process or retain information to comply with a legal obligation, such as responding to a lawful request from a competent authority.

Consent

Where processing requires your consent — for example non-essential analytics cookies in jurisdictions that require prior consent — we will seek it, and you may withdraw it at any time. Withdrawal does not affect processing carried out beforehand. See section 5.2 for the current status of our analytics consent mechanism.

Users in other jurisdictions may be subject to different frameworks. This Policy is designed to be consistent with widely recognised privacy principles regardless of jurisdiction.

13. International data transfers

OnlySail is operated from the United States and serves users worldwide. Our service providers, including Supabase, Google and Resend, may process and store personal information on infrastructure located in countries other than your country of residence, including the United States.

Where personal information is transferred from the EEA, the United Kingdom or another jurisdiction that restricts cross-border transfers, we rely on the transfer mechanisms made available by those providers — which may include Standard Contractual Clauses adopted by the European Commission or the UK Information Commissioner's Office, or other legally recognised safeguards.

We cannot guarantee that the laws of a destination country offer the same level of protection as those of your own jurisdiction, but we take reasonable steps to ensure transfers occur within a framework consistent with this Policy and applicable law. Questions about international transfers may be sent to ahoy@onlysail.com.

14. Data retention

We retain personal information for as long as your account remains active and as necessary to provide the services described in this Policy. The following principles govern retention:

Active account data

Retained while your account is active and in use.

Listing data

Listing content, photographs and brochures may be retained after a listing is withdrawn, archived or removed from public display, for operational, fraud-prevention, dispute-resolution, accounting or legal-compliance purposes.

Enquiry records

Buyer enquiry records may be retained for a limited operational period beyond the enquiry date to support dispute resolution and abuse prevention.

Backups and operational logs

System backups and infrastructure logs are retained for a limited period as part of standard operational practice and are not used for active processing beyond their technical and security purpose.

Legal holds

Where a legal or regulatory obligation, dispute or similar requirement applies, we retain the relevant information for no longer than necessary to satisfy it.

Following deletion

Where you request deletion, we take steps to delete or anonymise your personal information subject to the exceptions above, as described in section 17.

We do not state arbitrary fixed retention periods that we are not in a position to guarantee in practice. For questions about retention as it applies to your information, contact ahoy@onlysail.com.

15. Security

We apply technical and organisational measures appropriate to the information we process:

• Encryption in transit — traffic between your browser and OnlySail is served over HTTPS using industry-standard TLS.
• Authentication controls — account access requires verified credentials; Google Sign-In additionally benefits from Google's own authentication security.
• Password security — passwords are never stored in plain text and are handled by our authentication infrastructure using cryptographic hashing.
• Access controls — database row-level security and storage permissions restrict access to records to the account that owns them and to authorised platform processes.
• Infrastructure security — Supabase provides database, storage and infrastructure-level protections for data hosted in their systems.
• Monitoring — we maintain logging and monitoring to detect anomalous activity and potential security incidents.
• Email security — transactional email is delivered through Resend over authenticated, secure delivery infrastructure.

No internet-accessible system can be guaranteed completely secure. Please use a strong, unique password, keep your credentials confidential, and contact us immediately at ahoy@onlysail.com if you believe your account has been compromised.

16. Your privacy rights

Depending on your country of residence and applicable law, you may have some or all of the following rights. They vary by jurisdiction and are subject to conditions and exceptions:

Access

Request confirmation of whether we process personal information about you and, if so, a copy of it.

Correction

Request correction of inaccurate information or completion of incomplete information. Most profile and listing details can also be edited directly in your account.

Deletion

Request deletion of your personal information. We will honour this where we are not legally required or otherwise legitimately entitled to retain it — for example for fraud prevention, dispute resolution or regulatory compliance.

Restriction of processing

In certain circumstances, request that we restrict active processing while a dispute or another request is resolved.

Objection

Where we rely on legitimate interests, object to that processing. We will stop unless we can demonstrate compelling grounds that override your interests, or the processing is needed for legal claims.

Portability

Where processing is based on consent or contract and carried out by automated means, receive the information you provided in a structured, commonly used, machine-readable format.

Withdrawal of consent

Where processing is based on consent, withdraw it at any time, without affecting the lawfulness of prior processing.

Complaint to a supervisory authority

If you are in the EEA you may complain to the supervisory authority of your member state; in the United Kingdom, to the Information Commissioner's Office. We ask that you contact us first so we can try to resolve the matter directly.

To exercise any right available to you, email ahoy@onlysail.com from the address associated with your account. We may need to verify your identity before acting, and we will not charge a fee except where a request is manifestly unfounded or excessive.

17. Account and data deletion

OnlySail does not currently offer a self-service account deletion button. Deletion is handled manually on verified request: email ahoy@onlysail.com from the email address registered to your account, with the subject line "Account Deletion Request".

Once we have verified the request we will:

• deactivate your account and prevent further sign-in;
• delete or anonymise your personal profile information;
• remove your listings from public display.

Please note:

• copies of listing content previously published may persist in search engine indexes or third-party archives outside our control;
• enquiry records and operational logs may be retained for a limited period for fraud prevention, dispute resolution and security purposes;
• where a legal obligation requires retention of specific information, we retain only what is strictly necessary, for the required duration.

We will acknowledge your request and confirm the action taken within a reasonable timeframe.

18. Children's privacy

OnlySail is intended for adults and for persons legally capable of using a yacht marketplace and entering into commercial relationships. It is not directed to children below the minimum age at which they may lawfully consent to the processing of their personal data in their jurisdiction.

We do not knowingly collect personal information from children below that age. If you believe a child has provided personal information to OnlySail, contact us at ahoy@onlysail.com and we will take prompt steps to delete it.

19. Third-party websites and services

Listings on OnlySail may contain links to external websites, video platforms, broker company sites or other third-party resources. This Policy applies only to the OnlySail platform and the information we collect through it.

We are not responsible for the privacy practices or content of third-party websites, and a link in a listing is not an endorsement. We encourage you to review the privacy policy of any external site you visit.

20. Changes to this Policy

We may update this Privacy Policy to reflect changes to our services, technology or legal requirements. The "Last updated" date at the top of this page reflects the most recent published version.

Where changes are material, we will take reasonable steps to notify registered users, for example by email or by a notice on the platform. Continued use of OnlySail after an updated Policy is published constitutes acknowledgement of the changes. If you do not agree with an updated Policy, you should stop using the platform and may request deletion of your account as described in section 17.

21. Contact us

For any question, concern or request relating to this Privacy Policy or to how OnlySail processes your personal information, please contact us:

• Email: ahoy@onlysail.com
• Website: https://onlysail.com
• Data controller: Marketstrate LLC (State of Texas, United States)
• Principal business address: 1818 35th St, Galveston, Texas 77550, United States

We aim to respond to privacy enquiries within a reasonable timeframe and, in any event, within the period required by applicable law.