1. Data controller
Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), this policy describes personal data processing through capsailer.com. The controller is SHEVCHUK ILLIA, NIE Z1876330H. Contact: hello@capsailer.com. Address: Calle Molinillo del Aceite 6, 29008 Málaga, España.
2. Data collected
The form collects an email address, the selected interest and an optional message of up to 1,000 characters. It does not request a name, payment details or identity documents.
It also stores the language, submission date, consent version, request identifier, hash of the private deletion link and email notification status. To limit abuse, the server uses the IP address to generate an hourly hash key and keeps a counter with an expiry; the application does not store the plain IP address in this table. Expired keys are removed when subsequent requests are processed.
No nautical navigation data or geolocation is requested. No analytics or advertising tools have been incorporated into the site code. The selected language is stored locally in the browser. Infrastructure providers may process technical connection data under their terms.
3. Purpose of processing
The data are used exclusively to contact interested people when early access to the application becomes available and to send information about CAPSAILER product development if they have expressly consented.
Data are not used for any other purpose and no automated profiles are created. The current implementation does not automatically subscribe users to a newsletter: it saves the request and sends its contents to the controller for handling.
4. Legal basis
Processing is based on the individual’s express consent (Article 6(1)(a) GDPR), given by voluntarily ticking the acceptance checkbox when submitting the form. Consent may be withdrawn at any time without retroactive effect (see section 7). The checkbox is not preselected and the server rejects requests without consent.
5. Recipients and processors
Requests are processed through a custom form and site handler hosted with Sites on Cloudflare Workers, and stored in Cloudflare D1. A notification containing the email, interest, language and message is sent to hello@capsailer.com using Zoho Mail and its European interfaces (accounts.zoho.eu and mail.zoho.eu). This function does not use Mailchimp or Brevo.
Technology providers participate in hosting, storage and email on the controller’s behalf. Data are not disclosed to third parties for those parties’ own commercial purposes.
Verification remains pending for the contracting entities, processor agreements under Article 28 GDPR, D1’s actual location and safeguards for possible transfers outside the EEA. We do not claim that all infrastructure or access to data is restricted to the EU. Provider references are linked below; they do not replace verification of the actual contracts and configuration.
6. Retention period
Early-access form data will be retained for a maximum of 24 months from the individual’s last interaction (form submission, response to a communication, etc.), after which they will be deleted or anonymised, unless consent has been withdrawn earlier, in which case they will be deleted immediately.
If the individual becomes a registered CAPSAILER application user, their data will cease to be governed by this website policy and will be processed under the application’s own privacy policy, with retention periods linked to the active account.
Technical status: there is no automatic age-based deletion or synchronisation of the last interaction with Zoho. Compliance with this period requires manual management and review by the controller of both the database and email. The private link deletes the website record, but not email copies; their deletion must be arranged by writing to hello@capsailer.com.
7. Your rights
Everyone has the right to access their personal data; request rectification or deletion; request restriction of processing; object to processing; request data portability; and withdraw consent at any time.
To exercise these rights, write to hello@capsailer.com and specify the right concerned. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es, if you consider that processing does not comply with applicable rules.
8. Security measures
The controller applies reasonable technical and organisational measures to protect personal data against unauthorised access, loss or alteration, in accordance with Article 32 GDPR.
The site uses HTTPS. Zoho credentials are held in secret server configuration and are not delivered to the browser. The handler validates fields and request origins, limits size and frequency, and uses parameterised queries. Requests have no public listing. A hash, rather than the original token, is stored for the deletion link.