Draft, not yet reviewed by a lawyer.
Privacy
CharterDesk is a desk for yacht charter brokers, run by Kodo Yachts LLC. This page says what it reads, where it keeps it, who can see it, and how it goes when you ask. It covers the brokers who sign in, and the clients, captains and other brokers who open a page a broker sends them.
Each broker’s office decides what goes into its CharterDesk and what it is used for. For what an office keeps about its clients, the office is in charge and we look after it for them.
What CharterDesk reads
Email. An office connects its mailbox through Microsoft (Outlook, Microsoft 365) or Google (Gmail). That connection is read-only: CharterDesk reads the mail and its attachments and never sends, moves or deletes anything in the mailbox. Folders and people an office marks Keep Private are not read in. Replies are written in the broker’s own email program and sent from there.
WhatsApp. Where an office connects its WhatsApp Business number, messages reach CharterDesk through Meta’s WhatsApp Business Platform. A message goes out only when a broker presses send.
What brokers add. Clients, yachts, charters, notes, documents, payments and the answers clients give on their forms.
Identity documents. Passports and other IDs a client sends for a charter are kept apart from everything else. Only the office’s admin, the person who added it and the client’s own broker can open one; each opening is noted, and AI never reads them.
When AI is used
CharterDesk uses Claude, made by Anthropic, for things like summarising an email, drafting a reply or reading a contract. It runs only when a person clicks to ask for it, never on its own in the background. What is sent is what that click needs: the email, document or charter in question. Under Anthropic’s commercial terms, what we send is not used to train its models. A broker reads and changes every draft before anything is sent, and nothing is ever sent for them.
Pages clients open
Brokers send clients links to proposals, comparisons of yachts, preference sheets and enquiry forms, itineraries and trip guides. Captains and other brokers get links to availability and hold requests. Each link opens only what it was made for, with no sign-in, and works until the broker takes it down.
When someone opens one of these pages, CharterDesk notes that it was opened, when, and roughly how long it was read, so the broker knows when to get in touch. What is typed into a form goes to that broker. These pages set no cookies; they keep a random visit number in the browser until the tab is closed, so one visit counts once. Some of them load fonts from Google Fonts and photographs from Unsplash or Wikimedia Commons, which then see the reader’s internet address as any website would.
If an office sends a newsletter, it goes through Amazon Simple Email Service. Each copy notes whether it was opened and which links were clicked, and each has its own unsubscribe link, which works at once and for good.
Where it is kept
Each office has its own database on a server we rent from DigitalOcean in Frankfurt, Germany. Its files (attachments, contracts, photos) sit beside it. Connections are encrypted, and the keys to each mailbox are kept on the server, readable only by CharterDesk.
Every night each office is backed up: its database, its files and its keys, copied to a backup folder on the same server that only the server’s administrator can open. Database backups are kept for 60 days and then deleted.
Who can see what
In an office: the people its admin invites. Everyone signed in to an office sees that office’s clients, charters and mail, apart from mail kept private and the identity documents, which only the admin, the person who added one and the client’s broker can open. An admin can switch a person off at once, on every device.
Other offices: nothing. Offices never see each other’s data.
Kodo Yachts: the people who run CharterDesk can reach the server to keep it running, fix faults and restore backups. We look at an office’s data only for that, or when the office asks us to.
Services we use: DigitalOcean (the server), Microsoft or Google (reading the mailbox an office connects), Meta (WhatsApp), Anthropic (AI, when asked), and Amazon (newsletters and sign-in emails). Each gets only what its job needs. Where an office connects Kodo Guest, the charter details it chooses are shared with that app.
We don’t sell data
We never sell, rent or trade anyone’s data, and we don’t use it for advertising. An office’s data is used to run that office’s CharterDesk and nothing else.
Signing in
Brokers sign in with a passkey (Face ID, Touch ID, a fingerprint or a PIN); there are no passwords. CharterDesk keeps one cookie to keep a person signed in for 30 days. If someone asks for a sign-in link by email, the request is noted in the office’s log without the address.
Deleting data
A broker can mark someone as Not for CharterDesk, which erases what was kept from them. To have anything else deleted, or to ask what is kept about you, write to the broker’s office, or to us at jordon@kodoyachts.com. If you are a client, your broker’s office decides with you; we carry it out. Once deleted, we take its files out of the backups too, and it leaves the nightly database copies as they roll off, within 60 days.
When an office stops using CharterDesk, we give it a copy of its data if it asks, then delete the office and its backups.
Questions
Write to Kodo Yachts LLC at jordon@kodoyachts.com. If this page changes in a way that matters, we’ll say so on it and tell each office.