Privacy Policy
What personal data Nakhoda holds, why, who processes it, and the choices you have.
This is a working draft while Nakhoda is in early access. Ask us if anything here matters for your contract.
1. Who we are, and whose data this is
Nakhoda is provided by IRFANCODER ENTERPRISE (MA0351775-U), a sole proprietorship registered in Malaysia.
For the people who sign in to Nakhoda, we decide how their account data is used. For crew and vessel records a customer adds, the customer decides; we process that data on their behalf and only to run the service for them. Crew members with questions about their data should first contact the company that employs or manages them.
2. Data we collect
- Account data: name, email address, workspace and role, sign-in and session records.
- Crew data added by customers: name, date of birth, nationality, rank, passport and seaman's book numbers, contracts, assignments, and certificate details.
- Documents: certificates, passport and seaman's book pages, and other files you upload, including details read from them.
- Usage records: an audit log of changes in the workspace, share link views, and technical logs used to keep the service running.
3. Why we use it
To provide Nakhoda: storing and showing records, reading documents, sending expiry reminders, checking crew against required certificates, and producing the exports and share links you ask for. To keep the service secure, to support you when you ask, and to meet legal obligations. We don't sell personal data or use it for advertising.
4. AI processing
Documents are read by AI. Scanned pages are first turned into text, and each file is read through a link that stops working after an hour. Details read from documents, including a certificate holder's name, date of birth and document numbers, are compared with your records to match files and flag inconsistencies.
A person on the customer's team approves what is read before it changes a record. We don't use customer documents to train AI models.
5. Who we share it with
Only the service providers that run Nakhoda, for hosting, storage, document reading and email. Each is bound by a data processing agreement and processes data only for that purpose. Customers can ask us for the current list.
Beyond that, data is shared only by the customer, for example through a share link they create, or where the law requires it.
6. How long we keep it
Records and documents are kept for as long as your workspace is active, so the history inspectors ask for is there.
Within 30 days of your contract ending, or of a deletion request. You can export everything before then.
If we confirm a breach affecting your data, we tell you within 72 hours of us confirming it.
7. Your rights
Under Malaysia's Personal Data Protection Act 2010, and the GDPR where it applies, you can ask to see the personal data we hold about you, correct it, get a copy, or have it deleted, and you can object to or limit how it is used. You can also complain to your data protection authority.
Workspace owners can export, correct and delete crew records themselves. For anything else, contact us and we will reply within 21 days.
8. Children
Nakhoda is for businesses and is not meant for anyone under 16.
9. Changes and contact
We will post changes to this policy here and tell customers about material ones. Privacy questions and requests: [email protected]. Security issues: [email protected].