Privacy Policy

Version: 22 October 2026

Go2Boat, a product of Phaer AG, Grabenstrasse 15A, 6340 Baar, Switzerland. Contact for data protection enquiries: support@go2boat.com

This policy applies under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

• Guests: name, email, phone, country, booking data, payment details (via Stripe) and, at handover, crew list and ID data, where required by the provider or the authorities.
• Owners, operators, Agents: in addition, proof of identity, business licence, payout details.
• Potential business partners (hotels, agencies, tour operators and their contact persons): company, position, name where published, business email address and phone number, the public source of this information and our correspondence. We only use information that the company has published itself.
• Reviews: reviews by guests and providers, reports about them including evidence, substantiated incidents.
• All visitors: technical data (IP address, browser, time), cookies as described in section 6.

• Arranging and processing bookings, payments and payouts (contract, Art. 6(1)(b) GDPR)
• Verifying providers and Agents, preventing fraud (legitimate interest or legal obligation)
• Customer support by email, phone, WhatsApp and SMS (contract, legitimate interest)
• Messages about your booking, including a reminder about an unfinished booking (no more than twice); you can object to a reminder at any time, a reply to the email is enough (legitimate interest)
• Mutual reviews by guest and provider after the time on board. Reported reviews are pre-screened by an AI; our team makes the decision (legitimate interest in a fair and safe platform)
• Reliability of guests: we record substantiated incidents, e.g. damage to the boat or a no-show, on the guest account. When a guest makes an enquiry, providers can see whether the guest is considered reliable. After repeated incidents, bookings are possible on request only (legitimate interest of providers and Go2Boat in preventing damage and misuse)
• Invitations to further bookings sent to guests who have already booked via Go2Boat (legitimate interest); unsubscribe at any time via the link in every invitation
• Statutory retention, accounting (legal obligation)
• Proof of which contract or terms you accepted and when: wording, time, name, email address, IP address and browser (contract, legitimate interest)
• Improving the platform and statistics (legitimate interest or consent)
• Initiating business relationships with potential partners: one personal enquiry and no more than two follow-ups (legitimate interest, Art. 6(1)(f) GDPR). Each of these emails contains a link you can use to unsubscribe from further emails at any time; after that, we will not write to you again.

• To the provider of the booked boat: all information the provider needs for the booking.
• To providers you send an enquiry to: whether you are considered a reliable guest.
• Providers’ booking systems, e.g. MMK Booking Manager.
• Service providers (processors):
• Amazon Web Services (hosting, data centre in Frankfurt, Germany)
• Stripe (payment processing and payouts)
• Twilio (SMS, verification)
• Postmark (ActiveCampaign, USA): sending emails
• GitHub (Microsoft, USA): storage of research on potential business partners
• Anthropic (USA): AI assistant, pre-screening of reported reviews, research of public business information and draft texts
• No third-party analytics, map or font services: audience measurement runs without cookies on our own server (section 6), and we serve the map and fonts ourselves. Links to other services (e.g. Google Maps) only send data to them when you click them.
• Some service providers are based outside Switzerland and the EEA, in particular in the USA. Data is transferred on the basis of adequacy decisions (e.g. the Swiss-U.S. or EU-U.S. Data Privacy Framework) or standard contractual clauses.

Accounts and the data relating to them are kept for as long as the account exists; we delete it on request. We keep accounting records for 10 years. We keep a copy of every email about a booking (recipient, content, time) as proof of the booking for as long as the booking records are kept (10 years); sign-in codes and links are not stored. We keep proof of accepted contracts and terms for 10 years after the contract ends. We take substantiated incidents into account for no more than 24 months. We keep information on potential business partners until the person concerned objects. Anyone who has unsubscribed from further emails remains stored with their address and an unsubscribe note, so that we do not contact them again.

We only use technically necessary cookies, in particular for the language you have chosen. No consent is required for these.

To understand where visitors drop out during search and booking, we count page views and booking steps without cookies and without a profile: from the shortened IP address, the browser identifier and a key that changes daily, we create an identifier that can no longer be attributed after 24 hours. We do not store the IP address itself for this purpose. The counts are anonymous; we keep them without a time limit.

Agent links will in future use a cookie to attribute a booking to the referring Agent (duration: 30 days). This section will be supplemented before the Agent programme launches.

Access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. If information about your reliability is incorrect, we will correct it. You can unsubscribe from invitations to further bookings via the link in every invitation. Please send requests to the address in section 1. Complaints can be lodged with the FDPIC (Switzerland) or the competent supervisory authority in the EEA.

We update this policy when our processing changes. The version published at the time applies.