Last updated: September 2026

1. Data Controller

Oceanook ("we", "us", "our") operates the websiteoceanook.com. This privacy policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR).

2. Data We Collect

We collect and store the following personal data:

• Email address - provided during account registration
• Password - stored in hashed form (never in plain text)
• Session data - temporary cookies required for authentication
• Usage data - pages visited, approximate location, browser and device information, collected via Google Analytics 4only if you accept analytics cookies in the cookie banner. Google Analytics 4 does not log or store full IP addresses.
• Server logs - your IP address and browser user agent may be recorded in server logs for security, abuse prevention, and service monitoring

3. Purpose of Data Processing

We process your data for the following purposes:

• Account creation and authentication
• Sending account activation emails
• Sending newsletters (only if you opt in)
• Measuring website traffic and usage patterns with Google Analytics (only with your consent)
• Protecting the service against bots, scraping, and abuse

4. Legal Basis

We process your personal data based on:

• Consent (Article 6(1)(a) GDPR) - you provide your email and create an account voluntarily; analytics cookies are used only if you explicitly accept them in the cookie banner
• Legitimate interest (Article 6(1)(f) GDPR) - for maintaining the security and functionality of our service (including server logs and bot protection)

5. Data Retention

We retain your email address and account data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us.

Google Analytics data is retained for up to 14 months, after which it is automatically deleted. The lifetime of each cookie is listed in the cookie table in section 7.

6. Data Sharing

We do not sell, trade, or share your personal data with third parties, except:

• When required by law or legal process
• With email service providers (Mailgun) solely for delivering transactional emails
• With Google (Google Analytics 4), only if you accept analytics cookies. Google Analytics is provided by Google Ireland Ltd.; data may be transferred to and processed by Google LLC in the United States. Such transfers are covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.

7. Cookies

We use essential cookies required for the website to function, and analytics cookiesonly with your prior consent. When you first visit the site, a cookie banner lets you accept or decline analytics cookies. Declining does not affect the functionality of the website.

The cookies used on this website are:

Cookie	Type	Purpose	Duration
connect.sid	Essential	Keeps you signed in (session authentication)	28 days
i18n	Essential	Remembers your language preference	Session
bc_passed	Essential	Marks that you passed the anti-bot challenge	4 days
bc_app	Essential	Recognizes our official mobile app	1 year
cookieconsent_status	Essential	Remembers your cookie consent choice	1 year
_ga	Analytics (Google Analytics 4, consent required)	Distinguishes visitors for usage statistics	2 years
_ga_*	Analytics (Google Analytics 4, consent required)	Maintains analytics session state	2 years

8. Your Rights

Under the GDPR, you have the right to:

• Access - request a copy of the personal data we hold about you
• Rectification - request correction of inaccurate data
• Erasure - request deletion of your data ("right to be forgotten")
• Data portability - receive your data in a structured, machine-readable format
• Withdraw consent - withdraw your consent at any time. For analytics cookies, you can change your choice at any time via the "Cookie settings" link in the footer of every page; withdrawing consent also deletes the Google Analytics cookies from your browser
• Lodge a complaint - file a complaint with a supervisory authority

9. Data Security

We implement appropriate technical measures to protect your data, including password hashing, HTTPS encryption, and secure session management.

10. Contact

To exercise any of your rights or for questions about this privacy policy, please contact us at:info@oceanook.com