Back to map

Privacy Policy

Last updated: 9 August 2026

Navtrac (navtrac.io) is operated by CITS LTD, Unit 7 Initial Business Centre, Wilsons Business Park, Manchester M40 8WN, United Kingdom. You can contact us at navtrac@citsltd.uk.

This Privacy Policy explains how CITS LTD ("we", "us") collects and handles personal data when you use Navtrac — whether as a subscriber to the web application or as a developer using the Navtrac API. CITS LTD is the data controller for the personal data described in this Policy under the UK GDPR and, where applicable, the EU GDPR.

1. Data we collect

All users

  • Account data — your email address, name (if provided), and authentication data such as one-time login codes, session identifiers, and access tokens.
  • Billing data — payments are handled by our payment processor, Stripe; we do not store card numbers. We keep your subscription or purchase status, plan, invoices, and a Stripe customer reference.
  • Request logs — IP address, user agent, and timestamps of requests, kept for security, abuse prevention, and rate limiting.
  • Optional website analytics — if you consent and analytics is enabled, Google Analytics 4 receives aggregated page, session, approximate location, device, browser, traffic-source, sign-up, and subscription-conversion information. We exclude URL query parameters and do not send email addresses, API keys, or vessel searches.

Subscribers

  • Usage data — features used, vessels viewed or searched, and the watchlists, fleets, geofences, and saved filters you create.
  • Alert data — the email addresses of alert recipients you configure and the history of alerts sent. If you add a recipient other than yourself, you confirm they have agreed to receive those emails.

API developers

  • Developer account data — name, email, company name (optional), and hashed password.
  • API usage records — API keys (stored hashed), per-request usage logs (endpoint, timestamp, response status, credits consumed), and credit balance and purchase history. These records are also used for billing and are retained accordingly.

2. How and why we use it

We use personal data to:

  • operate the Service, authenticate you, and deliver the features you use (performance of a contract);
  • process payments and maintain billing records (contract and legal obligation);
  • send alert emails you configure (performance of a contract);
  • prevent abuse, enforce rate limits, and secure the Service (legitimate interests);
  • send service notices such as billing or policy-change emails (legitimate interests / legal obligation);
  • measure and improve website performance when you consent to optional analytics (consent);
  • comply with tax, accounting, and other legal obligations (legal obligation).

We do not sell personal data and we do not use it for third-party advertising.

3. Sharing and international transfers

We share personal data only with sub-processors needed to run the Service: our hosting and database providers, Stripe (payment processing), our transactional email provider, and Google Analytics when you consent to optional website analytics. Each is bound by confidentiality and data-protection terms. Where a sub-processor is located outside the UK or EEA, transfers are protected by adequacy regulations or standard contractual clauses. We may also disclose data where required by law.

4. Retention

  • Account, fleet, watchlist, and alert data — for the lifetime of your account, plus a short recovery period after deletion.
  • Request logs — up to 90 days.
  • Google Analytics data — according to the retention period configured for our GA4 property.
  • API usage and billing records — up to 6 years, as required for tax and accounting.

5. Your rights

If you are in the UK or EEA, you have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, email navtrac@citsltd.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

6. Cookies and local storage

We use a small number of necessary cookies and local-storage entries for authentication and UI preferences. If analytics is enabled, Google Analytics storage is optional and remains off until you consent. See our Cookie Policy for details and controls. We do not use advertising cookies.

7. Security

We protect data in transit with TLS, store passwords and API keys hashed, and restrict access to production data to authorised personnel. No system is perfectly secure; we will notify affected users and the relevant supervisory authority of any notifiable breach as required by law.

8. Vessel data

Vessel positions and voyage data shown in the Service relate to ships and are drawn from AIS broadcasts and public sources (see our Data Policy). Where such data can be associated with an identifiable individual (for example the owner of a small vessel), we process it in our legitimate interest of providing maritime transparency, based on information the vessel itself broadcasts publicly.

9. Changes

We may update this Policy from time to time. Material changes will be notified by email or in-app notice before they take effect.

10. Contact

Questions about this Policy or our data practices can be sent to navtrac@citsltd.uk or by post to CITS LTD, Unit 7 Initial Business Centre, Wilsons Business Park, Manchester M40 8WN, United Kingdom.