PRIVACY
What we hold, and who else sees it
Last reviewed September 24, 2026.
These pages describe how chartermarks works today. They are not a contract on their own — an association's agreement with us is the signed one, and where the two differ the signed one governs.
Two kinds of data, and they are not the same
Almost everything in chartermarks belongs to an association rather than to us. Their member companies, contacts, fleet figures, invoices, minutes and survey answers are theirs; we hold them so the software can do its job, and we act on their instructions. In data protection terms the association is the controller and we are the processor.
The small remainder is ours: the accounts of the people who sign in, and the record of what they did. That is covered here too, but it is a much shorter list.
What an association's data includes
- Member companies and their contacts — names, email addresses, telephone numbers, postal addresses.
- Figures the association counts, such as fleet sizes, and the answers members give on renewal and survey forms.
- Invoices, payments and the notes attached to them.
- Board and committee minutes, and the decisions recorded in them.
- Class registrations, including the license numbers of people being certified.
- Everything published on the association's own website, and every earlier version of it.
An association decides what to collect. We do not add fields to their records or use their data to build anything of our own.
Who else sees it
These are the only third parties that receive any data, and each one receives only what its job requires.
| Service | What it receives |
|---|---|
| DigitalOcean | Hosting and file storage. Everything in the database and every uploaded image lives here, in the United States. |
| Cloudflare | Domain name service. Sees the addresses people request, not the contents of any page. |
| Resend | Email delivery. Receives the address, subject and body of every message an association sends through us. |
| Stripe | Card payments, where an association has connected an account. Receives the amount and an invoice reference. Card numbers never reach us — they are typed on Stripe's own page. |
| Anthropic | Assisted drafting only, and only when a person asks for it. See below. |
| Google Fonts | Typefaces. A visitor's browser fetches fonts from Google, which means Google sees that visitor's IP address and which page loaded. Nothing else is sent. |
| YouTube | Only on pages where an association has embedded a video, and only when that page is loaded. |
There is no analytics service, no advertising pixel and no tracker of any kind.
Assisted drafting
Some features can draft text — a welcome note, a summary, the sessions read out of a conference program somebody pasted in. Where they do, the relevant text is sent to Anthropic's API and a draft comes back.
- It never happens on its own. A person asks for it, every time.
- Nothing drafted is published automatically. A person accepts, edits or rejects it first.
- Every feature works without it. With no key configured the software runs degraded, never broken.
- Each call is recorded against the association — which model, what it was for, and what it cost — so nobody is surprised by a bill or by what was sent.
Cookies
Every cookie we set is our own, signed so its contents cannot be altered, and set for one of these reasons. None of them is used for advertising or measurement.
- Signing in — keeps somebody signed in between pages.
- Opening a bill, a renewal form, a survey or a preview link — each of these arrives as a single-use link, which is exchanged for a cookie immediately so the address stops carrying it. That is why the token appears in a URL exactly once and never reaches a browser history, a referrer header or a screenshot of the address bar.
- Starting a card payment — holds what is being paid while the payer is on the processor's page.
How long we keep things
Indefinitely, and by design in two places.
- Published pages are kept, with their version history, so an association can always see and restore what it said before.
- The activity record is append-only. Entries are never edited or deleted, because its value is that it cannot be tidied after the fact.
Everything else is kept until an association asks us to remove it.
Getting data out, and getting it deleted
An association's data is theirs to take. Ask and we will export it in a usable format. Ask us to delete it and we will, with two caveats we will state at the time: financial records an association may be required to keep, and the append-only activity record, which we would remove wholesale rather than editing entries out of.
If you are a member of an association rather than a customer of ours, write to your association first — it is their record, and they can change or remove it themselves.
Children
This software is for the staff and members of trade associations. It is not intended for children and we do not knowingly collect anything from them.
Questions
Write to hello@chartermarks.com and a person will answer.