Privacy Policy

Updated October 20, 2026 · v2.5

1. Who we are and what this Policy covers

1.1 Operator

The controller (the owner of personal data under Ukrainian law) is the individual entrepreneur (sole proprietor, FOP) Oleinyk M.V., Odesa, Ukraine, registered under the law of Ukraine (hereinafter "we"). Contact for all data matters: support@marinehelper.com.

1.2 Services

This Policy covers:

• the marinehelper.com website (service descriptions, ordering and payment);
• the marinehelper.com/app web app (CV builder and personal account);
• the free CV check at marinehelper.com/en/seafarer-cv-check;
• the seafarer CV form section at marinehelper.com/en/seafarer-application-form (online form, examples and blank templates);
• the Marine Helper mobile app;
• your correspondence with us by e-mail and in messengers.

1.3 Applicable law

We process data under the law of Ukraine, including the Law of Ukraine "On Personal Data Protection". If you are in the European Economic Area or the UK, the GDPR and the UK GDPR apply in addition, and this Policy is written with their requirements in mind.

This Policy does not cover third-party websites we link to, or the processing of your CV by the companies that received it: they have their own rules.

2. What data we process

2.1 Account

E-mail address, password (stored only as a hash), name, phone number, messenger usernames (Viber, WhatsApp, Telegram).

2.2 CV data

Everything you enter in the CV builder or give us to prepare your CV:

• first and last name, gender, date of birth, citizenship, country and address of residence, contact details, photo;
• physical measurements for uniform sizing: height, weight, clothing and shoe size, hair and eye colour;
• name and contact of your next of kin for emergencies;
• maritime documents and certificates: type, number, issuing authority and date, validity period. They are part of the CV that we send to companies on your order;
• sea service history: vessels, IMO numbers, companies, positions, dates;
• positions sought, salary expectation, readiness date, English level.

2.3 Uploaded files

CV and application-form files in PDF and DOCX format that you upload for a check, for parsing or for CV preparation.

2.4 Orders and payments

The contents of the order, the amount, the currency, the payment provider's transaction id and its status, and the chosen mailing launch date. Card and wallet details are entered on the provider's page and never reach us.

For purchases in the mobile app — what Apple or Google sends us: the transaction id (for Google, the purchase token), the product, the purchase date and the subscription end date, the store country, the price and currency, and whether it was a test purchase. So that a purchase is credited to your account, the app passes the store your Marine Helper account id — without your name or e-mail address.

2.5 Support correspondence

Your e-mails and messages to us, our replies and their attachments — by e-mail and in messengers, if you contacted us there.

Messages you exchange with the AI assistant on the website and in the mobile app are stored with your account or guest session, together with any report you file about a reply. The assistant is not the place for document numbers or other personal data: it will ask you to enter them in the CV editor instead.

2.6 Reviews

The text of the review and your name, if you left a review and agreed to its publication.

2.7 Free CV check

To get a free check, you enter an e-mail address and upload a CV file. The file is parsed and analysed, including by AI models (section 5), and the result of the check is shown to you and sent to that address. A check on the marinehelper.com site does not create an account. A check in the web app or the mobile app creates a Marine Helper account on that address if you do not have one yet.

2.8 Partner program

For partner program participants, additionally: payout details, turnover, accrual and payout history, technical data of partner-link clicks. Details are in the agreement with the partner.

2.9 Technical data

• Server logs: IP address, browser user agent, time and address of the request — kept for up to 30 days.
• Cloudflare Turnstile on order forms — bot protection; the check is performed by Cloudflare.
• Google Ads click identifiers (gclid, wbraid, gbraid), if you came from an ad: saved on your first visit to attribute a registration or an order to the advertising campaign.
• Meta ad measurement: the Facebook or Instagram click identifier (fbclid), stored in the _fbc cookie if you came to the site from one of them, and the browser identifier in the _fbp cookie. Together with the page address, your IP address and browser user agent, they are sent to Meta Platforms via the Conversions API when you view pages and when you start placing an order.
• When you order a mailing and when you pay for an order, our server sends Meta, via the Conversions API, the order number, the payment amount and currency, the page address, the click identifier (_fbc), your IP address and browser user agent, and SHA-256 hashes of your e-mail address, phone number and account identifier. Both transfers are used to measure advertising and to show it to people who may be interested in our services; section 10.3 explains how to turn off the transfer from the site's pages.
• Mobile app crash reports and performance data (technical details about the error, the request and the device) via New Relic.
• The device's push notification token (Apple Push Notification service, Firebase Cloud Messaging) — to send you notifications about mailings, company replies and document expiry dates. Notifications can be turned off in the device settings.
• Anonymised, cookieless product analytics (section 11).
• The cookies listed in section 10.

2.10 Document vault

If you use the document vault in the mobile or web app:

• scans, photos and PDF files of your seafarer documents — passport, seaman's book, certificates of competency and other certificates, visas, medical documents — and small previews of them. Metadata (EXIF: location, device, time taken) is removed from photos on upload;
• details from the document, read by AI or entered by you: document type, title, number, issuing authority and country, issue and expiry dates, holder's name;
• shared folders you create: name, note, contents, link expiry and a PIN stored only as a hash; folder events — view, open, download, wrong PIN — with the visitor's country, device type and the site they came from. The visitor's IP address and browser are not stored: only a one-way hash of them is kept, to count unique visitors.

Medical documents may contain health information. You upload them by your own choice, and we use them only to store them, to remind you of their dates and to pass them to those you share them with yourself.

3. Where the data comes from

• From you: at registration, in the CV builder, in the order form, when uploading files, in correspondence and reviews.
• From your device: the technical data in section 2.9 and the cookies in section 10.
• From payment providers: the transaction id and status after payment.
• From Apple and Google: the confirmation of an in-app purchase (section 2.4).
• From the partner link you followed: only the click marker (section 10), with no other information about you.

4. Why we process data and on what legal basis

We ask for consent to data processing once — at registration, with a required checkbox that links to the Terms of Service and this Policy. Under the law of Ukraine, processing is based on that consent and on the contract with us. For users in the EEA and the UK, the GDPR basis for each purpose is given below.

1. Registration, sign-in and account management, CV builder — performance of a contract (the Terms of Service).
2. Fulfilling orders: CV preparation, mailing to companies, consultation — performance of a contract.
3. Candidate selection: assessing the CV and providing it to companies, including for a fee paid by them — your consent, which you give by submitting the CV for selection; it can be withdrawn at any time by leaving the selection.
4. Free CV check — performance of a contract: you requested the service, and it cannot be provided without processing the file.
5. Taking payment, refunds, issuing documents, accounting — performance of a contract and compliance with a legal obligation.
6. Support and replies to your enquiries — performance of a contract and our legitimate interest in answering users.
7. E-mail reminders about an unfinished CV or order, and our newsletters — news of the service, promotions and promo codes — legitimate interest in helping you finish what you started and in telling existing users what is new; you can opt out at any time (section 9).
8. Security: bot and fraud protection, server logs, incident investigation — legitimate interest in protecting the service and its users.
9. Product analytics — legitimate interest in understanding how the services are used; the analytics is anonymised (section 11).
10. Traffic attribution and ad measurement: Google Ads clicks, Meta ad measurement (the _fbp and _fbc cookies, page view, order and payment events) and partner-link visits — legitimate interest in measuring advertising, showing it to people who may be interested in our services and crediting partners correctly.
11. Partner program: accruals, payouts and the checks provided for in the agreement with the partner — performance of the contract with the partner and compliance with legal obligations, including sanctions restrictions.
12. Publishing reviews with your name — consent, which you give when submitting the review; it can be withdrawn.
13. App crash reports — legitimate interest in fixing errors.
14. Responding to lawful requests from authorities, keeping records required by law — compliance with a legal obligation.
15. Protecting our rights: disputes, claims, chargebacks — legitimate interest.
16. Document vault: storing documents, AI reading of their details, expiry reminders, shared folders and notifications of their views — performance of the contract: you use the function by your own choice. Health information in medical documents — on the basis of your explicit consent, which you give by uploading such a document; you withdraw it by deleting the document.
17. Push notifications in the mobile app — performance of the contract; notifications can be turned off in the device settings.

5. Automated processing and artificial intelligence

• Uploaded CV files and CV data are parsed and checked with AI models from third-party providers — OpenAI, Google (Gemini), Anthropic and xAI. The providers receive the CV content needed for the analysis and process it under a contract with us as processors, which does not allow them to use it for their own purposes.
• The AI assistant on the website and in the mobile app answers with the same providers' models. It receives your messages and the service information needed to answer, never your documents. Every reply can be reported from the chat, and a person reviews the report.
• Vault documents are read by the Google Gemini model: it receives the image of the document without its file name and determines its type, number and dates. On iPhone and Android the app may first read the document's text on the device itself (Apple Vision, Google ML Kit); that text is not sent to our servers. Recognition of document titles is improved from users' corrections without identifying anyone: a rule is not linked to any account and is switched on only when at least three different seafarers have made the same correction.
• AI is also used to match CVs to vacancies, to draft e-mail reminders (for example, about an incomplete profile) and to draft support replies.
• No decision that has legal or similarly significant effects on you is made solely automatically. CV check results are recommendations, not decisions. At your request, a person will review any automated result: write to support@marinehelper.com.

6. Who we share data with

6.1 Crewing companies and shipowners

When you order a mailing, we send your CV with your contact details by e-mail to the companies in the packages you have chosen. That is the very purpose of the service, therefore:

• each recipient company becomes an independent controller of the data and processes the CV under its own rules; we do not control how it stores or uses it;
• a sent e-mail cannot be recalled;
• we provide the list of companies that received your CV at your request.

If you take part in candidate selection, we provide your CV with your contact details to companies that pay us for access to the CVs of selected candidates. Each such company also becomes an independent controller of the data. You can leave the selection at any time — after that we stop offering your CV to new companies; a CV already provided to a company cannot be recalled.

Companies receive documents from your vault only if you share them yourself: through a link to a shared folder — with or without a PIN, for the period you set — or with your separate consent to disclose documents to a company you have applied to. A visitor who opens the folder sees your name (unless you hide it) and the type, title, number and dates of the documents. Every view and every download is recorded, and we notify you of the first view. You can close the link at any time, but a downloaded copy cannot be recalled.

6.2 Processors (service providers)

They process data on our instructions and may not use it for their own purposes:

• hosting providers for our servers;
• Cloudflare — content delivery network, caching, bot protection, e-mail routing, file storage (Cloudflare R2);
• e-mail delivery providers (SMTP relays, Amazon SES) — sending mailings and notifications;
• payment providers — Monobank (plata by mono) and Heleket;
• AI model providers — OpenAI, Google (Gemini), Anthropic and xAI;
• New Relic — mobile app crash reports and performance monitoring;
• Apple and Google — mobile app distribution, payment for in-app purchases, delivery of push notifications.

6.3 Messengers

If you write to us in Telegram, Viber or WhatsApp, the correspondence passes through those services under their rules.

6.4 Public authorities

We disclose data on a lawful demand from a court, a law enforcement body or another authorised authority, and only to the extent the law requires.

6.5 Business transfer

If the business or part of it is sold, reorganised or transferred to a successor, the data passes to the successor on the terms of this Policy. We will notify you of such a transfer.

6.6 Meta Platforms

To measure advertising, we send Meta Platforms (Facebook, Instagram) the data described in section 2.9: page views, the start of placing an order, orders and payments. Meta processes it under the Meta Business Tools Terms and the Meta Privacy Policy, including to show ads to people who may be interested in our services.

7. International data transfers

Some of our processors are located outside Ukraine and the European Economic Area, primarily in the USA. Transfers to them rely on the providers' contractual safeguards (standard contractual clauses) and on the necessity of fulfilling your order. Meta Platforms, which receives the advertising measurement data (section 6.6), also processes it outside Ukraine, including in the USA.

The companies that receive mailings are located all over the world. Transferring the CV to a company's country is necessary to perform the contract concluded with you: you choose the packages those companies belong to yourself. In candidate selection, the CV is transferred to companies all over the world on the basis of your consent.

8. Retention periods

• Account and CV data — while the account exists. After a deletion request the account is anonymised within 30 days.
• Orders and payments — 3 years after the order (Ukrainian accounting requirements).
• Log of mailings and of CVs provided through candidate selection (which company received which CV, and when) — 3 years.
• Support correspondence — 3 years.
• Vault documents — until you delete them or while the account exists. A document you delete is erased from storage at once. When the account is deleted, its vault documents are moved to a closed archive and kept there for one year from the deletion — to settle disputes and answer lawful requests — and then deleted.
• Shared folders and their view log — up to 180 days after the folder is closed or its link expires.
• Server logs — 30 days.
• The _fbp and _fbc cookies — 90 days. Meta keeps the events it has received under its own terms.
• Backups — up to 30 days; deleted data disappears from the backups once that period ends.
• Anonymised analytics — indefinitely; it contains no personal data.

If there is a legal ground to keep data longer (for example, a dispute or a demand from an authority), we keep it until that ground ends.

9. Your rights and how to exercise them

9.1 Rights

• Access — to learn what data about you we process and to receive a copy of it.
• Rectification — to correct inaccurate or incomplete data; you can edit your CV yourself in the account.
• Erasure — to delete the account and the data, if we have no legal obligation to keep them (section 8).
• Restriction of processing — while a dispute about the accuracy of the data or the lawfulness of processing is pending.
• Objection — to processing based on legitimate interest, including reminders.
• Portability — to receive your CV data in a machine-readable format.
• Withdrawal of consent — at any time; processing carried out before withdrawal remains lawful.
• Complaint — to the supervisory authority (section 9.3).

9.2 How to make a request

Write to support@marinehelper.com from the address linked to your account. We may ask you to confirm your identity so that data is not handed to a stranger. We reply within 30 days. You can delete the account yourself at any time — in the app, Profile → Delete account; what happens and how long it takes is set out in Deleting an account. Data export is available in the account settings or by e-mail.

You can opt out of reminders and our other e-mails by writing to unsubscribe@marinehelper.com or support@marinehelper.com.

9.3 Supervisory authorities

In Ukraine, the Ukrainian Parliament Commissioner for Human Rights. If you are in the EEA or the UK, you may contact the data protection authority of your country. We would appreciate it if you gave us the chance to resolve the matter first.

10. Cookies and similar technologies

We use cookies for the services to work, for your preferences, for tracking partner referrals and for measuring advertising.

10.1 Essential

• sessionId — the account sign-in session.
• _csrf — protects forms against request forgery.
• __cf_bm, cf_clearance — Cloudflare security cookies (bot protection).

10.2 Preferences

Kept for 12 months on the parent domain .marinehelper.com, so they apply on all our sites:

• nuxt-color-mode — light or dark theme;
• user_locale — interface language;
• user_theme_id — the chosen colour theme;
• user_radius_scale — the corner-rounding setting for interface elements.

10.3 Attribution

• x_bro_ref_id — the referral or partner link marker, 12 months. Needed to credit the partner who invited you.
• _fbp — the browser identifier for Meta ad measurement, 90 days. A first-party cookie of marinehelper.com, set by our server when you open a page.
• _fbc — the Facebook or Instagram click identifier (fbclid), 90 days. A first-party cookie of marinehelper.com, set when you come to the site from Facebook or Instagram, for example through an ad.

With these cookies, the site sends page views and the start of placing an order to Meta (section 2.9). If your browser sends the Global Privacy Control signal, our server does not set _fbp and does not send these events. You can also delete or block these cookies in your browser settings.

10.4 Other technologies

Cloudflare Turnstile on order forms, Google Ads click identifiers, the events sent to Meta and New Relic reports are described in section 2.9. You can delete or block cookies in your browser settings; without the essential cookies, signing in and submitting forms will not work.

11. Product analytics

We keep our own visit analytics, without cookies and without third-party services:

• a visitor is counted as a hash of the site, the IP address and the user agent with a salt that changes every day and is deleted after two days; the IP address and the user agent themselves are not stored;
• sessions are stitched at the network edge, not on your device;
• signed-in users are counted under a pseudonym derived with a persistent secret, not under their e-mail address;
• Do Not Track and Global Privacy Control signals are honoured;
• search terms are kept only when they look topical.

12. Security

• The connection to the sites and apps is protected by HTTPS (TLS).
• Passwords are stored only as a hash; card and wallet details never reach us.
• Access to data is limited to those who need it for their work; the sites run through the Cloudflare network, which filters malicious traffic.
• Vault documents are kept in private storage and open only through temporary links that work for 15 minutes.
• Backups are kept for up to 30 days.
• If an incident affects your data, we will notify you and the supervisory authority where the law requires it.

Complete security cannot be guaranteed; keep your password safe and tell us about any suspicious activity in your account.

13. Children

The services are intended for persons aged 18 and over. We do not knowingly collect data of minors; if we learn that an account belongs to a person under 18, we will delete their data.

14. Changes to this Policy

We may update this Policy. A new version takes effect from the date of its publication on this page, unless it states a later date; the number and date of the version in force are given at the top of the document. The current version is always published on this page.

15. Contact

• support@marinehelper.com — all questions and requests about personal data.
• FOP Oleinyk M.V., Odesa, Ukraine.