Privacy Policy

From website visitors and enquirers:

From client submissions to Nautilux and to our survey and advisory work:

We ask clients not to upload personal data the engagement does not need. Where the work can be delivered from redacted crew documents, we prefer redacted documents.

Crew data is personal data, and parts of it are treated as sensitive personal data in some jurisdictions. We handle it accordingly.

Material uploaded to Nautilux is analyzed by automated systems, including large language model and vision model processing delivered through Microsoft Azure OpenAI Service. This includes documents and photographs that may contain personal data.

We use a limited set of cookies and privacy-conscious analytics to understand how the website is used and to keep it performing. We do not run advertising cookies or cross-site advertising trackers on this site. You can control cookies through your browser settings, and disabling some may affect how the site functions.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information with a small number of service providers who process it on our behalf under contract:

A current, named sub-processor list, with processing locations, is available on request and is provided to clients at onboarding. We tell clients before adding a sub-processor that will handle their material. We may also disclose information where required by law, regulation, court order or valid legal process, and to protect the rights, safety and property of SolarisTech, our clients or others. Where an engagement is instructed by a lender, insurer, law firm or administration rather than by the vessel's owner, the report goes to the party who instructed it, and we identify that party before the work starts.

Website enquiry data is kept for as long as needed to deal with the enquiry and for a reasonable follow-up period, then deleted. Engagement material, including client-uploaded documents and images, is retained for the period stated in the engagement documents. Where nothing else is agreed, our default is seven years from delivery of the final report, reflecting the limitation periods and record-keeping expectations that apply to survey and inspection work. A client may request earlier deletion of uploaded material.

We act on that request unless we are required to retain it by law, by a legal hold, or because a claim remains unresolved, and we tell you which applies. Deletion covers primary storage and propagates to backups on the normal backup cycle. The final report, and the record that the engagement took place, are retained even where source material is deleted. We apply the safeguards described in our Information Security and Data Protection Policy to all personal information we hold. We do not hold SOC 2 or ISO/IEC 27001 certification and we do not claim either.

Depending on where you are, you may have rights to access, correct, delete, port or restrict the use of your personal information, to object to certain processing, and to complain to a supervisory authority. In California you may also have rights of access, deletion, correction and to limit sharing. We do not sell personal information. If you are a seafarer whose data was uploaded to us by an employer or manager, we will normally pass your request to that client, because they instructed the processing and hold the relationship with you, and we will tell you that we have done so.

SolarisTech operates from the United States and South Korea and uses cloud infrastructure in more than one country, so personal information may be processed outside the country where it was collected. Where personal data is transferred from the European Economic Area, the United Kingdom or Korea, we rely on the transfer mechanisms available under the applicable law, including standard contractual clauses with our providers. We can describe the arrangement in place for your account on request.