Privacy Policy

The data controller is BATOO S.R.L., Corso Venezia 54, 20121 Milan (MI), Italy, VAT and tax code 14748130961. Contact privacy@batoo.it; certified e-mail: batoo@legalmail.it.

This policy covers batoo.it, batoo.show, related account and analytics areas, APIs, and Batoo’s official MCP server. Data comes from you, your device and browser, advertisers and brokers, or nautical catalogues and feeds supplied by Batoo, EasyMLS, and other authorized providers.

Professional and listing information already made public by shipyards, brokers, or sellers may be indexed and normalized to make the catalogue searchable. Anyone publishing third-party data must be entitled to do so and provide the required notices.

• Identity and contact data: name, surname, e-mail, phone, company, website, location, and professional role.
• Account and security data: Firebase identifier, sign-in provider, verification status, session token, access events, and abuse-prevention data.
• Listings and content: specifications, price, location, images, documents, and contact details associated with new or used boats, drafts, favorites, and comparisons.
• Requests and leads: boat of interest, message, possible trade-in, consent to offers from similar brokers, and delivery status.
• Payments and subscriptions: customer, plan, payment status, invoices, and Stripe identifiers. Batoo does not receive the full card number.
• Newsletter and marketing: e-mail, language, user type, source, and proof of consent.
• Service usage: pages, searches, filters, interactions, referrals, online identifiers, IP address, user agent, technical logs, and cookie preferences.
• AI and MCP requests: search text, filters, public listing identifiers, language, technical parameters, and logs needed to deliver and protect the service.

• Provide the marketplace, search, comparisons, accounts, listings, professional analytics tools, and MCP: performance of a contract or pre-contractual steps.
• Send a request to the selected broker or seller and, only if requested, similar brokers: performance of your request and consent for the additional sharing.
• Manage payments, invoices, subscriptions, and tax duties: contract and legal obligation.
• Protect systems and users, prevent fraud and abuse, defend rights, and improve reliability and performance: legitimate interests balanced against your rights.
• Send newsletters and promotions or create advertising profiles: consent, which may be withdrawn at any time.
• Measure usage with third-party analytics: consent collected through the banner, except for any aggregate technical statistics that do not identify users.
• Handle enquiries, complaints, and authority requests: pre-contractual steps, legal obligation, or legitimate interest.

Fields marked as required are needed to complete the requested function. Without them, we may be unable to create an account, publish a listing, forward a contact, or deliver a purchased service.

Batoo aggregates and normalizes boat data from its backend and integrated sources, including EasyMLS. Source and availability may change as feeds are refreshed. Public listing data may appear on the website, SEO pages, search results, feeds, and through the MCP server.

When you submit a boat enquiry, the necessary data is shared with the broker, shipyard, or seller named in the listing, who may act as an independent controller for later commercial follow-up. The option to contact similar brokers is separate and never enabled automatically.

Some natural-language search and assistant features may send the text you enter and the strictly necessary context to OpenAI or AI services configured by Batoo. Do not enter sensitive or confidential information. Automated results are suggestions and should be checked.

Batoo’s public MCP server lets ChatGPT, Codex, and other compatible clients search and read public catalogue data. It does not require a Batoo account, and responses are designed to exclude private contact details, authentication secrets, and unnecessary internal identifiers. Batoo may log IP address, time, requested tool, parameters, and technical result for security, diagnostics, and rate limiting.

The assistant or client provider through which you use the MCP processes your conversation under its own privacy policy. Batoo does not receive your ChatGPT password or account credentials; it receives only the technical request forwarded to the server.

Depending on the features actually used, data may be processed by authorized personnel and contracted providers for hosting and infrastructure (Vercel and Hetzner), authentication and cloud services (Google Firebase and Google Cloud), content management (Sanity), payments (Stripe), e-mail and marketing (Brevo), AI (OpenAI), consent-based analytics (Google Analytics), and consent-based advertising (Google Ads, Google Tag Manager, and Meta).

Recipients may also include brokers, shipyards, sellers, and catalogue providers involved in a request, professional advisers, authorities, or parties to whom disclosure is required for law, security, or the protection of rights.

Some providers may process data outside the European Economic Area. Depending on the service, Batoo relies on adequacy decisions, the EU–US Data Privacy Framework, standard contractual clauses, and supplementary measures required by law. You may ask privacy@batoo.it about applicable safeguards.

• Accounts and listings are kept while active and as needed to handle closure, disputes, and legal duties.
• Leads and enquiries are kept to handle and evidence delivery and protect the parties, then deleted or anonymized under internal cycles and applicable duties.
• Accounting and payment data is kept for statutory tax and civil-law periods.
• Marketing data is used until consent is withdrawn or after a defined period of inactivity; proof of consent may be kept to establish or defend legal claims.
• Technical, security, API, and MCP logs are rotated and retained as needed for security, diagnostics, and abuse prevention, unless an incident or legal duty requires longer storage.
• Cookies and browser storage follow the periods in the Cookie Policy and are removed or disabled when the relevant consent is withdrawn.

You may request access, correction, deletion, restriction, portability, and objection, and may withdraw consent without affecting earlier processing. You may also seek clarification about automated decisions and lodge a complaint with the Italian Data Protection Authority or your competent supervisory authority.

Send requests to privacy@batoo.it. We may ask for reasonable information to verify your identity and will respond within GDPR time limits.

Search, ranking, and recommendations may order listings by relevance, features, quality and, if you consented to marketing, interest signals. Sponsored content is identified. These activities do not produce legal or similarly significant effects on individuals.

We use proportionate technical and organizational measures, including access control, transport encryption, minimization, backups, and monitoring. No system is risk-free. Batoo is not intended for people under 18 and does not knowingly collect their data to create accounts or enter services.

We may update this policy when services, providers, or laws change. The date above identifies the current version, and material changes will also receive appropriate notice. For privacy questions, contact privacy@batoo.it.