Privacy Policy

This Privacy Policy explains how Berth Right MGMT LLC, a Florida limited liability company doing business as BerthRight (“BerthRight,” “we,” “us”), with its business address at 741 West Ave, Ocean City, New Jersey 08226, handles personal information.

We handle personal information in two very different roles, and this policy is organized around that split:

If you are a boater, start with your marina. Your marina holds and controls your records; contact it first. If you contact us instead, we will forward your request to the marina and help it respond, but we will not act on a marina’s data on our own. Section 13 explains this in full.

1. Scope and How to Read This Policy

1.1 What this policy covers. Sections 2 through 11 (Part A) describe the personal information for which BerthRight is the controller — the “business” under California law. Sections 12 through 14 (Part B) describe the personal information we process on behalf of a Marina Operator. Sections 15 through 20 apply to both.

1.2 Related documents. This policy should be read together with our Terms of Service, our Cookie and Tracking Notice, our Subprocessor List, our Data Export and Deletion Policy, our Security Overview, and, for Marina Operators, our Data Processing Addendum. Where the Data Processing Addendum and this policy differ with respect to a Marina Operator’s data, the Data Processing Addendum controls.

1.3 Where we operate. BerthRight is offered in the United States, and the information described in this policy is stored in the United States. Section 15 describes the one circumstance in which it is accessed from outside the United States.

Part A — Information BerthRight Controls

This Part applies to our marketing website, to prospects and leads, to marina account contacts and Authorized Users, to support correspondence, and to the billing relationship between BerthRight and a paying marina. It does not apply to a boater’s records inside a marina’s account — see Part B.

2. Information We Collect and Where It Comes From

2.1 Information you give us

• Prospect and lead information submitted through our get-started or contact forms: your name, email address, phone number, marina name, marina location, marina website, approximate slip count, the software you use today, and anything you choose to write in the free-text field.
• Marina account contact information: the name, business email address, phone number, and role of each person a Marina Operator authorizes to use the platform, together with the marina’s business address.
• Support and other correspondence: the content of emails, phone calls, and support requests you send us, including any information you choose to include in them.
• Billing information for our own invoices to a paying marina: billing contact, billing address, subscription plan, slip count, invoice and payment history.
• Communication preferences, including SMS and email opt-in and opt-out records (see Section 5).

2.2 Information collected automatically

• Server and application log data generated when you use our site or the platform: IP address, browser type and version, operating system, the pages or endpoints requested, timestamps, and referring URLs. We use this to operate the service, investigate errors, and detect abuse.
• Strictly necessary cookies only — authentication, request routing, and bot protection. See Section 4.

We do not collect location data from your device, and we do not run analytics, advertising, or session-replay tools. Version 1.0 of this policy listed “approximate location data” among the information collected automatically. That was not accurate as to the deployed product, and the statement has been removed.

2.3 Information from third parties

• Payment confirmation data from our payment processor — confirmation that a payment succeeded or failed, the last four digits and brand of a card, and related transaction metadata. We do not receive, transmit, or store full payment card numbers or card verification values.
• Authentication events from our authentication provider — sign-in, sign-out, and multi-factor authentication records associated with an account.
• Message delivery events from our email and SMS providers — whether a message was delivered, bounced, or opted out.

3. How We Use That Information

We use the information described in Section 2 to:

• respond to your inquiry, schedule a demonstration, and follow up on a lead;
• create, provision, administer, and secure a marina’s BerthRight account, including authentication and multi-factor authentication;
• provide support and respond to your correspondence;
• bill a Marina Operator for its subscription, collect payment, and keep the accounting and tax records that requires;
• send transactional and service messages, and marketing messages you have opted in to receive (see Section 5);
• operate, maintain, troubleshoot, secure, and improve the platform, including detecting and preventing fraud, abuse, and unauthorized access;
• comply with our legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims; and
• enforce our Terms of Service and Acceptable Use Policy.

We do not use this information for advertising, we do not build advertising profiles, and we do not use it to make automated decisions that produce legal or similarly significant effects about you.

4. Cookies and Tracking Technologies

The only cookies used on our site are strictly necessary ones: authentication (to keep you signed in), request routing (to route traffic correctly across our hosting infrastructure), and bot protection (to protect public forms from automated abuse). We do not use analytics cookies, advertising pixels, or session-replay tools.

Our Cookie and Tracking Notice lists each cookie, its provider, its purpose, and its duration, and describes your browser-level choices. If we ever add a cookie or technology outside the strictly necessary category, we will update that notice before it goes live.

5. SMS / Text Message Communications

Consent. When you submit an inquiry form or create an account on BerthRight or a marina operated using BerthRight, you may opt in to receive SMS messages by checking a clearly labeled, unchecked consent box and providing your mobile number.

Message types. If you opt in, you may receive text messages including: inquiry and reservation confirmations, slip availability notifications, payment and invoice reminders, dock arrival and check-in instructions, account verification codes, and service-related updates.

Frequency. Message frequency varies based on your activity and reservations.

Rates. Message and data rates may apply. Consent to receive SMS messages is not a condition of any purchase.

Opt-out. You can opt out at any time by replying STOP to any message. For assistance, reply HELP or contact us using the information in Section 20.

SMS data sharing. We do not share, sell, rent, or otherwise disclose your mobile phone number or SMS opt-in data to third parties or affiliates for marketing or promotional purposes. Phone numbers and consent records are shared only with service providers (such as Twilio) strictly to deliver the messages you have requested.

Who obtains consent for a marina’s messages. Where a message is sent by a Marina Operator through the platform, the Marina Operator is responsible for obtaining and documenting the consent required for that message and for honoring opt-outs; BerthRight supplies the consent-capture mechanism, the STOP and HELP handling, and the consent record. This allocation is set out in Section 6.7 of our Terms of Service.

6. How We Share Information — and What We Never Do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use those two words as the privacy statutes define them:

• To “sell” is to disclose personal information to a third party for monetary or other valuable consideration. We do not.
• To “share” is to disclose personal information to a third party for cross-context behavioral advertising — targeting ads to you across sites or services you did not interact with — whether or not money changes hands. We do not.

Disclosing information to a vendor that processes it only on our documented instructions, under a written contract that forbids using it for the vendor’s own purposes, is neither a sale nor a share. Those vendors are our service providers and subprocessors. We share information only as follows:

• Service providers and subprocessors who host the application, store the database, handle sign-in, deliver email and text messages, process payments, and serve media, under contractual confidentiality and data-protection obligations. We do not list them inline here, because an inline list goes stale: the current, maintained list is at berthright.app/subprocessors.
• The Marina Operator you contacted, when you submit an inquiry, reservation, or account request to that marina through the platform. From that point, the marina is the controller of that information — see Part B.
• Legal compliance, when required by law, subpoena, or government request, or where reasonably necessary to protect our rights, our users, or the public. We will not disclose more than the request requires.
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to customary confidentiality protections. If a transfer would materially change how your information is handled, we will say so before it takes effect.
• With your direction or consent, for anything else.

We do not disclose personal information to data brokers, advertising networks, or list-rental services, and we do not permit our service providers to use it for their own marketing.

7. How Long We Keep It

We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires. The table below states the period, or the criteria we use to determine the period, for each category we control.

We may keep information longer where a legal hold, subpoena, investigation, or pending claim requires it, and we may keep aggregated or de-identified data that no longer identifies anyone. Retention of data inside a marina’s account is governed by Part B and by our Data Export and Deletion Policy.

8. Your Rights Under State Privacy Laws

8.1 Who this section is for. Roughly twenty states have comprehensive consumer privacy laws in effect, including New Jersey (the New Jersey Data Privacy Act, effective January 15, 2025), Virginia, Colorado, Connecticut, Delaware, Oregon, Montana, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, New Hampshire, Iowa, Nebraska, Tennessee, and Texas. California is addressed separately in Section 9. This section applies to information for which BerthRight is the controller. If your information sits in a marina’s account, Section 13 tells you where to send your request.

8.2 Your rights. Subject to your state’s law and to verification, you may:

• confirm whether we process personal information about you, and access it;
• correct inaccurate personal information about you;
• delete personal information we hold about you;
• obtain a portable copy of personal information you provided to us, in a readily usable format, where processing is carried out by automated means; and
• opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects. As stated in Section 6, we do none of those things today, so there is nothing to opt out of — but the right stands, and if that ever changes we will provide a working opt-out before it does.

You may also withdraw consent for SMS messages at any time by replying STOP, and unsubscribe from marketing email using the link in any such message.

8.3 How to make a request. Email info@berthright.app or write to us at the address in Section 20. Tell us which right you are exercising and give us enough information to find your records. We respond within forty-five (45) days of receiving a request. Where reasonably necessary, we may extend that period once by an additional forty-five (45) days, and we will tell you within the first period if we do, and why. There is no charge for a request, unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline it and tell you why.

8.4 Verification. Before we act, we verify that the request comes from you. We do this by matching information you give us against the records we already hold — typically the email address or phone number associated with the information, and one or two additional data points. For a deletion request, or where the information is more sensitive, we may ask for more. We will not create an account for you, and we will not ask you for information we do not already hold, just to verify a request. If we cannot verify you, we will tell you why and treat the request as an opt-out where the law allows.

8.5 Authorized agents. You may use an authorized agent to make a request. We will ask the agent for written, signed permission from you, and we may contact you directly to confirm that you gave that permission and to verify your identity. An agent acting under a valid power of attorney does not need separate written permission.

8.6 Appealing a decision. If we decline your request, in whole or in part, you may appeal. Reply to our response, or write to info@berthright.app with “Privacy Appeal” in the subject line, within a reasonable time after our decision. An appeal is reviewed by someone other than the person who made the original decision. We will respond in writing within forty-five (45) days of receiving your appeal, explaining the action we have taken or declined to take and the reasons for it. If we deny the appeal, we will tell you how to contact your state Attorney General to submit a complaint, and you may do so.

8.7 No retaliation. We will not deny you a service, charge you a different price, or provide you a different level of service because you exercised a privacy right.

9. California Privacy Rights (CCPA / CPRA)

9.1 Our status. BerthRight does not currently meet the revenue or data-volume thresholds that make a business subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act. We publish this section, and honor the requests described in it as a matter of practice, because a California resident should not have to guess where we stand and because we would rather build the process before we need it. If we cross a threshold, this section becomes our compliance statement without further change.

9.2 Categories collected, sources, and purposes

In the twelve months preceding the effective date of this policy, we have collected the following categories of personal information as a controller. Categories not listed are not collected.

Sensitive personal information. The only sensitive personal information involved is account log-in credentials, which are held by our authentication provider and used solely to authenticate you and secure your account. We do not collect government identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric information, union membership, or the contents of your mail, email, or messages other than correspondence you send us. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit.

9.3 Categories disclosed

In the same period, we disclosed identifiers, commercial information, and internet activity information for a business purpose only, and only to service providers under written contracts that prohibit them from using the information for their own purposes. Those service providers are listed at berthright.app/subprocessors. We have not sold personal information, and we have not shared personal information for cross-context behavioral advertising, in the preceding twelve months — and we do not do so today. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

9.4 Your California rights

• Right to know the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes, and the categories of third parties to whom we disclosed it.
• Right to access a copy of that personal information, in a portable and readily usable format where technically feasible.
• Right to delete personal information we collected from you, subject to the exceptions the statute allows.
• Right to correct inaccurate personal information we hold about you.
• Right to opt out of the sale or sharing of personal information. We do neither, so we do not provide a “Do Not Sell or Share My Personal Information” link; if that changes, we will provide one and honor it.
• Right to limit the use and disclosure of sensitive personal information. We use sensitive personal information only to authenticate you and secure your account, which is a use the statute permits without a limitation right, so there is nothing further to limit.
• Right to non-discrimination for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

9.5 How to exercise them, verification, and agents

Submit a request by emailing info@berthright.app or writing to the address in Section 20. We confirm receipt within ten (10) business days and respond within forty-five (45) days, extendable once by a further forty-five (45) days with notice to you. We verify your identity as described in Section 8.4 — matching information you provide against records we already hold, with a higher degree of certainty required for a deletion request or a request for specific pieces of information. An authorized agent may submit a request on your behalf as described in Section 8.5. If we deny a request, Section 8.6 explains how to appeal.

10. Universal Opt-Out Signals and Global Privacy Control

Several states require a covered business to honor universal opt-out preference signals, such as Global Privacy Control (GPC), as an opt-out of the sale or sharing of personal information. We are not currently required to honor those signals, because we do not meet the applicability thresholds under the laws that mandate it — and because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing for such a signal to opt out of today. If our practices or our regulatory status change, we will honor GPC and equivalent signals, and we will update this section and our Cookie and Tracking Notice before that change takes effect.

11. Children's Privacy

BerthRight is a business tool for marinas. It is not directed to children, and we do not knowingly collect personal information from children under 13 as those terms are used in the Children’s Online Privacy Protection Act (COPPA).

Several state laws go further, restricting targeted advertising to, and the sale or sharing of the personal information of, minors under 16 and in some states under 18, and requiring consent before such processing. We do not engage in targeted advertising, and we do not sell or share the personal information of any user, minor or adult — so those consent requirements have no processing of ours to attach to.

Families visit marinas, and a marina’s records may name a child — a second guest on a reservation, for example. Information inside a marina’s account is controlled by that marina under Part B, and questions about it should go to the marina. If you are a parent or guardian and believe a child’s personal information has reached us in a context where we are the controller, contact us at info@berthright.app and we will delete it.

Part B — Information BerthRight Processes for a Marina

This Part applies to everything a Marina Operator puts into the platform about its own boaters and its own business.

12. The Marina Is the Controller

12.1 Roles. Boater records, vessel records, slip and storage assignments, reservations, waitlist entries, invoices, payment history, messages and consent records, documents, and reports generated from them are the Marina Operator’s data. The Marina Operator is the controller (the “business” under California law) and decides what is collected, why, how long it is kept, and who may see it. BerthRight is the processor (the “service provider”) and handles that information only on the marina’s documented instructions.

12.2 What governs it. That information is governed by the marina’s own privacy policy and by our Data Processing Addendum with the marina — not by Part A of this policy. If you want to know why your marina holds a piece of information about you, or how long it will keep it, ask the marina.

12.3 What we do not do with it. We do not sell it. We do not share it for advertising. We do not use it to market to boaters on our own behalf, and we do not use one marina’s data to serve another. We use it to run the platform for that marina, to keep it secure, to support it, and to bill the marina — and for nothing else, except aggregated and de-identified statistics that no longer identify any marina, any boater, or any vessel.

12.4 A marina’s own account contacts. Information about the people who administer a marina’s account — their names, work email addresses, and sign-in records — sits in both roles at once: we control it as our customer contact and authentication data (Part A), and the marina controls it as its own personnel record (Part B).

13. If You Are a Boater and Want to Exercise a Right

Contact your marina first. The marina controls your records. It can look them up, correct them, export them, and delete them directly, and it is the party your privacy rights run against for that information.

If you contact us anyway, here is exactly what we will do. We will acknowledge you, identify the marina your request concerns, forward the request to that marina, tell you that we have done so, and assist the marina in responding using the tooling and support described in our Data Processing Addendum and our Data Export and Deletion Policy.

What we will not do is act on a marina’s data unilaterally. We will not delete, correct, disclose, or export a boater’s record on the boater’s instruction alone, because doing so would override the decision of the party that is legally responsible for it — and could destroy a record the marina is required to keep. That is a deliberate limit on our own authority, not an attempt to avoid your request.

Two things you can always do directly, wherever the message came from: reply STOP to any text message to stop receiving them, and use the unsubscribe link in any marketing email. Those take effect immediately and do not require the marina.

14. Export and Deletion of a Marina’s Data

A Marina Operator may request a full export of its data at any time during an active subscription by writing to info@berthright.app. Export is request-based today, delivered in CSV, JSON, or SQL format; a self-service export console is in development, and we will update our Data Export and Deletion Policy when it ships.

After a subscription ends, the export window stays open for 30 days. Data is then deleted from our live production systems within 30 days of that window closing, and is purged from encrypted backups as those backups roll off in line with our infrastructure provider’s retention configuration. The full timeline, the limited categories we retain afterward and why, and the public-records carve-out for municipal marinas are in the Data Export and Deletion Policy.

Applies to Both Parts

15. Where Information Is Stored, and Who Can Access It

15.1 Storage. All personal information described in this policy is stored in data centers located in the United States. Each of our infrastructure providers is configured to keep data in United States regions.

15.2 One cross-border access path, disclosed. We engage a contracted software development firm whose engineers are located outside the United States for software development, maintenance, and support engineering. To build the platform and to fix problems in it, those engineers sometimes need to look at real data in production systems. Their access is scoped to the specific task, granted at least privilege, individually credentialed — never a shared login — logged, and revoked when the task ends. Bulk export or download of personal information by contractor personnel is prohibited, and development environments use synthetic or de-identified data.

This is the only circumstance in which personal information is accessed from outside the United States, and no copy of it is kept abroad. We disclose it because you would want to know. The firm is identified to any Marina Operator on request, is listed on our Subprocessor List, and the full terms are in Section 13 of our Data Processing Addendum.

16. Artificial Intelligence

BerthRight does not currently use artificial-intelligence systems to process personal information. There is no AI assistant, no model-based analysis of customer records, and no automated decision-making that produces legal or similarly significant effects about any person.

If that changes, we will update this policy and our Subprocessor List before any such system goes live, and we will say plainly what it does and what data it touches. In any event, customer data will not be used to train third-party models.

17. How We Protect Information

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, multi-factor authentication, individually issued credentials, access logging, and payment processing handled directly by our payment processor so that card numbers never reach our systems. Our Security Overview describes these controls in more detail. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

18. Security Incidents

If a security incident affects personal information we process on behalf of a Marina Operator, we notify that marina without undue delay after confirming the incident, and where feasible within seventy-two (72) hours of confirmation, so that it can meet its own legal obligations; the notice contents, our cooperation obligations, and the sequencing of notices to individuals and regulators are set out in Section 10 of our Data Processing Addendum. For personal information we control ourselves, we notify affected individuals and the applicable regulators as and when applicable law requires.

19. Changes to This Policy

We may update this policy as our practices, the product, or the law change. The version number and dates at the top of this page always reflect the current version.

For material changes, we will give notice before the change takes effect — by email to account contacts, through the Service, or both — and every prior version stays available at a permanent URL so you can see exactly what applied at any point in time. Version 1.0 is archived at berthright.app/privacy/v1.

20. Contact Us

For questions about this policy, to exercise a privacy right, or to appeal a decision, contact:

To appeal a denied privacy request, write to the same address with “Privacy Appeal” in the subject line (Section 8.6). If you are a boater with a question about your records at a marina, please contact that marina (Section 13).