Subprocessors

What this page is

BerthRight is marina management software. Marinas — we call them Marina Operators — use BerthRight to manage slips, reservations, storage, service work, billing, and communications with their boater customers.

To deliver that software, BerthRight relies on a small number of specialized technology companies. They host the application, store the database, handle sign-in, deliver email and text messages, process payments, and serve images and video. In privacy law these companies are called subprocessors, because they process data on BerthRight’s behalf, and BerthRight in turn processes it on the Marina Operator’s behalf.

In plain English: a subprocessor is a company BerthRight hires that may come into contact with your data in the course of making BerthRight work. We do not sell your data or your boaters’ data to anyone, and we do not share it for advertising. The companies below are vendors we pay to run infrastructure — not partners we hand data to.

This page lists every one of them. We publish it because you should not have to ask, and because our contract commits us to keeping it accurate.

Who owns the data. If you are a boater and you have a question about your personal information, please contact the marina you do business with. The marina controls its own customer records; BerthRight only stores and processes them on the marina’s instructions and cannot access, change, or delete a marina’s records at a boater’s request. If you write to us, we will point you back to the marina. If you are a Marina Operator, see the Data Processing Addendum for the full terms.

Current subprocessors

Infrastructure and platform

Payments

About payment card data. Full card numbers never reach BerthRight’s systems. When a boater pays, the card details go directly from their browser to Stripe through Stripe’s own hosted payment fields. BerthRight stores only a Stripe token, the card brand, the last four digits, and the expiration date — enough to show “Visa ending in 4242” on a screen and to charge a saved card through Stripe, and not enough to make a payment anywhere else. For card data, Stripe operates under the Marina Operator’s own direct agreement with Stripe.

Communications

Development and support

About our development partner — and why we tell you about it. BerthRight is a small company. Alongside our founder, we work with an established software development firm whose engineers are located outside the United States. We will identify the firm to any Marina Operator on request. Their engineers help build and support the platform, and to fix a problem in a marina’s account they sometimes need to look at real data.

We disclose this because you would want to know, and because a vendor who hides it is a vendor you cannot check. Concretely:

• Every engineer with access is named and has their own login — never a shared account.
• Access is limited to what a specific task requires, and it is logged and monitored.
• Access is revoked when an engineer leaves the project.
• Every engineer is individually bound by a written confidentiality agreement.
• Your data is stored in the United States. This is the only situation in which anyone outside the United States looks at it, and no copy is kept abroad.

The full terms are in Section 13 of the Data Processing Addendum.

Infrastructure providers’ own certifications

BerthRight does not operate its own data centers. The companies above that host data — Vercel, Supabase, Clerk, Stripe, and Cloudflare — maintain their own security programs and independent third-party audits and certifications, which are available on their respective trust or security pages. Marina Operators conducting a security review may request the reports BerthRight is permitted to share by writing to info@berthright.app. See Section 11.2 of the Data Processing Addendum for what BerthRight provides on request.

How we notify you when this list changes

BerthRight will give notice at least thirty (30) days before a new subprocessor begins processing personal information, in two ways:

Please keep your notice contact current. Email notice goes to the address in your account settings. If that address is a person who has left the marina, you will not receive the notice. We recommend using a monitored role address (for example, office@yourmarina.com) rather than an individual’s mailbox, and re-checking it at the start of each season.

Your right to object

If you are a Marina Operator with a BerthRight Data Processing Addendum in place, you may object to a new subprocessor on reasonable, documented data protection grounds by writing to info@berthright.app within thirty (30) days of our notice. We will work with you in good faith to find a solution. If we cannot, you may terminate the affected services and receive a refund of any prepaid, unused fees. The full process is in Section 8.4 of the Data Processing Addendum.

Emergency changes

Occasionally a vendor must be replaced quickly — because it ceases operations, suffers a serious security failure, or terminates service on short notice. In that situation we may make the change before the thirty (30) days elapse, in order to keep your marina running. We will tell you as soon as we reasonably can, and your right to object still applies after the fact. See Section 8.5 of the Data Processing Addendum.

Change log

What our subprocessors are contractually required to do

Every subprocessor listed above is engaged under a written contract that imposes data protection obligations no less protective than those BerthRight owes to Marina Operators, including obligations of confidentiality, security, limited use, and deletion or return of data. BerthRight remains responsible to its customers for its subprocessors’ handling of personal information. See Sections 8.6 and 8.7 of the Data Processing Addendum.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not allow any subprocessor to use marina or boater data for its own purposes.

Questions

Related pages: Privacy Policy · Security Overview · Terms of Service · Acceptable Use Policy