Privacy Policy

1. Introduction

Maritime AI, Inc. ("Maritime," "we," "us," or "our") operates the maritime.sh platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

2.1 Account Information

When you create an account, we collect your name, email address, and profile picture as provided by you or your authentication provider.

2.2 Information from Third-Party Authentication Providers

We offer sign-in via Google and GitHub. When you authenticate through these providers, we receive:

• Your name and email address
• Your profile picture URL
• A unique account identifier from the provider

We access only the minimum data necessary to create and maintain your account. We do not request access to your contacts, calendar, drive files, or any other data beyond basic profile information.

2.3 Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other raw payment credentials on our servers. We retain only a reference identifier for your Stripe customer record.

2.4 Service Usage Data

• Agent configurations, deployment metadata, and logs
• API keys and secrets you provide for your agents (stored encrypted)
• Usage metrics (compute time, resource consumption)

2.5 AI Model Calls

When your agents call an AI model through Maritime's AI credits, we store the full content of each call: the request your agent sends (instructions, conversation messages, tool definitions and tool results) and the model's response (text and tool calls), with its time, model, token counts and cost. This content can include information that your own users send to your agents. We store it encrypted in Amazon S3. It is available only to authorized Maritime personnel and is not shown in your dashboard or API. Calls that your agents make with your own API key do not go through Maritime and are not stored.

2.6 Automatically Collected Information

• IP address and approximate geolocation
• Browser type, operating system, and device information
• Pages visited and features used within the Service
• Referring URL and session duration

3. How We Use Your Information

• Authenticate your identity and maintain your account
• Provide, operate, and maintain the Service
• Process billing and send transaction-related communications
• Send technical notices, security alerts, and support messages
• Monitor and analyze usage patterns to improve the Service
• Detect, prevent, and address fraud, abuse, or technical issues
• Use the content of your agents' AI model calls to operate, debug, secure, and improve the Service
• Comply with legal obligations

4. Google User Data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request access to your Google account email, name, and profile picture for authentication purposes
• We do not use Google user data for advertising purposes
• We do not sell Google user data to third parties
• We do not use Google user data to build user profiles for advertising or to serve ads
• We limit our use of Google user data to providing and improving the Service as described in this policy
• We do not allow humans to read your Google user data unless we have your affirmative consent, it is necessary for security purposes, to comply with law, or for our internal operations (and only when data is aggregated and anonymized)

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

• Service providers: Stripe (payment processing), Railway (hosting), AWS and Hetzner (infrastructure), and Neon (database hosting), each bound by data processing agreements
• Legal requirements: When required by law, subpoena, court order, or government request
• Safety: To protect the rights, property, or safety of Maritime, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users

6. Data Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted via TLS
• Sensitive credentials (API keys, secrets) are encrypted at rest using AES-256-GCM
• Database connections use TLS with certificate verification
• Authentication tokens are signed and encrypted (JWE/JWS)
• Access to production systems is restricted to authorized personnel

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained until you delete your account
• Agent deployment data and logs are retained for the life of the agent plus 30 days after deletion
• The content of AI model calls is retained indefinitely, including after you delete your account
• Billing records are retained for 7 years as required by tax and accounting regulations
• Automatically collected usage data is retained for up to 12 months

8. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data and account
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your data
• Withdrawal of consent: Revoke consent for data processing at any time

To exercise any of these rights, email us at contact@maritime.ac. We will respond within 30 days. You may also revoke third-party access by disconnecting Maritime from your Google or GitHub account settings at any time.

9. Cookies and Tracking

We use essential cookies required for authentication and session management. We do not use third-party advertising cookies or cross-site tracking technologies. Specifically:

• Session cookies: Required for authentication (expire when you close your browser or after 30 days)
• Preference cookies: Store your UI preferences (theme, layout)

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

11. International Data Transfers

Your data may be processed and stored in the United States and other countries where our infrastructure providers operate. By using the Service, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and sending a notice to the email address associated with your account. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: