Privacy Policy

1. Who we are

This policy explains what personal data GMC Link collects, why, who receives it, how long it is kept, and what rights you have. The controller of your data is GeoMarine Crew Link Gocha Musharbadze, identification code 61009015468, registered at Batumi, Georgia. For any privacy question or request, write to info@gmc-link.com.

2. What data we collect

We collect what you give us and what the platform needs to work:

Account data: email address, password (stored only as a one-way hash), interface language, and account type.
Crewing company data: company name, identification code, contact person, phone, and — if you add them — address, website, description, contact email, and logo.
Seafarer profile: name, rank, phone, availability date, and photo. Optional personal details: date of birth, citizenship, country and city of residence, street address, closest airport, a second phone, English level, education and languages, salary expectation, next of kin, and references. Optional physical characteristics that crewing companies request for protective equipment: height, weight, shoe and coverall size, hair and eye colour.
Sea service: vessels, ranks, dates, and the other details of each voyage.
Documents: scans or photos of your passport, seaman's book, identity document, visas, certificates, and medical documents, with the details read from them (numbers, dates, issuing authority).
Applications: the vacancy, your cover note and answers, the CV you send (if you send the CV built in GMC Link, a PDF copy as it was at that moment), the documents you choose to share, and when you consented to sharing. The crewing company may add its own notes, tags, and rating to your application.
Job alerts, saved vacancies, notifications, and your email preferences.
Payments: your subscription and payment history and invoices. You enter card details on Bank of Georgia's payment page; if you save a card, we keep only the bank's token, the masked card number, and its expiry date.
Messages you send through the contact form: name, email, topic, and message. They are forwarded to our mailbox and not stored on the platform.
Technical data: our application logs record each request's time, address within the site, result, and account id — not your IP address. The web server logs record IP addresses and are deleted after 14 days.

3. Health data

Medical certificates, vaccination records, and drug and alcohol test results are health data, a special category of personal data. You upload them only if you choose to, because crewing companies require them for employment at sea.

We process them on the basis of your consent, given when you upload such a document and when you share it with an application. We use them only to keep your document registry, to remind you of expiry dates, to read them with AI when you ask, and to show them to the crewing companies you share them with. You can withdraw your consent at any time by deleting the document.

4. Why we process your data and on what basis

To provide the platform — your account, profile, document registry, applications, and notifications — under our contract with you (the Terms of Use).
To pass your application to the crewing company you apply to, at your request.
To provide Premium features, including AI processing, only when you ask for them — under our contract with you.
To process payments and keep accounting records — under our contract with you and our legal obligations.
To keep the service secure and prevent abuse — our legitimate interest.
To send emails: service emails (account, security, payments, decisions on your account) are part of the service; the others (application updates, document and vacancy expiry, job alerts, AI results) follow your email preferences, and you can switch them off in your settings.
Health data: your consent, as described above.

5. What crewing companies see

No crewing company can search for you or see your profile until you apply to one of its vacancies. When you apply, that company sees:

your name, rank, phone, photo, and availability date;
your sea service and its totals;
your cover note and answers;
the CV you attach — a CV built in GMC Link contains everything you put into it (contact and personal details, the document and medical tables, next of kin, photo);
only the documents you chose to share with that application.

6. What crewing companies may do with it

While your application is open, the company can download your CV and the documents you shared, and it may pass them to a shipowner or employer for that recruitment. It receives your data as an independent controller and must follow the rules in our Terms of Use.

If the company rejects you or you withdraw, and you have no other open application with that company, it can no longer open your CV or documents. The application itself — your profile, sea service, cover note, and answers — stays visible to the company. Copies the company already downloaded fall under its own responsibility.

If you add next of kin or references, make sure they agree to their details appearing in your CV.

7. AI processing (Premium)

AI runs only when you ask for it. Nothing is ever applied to your profile or documents until you review the result and confirm it.

Document recognition: the pages you upload are converted to images (a PDF up to 25 pages) and sent for reading; a sea service record page is read twice, to cross-check handwritten entries.
CV import: the text of your CV file; for a PDF, also images of its first pages — of every page, up to 25, when the PDF is a scan; a photographed CV is sent as the photo.
CV summary: only your rank, your sea service (ranks, vessel types, dates), and the names of your certificates — never your name, contact details, or documents.
These requests go through OpenRouter (United States) to Google's Gemini models. We send them with settings that allow only providers that keep no copy of the content and do not use it for training.
We keep the result: the values read, their confidence, the model, token counts, and the time — so we can show you what was applied where. It is deleted with your account. The page images are prepared in memory for each request and not stored.
AI use has a monthly limit per user. Administrators see usage counts and costs, never the contents of your documents.

8. Who else receives data

We do not sell your data. Besides the crewing companies you apply to, these providers process it on our behalf, under contract, only for the service they provide:

DigitalOcean — our servers and file storage in Frankfurt, Germany, and a backup copy in Amsterdam, the Netherlands;
Cloudflare — network and security: all traffic to the site and its API passes through it; also our cookie-free visitor statistics;
Resend — email delivery (EU region, Ireland);
OpenRouter and Google — AI processing, only when you ask for it;
Google Analytics — visitor statistics: which pages are opened, from where, and on what device;
Bank of Georgia — card payments;
Google Workspace — our mailbox, which receives your emails and contact form messages.

9. Transfers outside Georgia

Your data is stored in the European Union: in Germany, with a backup copy in the Netherlands. AI requests are processed by OpenRouter and Google, including in the United States, Google Analytics processes visitor statistics there too, and Cloudflare carries traffic across its global network. Each of these transfers relies on the provider's data processing terms and the safeguards they contain.

10. Security

Connections are encrypted. Passwords are stored only as hashes. Your files sit in private storage and open only through links that expire within minutes; no file has a permanent public address. Platform administrators can see account, profile, application, and payment data for support and moderation, but cannot open your documents.

11. How long we keep data

We keep your data while your account exists. You can delete your account in your settings; for 30 days you can still restore it, then it is permanently deleted: profile, documents and files, sea service, applications (sent and received), AI records, notifications, alerts, saved vacancies, and saved cards.

Payment records and invoices are kept for 2 years after the account is deleted, for accounting, linked to an anonymized account; then they are deleted too. Deleted data leaves our backups within 14 days.

12. Cookies

The site itself sets only the cookies it needs to work: crewport_rt keeps you signed in (30 days, not readable by scripts), crewport_role remembers which cabinet to open (30 days), and NEXT_LOCALE remembers your language (until you close the browser). The checkout keeps one short-lived value in your browser's session storage.

Visitor statistics come from Cloudflare Web Analytics, which sets no cookies, and Google Analytics, which sets the _ga and _ga_* cookies (up to 2 years) to tell returning visitors from new ones. Google receives a random visitor identifier, the pages you open, where you came from, your device and browser details, and your approximate location — never your name, email, or account data. We use no advertising cookies.

13. Your rights

See and correct your data in your profile at any time.
Download a copy of your account data and files from your settings, or ask us for it.
Delete your account, or ask us to delete specific data.
Withdraw consent — delete a document, or switch off optional emails — at any time.
Object to or ask us to restrict processing based on our legitimate interest.
Write to info@gmc-link.com with any request; we answer within the time the law sets. If you believe your data is processed unlawfully, you can complain to the Personal Data Protection Service of Georgia.

14. Changes to this policy

We update this policy when the platform or the law changes. We will announce material changes on the platform before they take effect.