Privacy Policy

This Privacy Policy explains how Avena Services, LLC (“Avena,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Sailing Plans at www.sailingplans.com and related services (the “Service”).

We designed this policy to address requirements and expectations under the EU General Data Protection Regulation (GDPR), Canadian privacy law (including PIPEDA and, where applicable, Québec Law 25), and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Who is responsible

The data controller (and organization accountable for personal information) is:

Avena Services, LLC
2219 Main St Unit 183
Santa Monica, CA 90405-2217
United States
Product: Sailing Plans
Email: [email protected]

Privacy and data-subject requests should go to the same address with a clear subject line (for example, “Privacy request”).

2. Information we collect

Depending on how you use the Service, we may process:

• Account and identity data — name, email address, username, profile details, and authentication identifiers when you create or sign in to an account. Sign-in is provided by an authentication provider; we receive account data needed to operate signed-in features.
• Communications — messages you send us, including waitlist or contact emails to [email protected].
• Usage and technical data — IP address, device and browser type, approximate location derived from IP, pages or routes requested, timestamps, and diagnostic or server logs generated while providing and securing the Service.
• Cookies and similar technologies — session and authentication cookies required for sign-in and account security. See our Cookie Notice.

We do not currently operate a third-party advertising or product analytics pixel on the marketing site. If we add analytics or similar tools later, we will update this policy and the Cookie Notice.

3. How we use information (purposes)

• Provide, maintain, and secure accounts and the Service
• Authenticate users and prevent abuse or fraud
• Respond to waitlist, support, and privacy requests
• Operate hosting, delivery, and infrastructure for availability
• Comply with law and enforce our Terms of Service
• Improve the Service based on operational needs and feedback

4. Legal bases (GDPR / similar regimes)

Where GDPR or analogous rules apply, we rely on:

• Contract — processing needed to provide the Service you request (for example, account creation and sign-in).
• Legitimate interests — securing the Service, preventing abuse, basic operations and logging, in ways that do not override your rights.
• Consent — where we ask for it (for example, optional marketing email if we offer it), which you may withdraw at any time.
• Legal obligation — when we must retain or disclose information to meet applicable law.

5. Canada (PIPEDA / Law 25 awareness)

We are accountable for personal information under our control. We collect, use, and disclose personal information for the purposes described in this policy, and we seek meaningful consent where required (for example, when you submit a waitlist email or create an account). You may request access to, or correction of, your personal information by contacting us at [email protected]. We will respond within the timeframes required by applicable Canadian law. If you are in Québec, additional Law 25 rights and transparency expectations may apply; contact us to exercise them.

6. California (CCPA/CPRA)

In the prior 12 months, depending on your use of the Service, we may have collected the following categories of personal information: identifiers (such as name, email, IP address, account ID); internet or other electronic network activity (such as logs and interactions with the Service); and, if you provide them, limited profile or contact details.

We use these categories for the business purposes listed in Section 3 (providing the Service, security, customer communication, and compliance).

We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. Because we do not sell or share in that sense, we do not currently offer a “Do Not Sell or Share My Personal Information” opt-out mechanism beyond the rights below. If that changes, we will update this policy and provide a clear method to opt out.

California residents may have the right to:

• Know what personal information we collect and how it is used
• Delete personal information, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing (if applicable in the future)
• Not be discriminated against for exercising privacy rights

To exercise these rights, email [email protected]. We may need to verify your identity before fulfilling a request. You may use an authorized agent where the law allows; we may require proof of authorization.

7. Processors and service providers

We use trusted service providers to help run the Service. They process personal information on our instructions and for our purposes, including categories such as:

• Authentication providers — sign-in, session management, and account identity services
• Hosting providers — application hosting and managed data storage
• Content delivery and security providers — DNS, CDN, and edge security for the website
• Email services — delivering transactional or waitlist-related messages when you contact us

These providers may process data in the United States or other countries where they operate.

8. International transfers

If you access the Service from the EEA, UK, Switzerland, Canada, or elsewhere, your information may be transferred to and processed in the United States and other countries that may have different data protection laws. Where required, we rely on appropriate safeguards offered by our providers (such as Standard Contractual Clauses) and contractual commitments with processors.

9. Retention

We keep personal information only as long as needed for the purposes above: while your account is active; for a reasonable period afterward for security, dispute resolution, and legal compliance; and for communications you send us according to ordinary business retention practices. Server logs are typically retained for a shorter operational window unless needed for security investigations. You may request deletion as described below.

10. Your rights (GDPR and similar)

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data (“right to be forgotten”)
• Restrict or object to certain processing
• Receive a portable copy of data you provided
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority in your country or region

To exercise these rights, contact [email protected]. We will respond within the period required by applicable law.

11. Security

We use reasonable administrative, technical, and organizational measures appropriate to the nature of the Service (including encrypted transport, access controls, and authenticated APIs). No method of transmission or storage is perfectly secure. If we become aware of a breach that requires notification under applicable law (including Canadian breach reporting rules where they apply), we will notify affected individuals and authorities as required.

12. Children

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

13. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be posted on this page; continued use of the Service after an update means you acknowledge the revised policy.

14. Contact

Questions or privacy requests: [email protected]
Avena Services, LLC — Sailing Plans
2219 Main St Unit 183
Santa Monica, CA 90405-2217
United States