Privacy Policy

How LYRA collects, uses, and protects your personal data

1. Data Controller

LYRA ("we", "us", "our") is the data controller responsible for your personal data. LYRA is registered in England and Wales.

Email: welcome@lyra.yachts
Phone: +34 658 845 957

2. Data We Collect

Depending on how you interact with our services, we may collect the following categories of personal data:

  • Identification data — name and email address, provided through your Google or Apple account during sign-in
  • Technical data — IP address, browser type, device information, and operating system
  • Usage data — pages viewed, yachts browsed, searches performed, and time spent on the platform
  • Preference data — your answers to the onboarding questionnaire, including yacht type, size range, budget, cruising area, hull material, and other selection criteria
  • Communication data — messages, inquiries, and correspondence sent to us via email, WhatsApp, Telegram, or phone

3. How We Collect Your Data

  • Account creation — via OAuth sign-in with Google or Apple (we do not store your password)
  • Onboarding questionnaire — yacht preferences you provide during the AI yacht selection process
  • Website usage — automatically collected technical and usage data when you browse our platform
  • Direct communication — when you contact us by email, WhatsApp, Telegram, or phone
  • Contact forms — when you submit inquiries through our website

4. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR Article 6:

  • Consent — when you create an account, complete the onboarding questionnaire, or subscribe to communications
  • Contractual necessity — to deliver the services you have requested, including yacht search and recommendations
  • Legitimate interest — to maintain platform security, prevent fraud, and improve our services

5. AI and Automated Decisions

LYRA uses an AI-powered recommendation engine to match your preferences with yachts in our catalog. This system uses semantic search technology to find yachts that best correspond to your stated criteria.

This processing does not produce legal effects or similarly significant decisions about you. The AI provides suggestions to assist your decision-making — it does not make decisions on your behalf.

Under GDPR Article 22, you have the right to request human review of any AI-generated recommendation, to express your point of view, and to contest the result.

6. Third-Party Services

We share data only with service providers necessary for the operation of our platform:

We do not share your personal data with advertising networks, data brokers, or marketing platforms.

7. Cookies

We use only strictly necessary and functional cookies:

  • Authentication session cookie — maintains your signed-in state (strictly necessary)
  • Cloudflare Turnstile — bot protection token (strictly necessary)
  • Vimeo player — video playback preferences (functional)

We do not use analytics, advertising, or social media tracking cookies. For more details, see our Cookie Policy.

8. International Data Transfers

Your data may be stored and processed outside the United Kingdom and the European Economic Area. Our hosting provider (Railway) operates servers in the United States, and Cloudflare operates a global content delivery network.

These transfers are governed by EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA), ensuring your data receives equivalent protection regardless of where it is processed.

9. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

  • Account data — until you delete your account, plus 30 days for secure removal
  • Yacht preferences — until you delete your account
  • Communications — 2 years from the date of last correspondence
  • Server logs — 90 days

After the applicable retention period, your data is securely deleted.

10. Your Rights

Under GDPR Articles 15–22, you have the following rights regarding your personal data:

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — correct inaccurate or incomplete data
  • Right to erasure — request deletion of your data where legally applicable
  • Right to restriction — limit how we process your data in certain circumstances
  • Right to data portability — receive your data in a machine-readable format
  • Right to object — object to processing based on legitimate interest
  • Right to withdraw consent — withdraw previously given consent at any time

To exercise any of these rights, contact welcome@lyra.yachts. We will respond within 30 days. These rights are provided free of charge.

11. Supervisory Authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority:

  • United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
  • European Union: You may also contact your local Data Protection Authority

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised effective date. Where changes are material, we will seek fresh consent where applicable.

13. Contact

Email: welcome@lyra.yachts
Phone: +34 658 845 957

Effective: 7 February 2026