Privacy

What KodoDesk reads

Email. An office connects its mailbox through Microsoft (Outlook, Microsoft 365) or Google (Gmail). That connection is read-only: KodoDesk reads the mail and its attachments and never sends, moves or deletes anything in the mailbox. Folders and people an office marks Keep Private are not read in. Replies are written in the broker’s own email program and sent from there.

WhatsApp. Where an office connects its WhatsApp Business number, messages reach KodoDesk through Meta’s WhatsApp Business Platform. A message goes out only when a broker presses send.

What brokers add. Clients, yachts, charters, notes, documents, payments and the answers clients give on their forms.

Identity documents. Passports and other IDs a client sends for a charter are kept apart from everything else. Only the office’s admin, the person who added it and the client’s own broker can open one; each opening is noted, and AI never reads them.

When AI is used

KodoDesk uses Claude, made by Anthropic, for things like summarising an email, drafting a reply or reading a contract. It runs only when a person clicks to ask for it, never on its own in the background. What is sent is what that click needs: the email, document or charter in question. Under Anthropic’s commercial terms, what we send is not used to train its models. A broker reads and changes every draft before anything is sent, and nothing is ever sent for them.

Pages clients open

Brokers send clients links to proposals, comparisons of yachts, preference sheets and enquiry forms, itineraries and trip guides. Captains and other brokers get links to availability and hold requests. Each link opens only what it was made for, with no sign-in, and works until the broker takes it down.

When someone opens one of these pages, KodoDesk notes that it was opened, when, and roughly how long it was read, so the broker knows when to get in touch. What is typed into a form goes to that broker. These pages set no cookies; they keep a random visit number in the browser until the tab is closed, so one visit counts once. Some of them load fonts from Google Fonts and photographs from Unsplash or Wikimedia Commons, which then see the reader’s internet address as any website would.

If an office sends a newsletter, it goes through Amazon Simple Email Service. Each copy notes whether it was opened and which links were clicked, and each has its own unsubscribe link, which works at once and for good.

Where it is kept

Each office has its own database on a server we rent from DigitalOcean in Frankfurt, Germany. Its files (attachments, contracts, photos) sit beside it. Connections are encrypted, and the keys to each mailbox are kept on the server, readable only by KodoDesk.

Every night each office is backed up: its database, its files and its keys, copied to a backup folder on the same server that only the server’s administrator can open. Database backups are kept for 60 days and then deleted.

Who can see what

In an office: the people its admin invites. Everyone signed in to an office sees that office’s clients, charters and mail, apart from mail kept private and the identity documents, which only the admin, the person who added one and the client’s broker can open. An admin can switch a person off at once, on every device.

Other offices: nothing. Offices never see each other’s data.

Kodo Yachts: the people who run KodoDesk can reach the server to keep it running, fix faults and restore backups. We look at an office’s data only for that, or when the office asks us to.

Services we use: DigitalOcean (the server), Microsoft or Google (reading the mailbox an office connects), Meta (WhatsApp), Anthropic (AI, when asked), and Amazon (newsletters and sign-in emails). Each gets only what its job needs. Where an office connects Kodo Guest, the charter details it chooses are shared with that app.

We don’t sell data

We never sell, rent or trade anyone’s data, and we don’t use it for advertising. An office’s data is used to run that office’s KodoDesk and nothing else.

Signing in

Brokers sign in with a passkey (Face ID, Touch ID, a fingerprint or a PIN); there are no passwords. KodoDesk keeps one cookie to keep a person signed in for 30 days. If someone asks for a sign-in link by email, the request is noted in the office’s log without the address.

Deleting data

A broker can mark someone as Not for KodoDesk, which erases what was kept from them. To have anything else deleted, or to ask what is kept about you, write to the broker’s office, or to us at jordon@kodoyachts.com. If you are a client, your broker’s office decides with you; we carry it out. Once deleted, we take its files out of the backups too, and it leaves the nightly database copies as they roll off, within 60 days.

When an office stops using KodoDesk, we give it a copy of its data if it asks, then delete the office and its backups.

Questions

Write to Kodo Yachts LLC at jordon@kodoyachts.com. If this page changes in a way that matters, we’ll say so on it and tell each office.