Privacy Policy

1. Who we are

STSscreen is operated by STSSCREEN LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. Our representative in the European Union under Art. 27 GDPR is Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Our representative in the United Kingdom under Art. 27 UK GDPR is Data Protection Representative Limited (trading as DataRep), 107-111 Fleet Street, London, EC4A 2AB, United Kingdom.

To contact DataRep about your personal data, email datarequest@datarep.com quoting "STSSCREEN LLC" in the subject line, use the webform at www.datarep.com/data-request, or write to DataRep at either address above or at any of its other EU/EEA offices (list available from support@stsscreen.com). Letters must be addressed to DataRep, not to STSscreen, or they will not reach us. For questions about a screening or a payment, write to support@stsscreen.com instead.

Contact for anything in this policy: support@stsscreen.com.

2. What this policy covers

The STSscreen service at stsscreen.com and its email channel (documents sent to sts@in.stsscreen.com). STSscreen generates a ship-to-ship counterpart screening report from two documents you provide: a Q88 and a Class Survey Status Report (CSSR). There are no user accounts.

3. What we process, why, and on what legal basis

Documents you provide (Q88 and CSSR, as .pdf, .doc or .docx). These contain vessel technical and commercial data and may incidentally contain personal data of named individuals, for example a listed contact person. The service does not seek out or use such personal data: no screening logic reads it, contact details are stripped from the report at rendering, and any incidental personal data inside the documents is deleted with them on the schedule in Appendix A of the Terms. Before you pay, your documents are classified and validated locally on our infrastructure. Only after payment is confirmed are they sent, once, to our AI processing provider, Anthropic (Claude API), which acts as our processor under a data processing agreement, does not use them for training, and deletes them within 30 days. We keep no copy after your report is generated and cannot recover your documents; to screen them again, upload them and pay again. Purpose: classifying the documents and generating your screening report. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: deleted as soon as your report is generated; ceilings in Appendix A.

Email data (email channel only): your sending address, message subject, and attachments. Purpose: running the screening you requested, sending the payment link and the report, replying when classification fails. Legal basis: contract performance. Retention: the email session record, including your address, expires automatically within 49 hours; attachments per Appendix A.

Payment data: payments are made through Stripe, which acts as merchant of record for your purchase and handles checkout and card data as an independent controller under its own privacy policy. We receive payment status and a payment reference; we never receive or store card numbers. Purpose: confirming payment of the EUR 2.50 fee (VAT included), refunding it when a screening is canceled, and fraud prevention. Legal basis: contract performance; legitimate interests (fraud prevention); legal obligation (tax and accounting records). Retention: transaction records are kept as long as applicable tax law requires (currently ten years from the end of the year of the transaction).

Technical data: your IP address is used transiently for rate limiting and abuse prevention (stored only as hashed keys that expire with their short windows), and standard hosting logs exist at our infrastructure providers. Our own application logs carry technical identifiers (session and payment references, status codes), never your email address, document names, or document contents. Our hosting provider retains runtime logs for approximately one day. Legal basis: legitimate interests.

Generated report and session metadata: the report PDF, a session identifier, a customer-visible reference, and timestamps. Purpose: delivering your report and handling support. Legal basis: contract performance. Retention: the report is available for 24 hours and then deleted; session records expire within 24 hours (web) or 49 hours (email).

Support correspondence: emails you send to support@stsscreen.com. Legal basis: legitimate interests (handling your request). Retention: ordinary business correspondence, deletable on request absent a legal obligation.

4. Cookies

The service sets no cookies and runs no analytics or third-party scripts: there is no cookie use, no tracking, and nothing to consent to on this site. Stripe's hosted checkout, which you are redirected to for payment, sets its own cookies on its own domain under its own privacy policy.

5. Recipients of data

We share data with the following recipients, by category: Stripe, the merchant of record for your purchase, which handles checkout and card data as an independent controller; and service providers acting on our instructions under a data processing agreement: cloud hosting and file storage providers, an AI document-processing provider, Anthropic (receives documents only after payment, as described above), a transactional email delivery provider, and a DNS and mail routing provider. Each receives only what its role requires. We do not sell or share data for advertising, and we disclose data to authorities only where legally required.

6. International transfers

The controller is established in the United States, and some providers process data there. EU and UK customer data is handled under this policy's rules regardless of location; transfers rely on the EU-US Data Privacy Framework (and its UK Extension) where a provider is certified, and otherwise on Standard Contractual Clauses. You can request details of the safeguards via support@stsscreen.com.

7. How long we keep things

The service is built to keep as little as possible for as short as possible: uploaded files are deleted as soon as your report is generated, the report is available for 24 hours and then deleted, and every session record expires automatically (24 hours web, 49 hours email). Nothing customer-related is retained indefinitely. The full retention ladder, including the email channel's windows and the abandonment ceilings, is Appendix A of the Terms and forms part of this policy.

8. Automated processing

Screening reports are generated automatically, including AI-assisted document processing after payment. The report assesses vessels and documents, not people; no decision with legal or similarly significant effects on an individual is made.

9. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR and UK GDPR. Because the service deletes data automatically within hours, the data may already be gone by the time we receive a request. To exercise any of these rights, email support@stsscreen.com. You also have the right to lodge a complaint with a data protection authority at any time: in the EU, the authority of your country of residence; in the UK, the Information Commissioner's Office (ico.org.uk).

10. Security

Transport encryption throughout, payment handling delegated entirely to Stripe's hosted checkout, no accounts and no credential storage, and the deletion-first design described above. File and session storage run on established managed cloud infrastructure under those providers' security programs.

11. Minors

The service is a professional maritime tool and is not directed at minors, and we do not knowingly process minors' personal data.

12. Changes

Material changes will be posted on this page with a new effective date.

Effective date: 29/09/2026