Legal
Last updated 2026-08-10
Najack is a digital check-in platform used by boat-charter operators. For Billy Bones Boat Charters (Captain Flint Boat Charter B.V., Sint Maarten), Najack is used on-site at the dock so passengers can complete waiver, lunch, boat selection, and related check-in steps, and so staff can run the day’s manifest.
This policy explains what personal data is collected through Najack, why it is used, and how it is handled. The liability waiver you may sign at check-in is a separate legal document about the boat activity — it is not a substitute for this privacy notice.
Passenger check-in may include: first and last name; optional email (typically for the first passenger in a group); handwritten signature image; dietary notes or allergies if you provide them; tour, departure, boat, and group details; and, for Anguilla-related tours when required, passport-related fields (such as passport number, nationality, dates of birth/issue/expiry, sex, and area/hotel) that you enter or confirm after a camera scan.
Staff and operator accounts may include: email address; password (stored by our authentication provider, not in plain text in our business tables); organization membership and role; and an optional staff PIN (stored as a one-way hash, never as the PIN itself).
We also store technical session data needed to run the app: signed session cookies for sign-in, kiosk mode, staff unlock, and organization context; and basic operational logs from our hosting provider.
To complete check-in and keep an accurate passenger and boat manifest for the day.
To record acceptance of the tour liability waiver (including a snapshot of the waiver text and your signature).
To support Anguilla customs / Dutch clearance workflows when the tour requires passport details.
To let authorized staff manage boats, exports, and day-of operations.
To authenticate operators and protect the kiosk and staff console (including rate limiting and session security).
When passport scanning is used, a photo is sent to our server so an AI vision provider (Google Gemini) can help read passport fields. The photo is used for that extraction attempt and is not saved as a lasting passenger photo in Najack storage. You can skip scanning and enter details manually when the flow allows it.
Staff may later review or correct passport fields for operational and customs purposes.
Najack uses essential cookies and similar storage to keep you signed in, keep a kiosk session active on the passenger iPad, remember staff unlock for the console, and bind platform admins to the correct organization. These are required for the product to work.
We do not use Google Analytics, Meta Pixel, or similar advertising trackers in the Najack app. If that changes, we will update this policy and, where required, show a consent choice.
Application hosting is on Vercel. Database, authentication, and signature file storage are on Supabase. Passport vision extraction uses Google’s Gemini API as described above. Rate limiting uses Upstash Redis.
These providers process data on our instructions to operate Najack. Access inside the operator organization is limited to authenticated staff (and platform administrators when supporting that organization).
Check-in, waiver, signature, and related operational records are kept for as long as needed for boat operations, customs support, and legitimate business or legal records. We may introduce retention or archiving rules over time; historical check-ins are not deleted automatically today.
Account and session data last while the account is active or the session remains valid. You can sign out to end a browser session.
We do not sell personal data.
Data may be shared with: the charter operator running the tour (e.g. Billy Bones staff); service providers listed above that host or process the app; and authorities when passport/manifest information is required for immigration or customs processes related to the tour.
Passengers can ask staff on-site about the data collected for their check-in. Optional email can be left blank when the kiosk presents it as optional.
Operators who have a Najack account can request access updates or account help through their organization admin, or via WhatsApp support from the no-access screen when configured.
For privacy questions about Najack or Billy Bones check-in data handling, contact the operator who checked you in, or use the support WhatsApp channel published in the app.
We may update this policy as the product or legal requirements change. The “Last updated” date at the top of the page will change when we do. Continued use of Najack after an update means the revised policy applies to that use.