WeekAtSea Privacy Policy

How our AI yacht charter assistant handles your data

Last updated: 30 September 2026

In short: WeekAtSea is an AI assistant that helps you find and book a charter yacht. We use what you tell it to answer you and, when you ask us to, to pass your request to the reservations team that books the boat. We don't sell your data, we don't use it for advertising, and you can ask us to delete it at any time.

1. Who we are

WeekAtSea is operated by Lomboos d.o.o., Zagreb, Croatia ("Lomboos", "we", "us"). Lomboos is the controller of the personal data described in this policy.

Contact for anything privacy-related: support@lomboos.com.

This policy covers WeekAtSea wherever you talk to it:

in Instagram direct messages with @weekatsea (and, later, other Instagram accounts it answers for);
as a chat assistant on websites, including chat.lomboos.com and charter websites of our partners. When the assistant runs on a partner's website, that website's own privacy policy also applies to your visit there.

2. WeekAtSea is an AI, not a person

Replies from WeekAtSea are generated automatically by an artificial-intelligence language model. It uses live data from charter booking systems for boats, prices and availability, but it can still make mistakes. Nothing it says is a binding offer. Prices and availability are confirmed only by the reservations team, in writing. A person from our team may occasionally join a conversation; when that happens, the assistant pauses.

3. What we collect

Everything you write to the assistant

We store the messages you send and the assistant's replies, including anything you tell it about your trip: dates, group size, preferred boats, destinations and special requests. Please don't share sensitive information (health, payment card details, identity documents) in the chat; the assistant doesn't need it.

Contact details you give us

When you ask the assistant to send your request to the reservations team, or leave your details so we can follow up, we collect your name, email address and, if you give it, your phone number. If you type an email address or phone number into the chat, we record it too, so our team can get back to you.

On Instagram

Your Instagram-scoped user ID, username and display name, which Instagram provides so we can reply to you.
The messages you send us, including a note that you sent a photo, voice message or shared post. The assistant can't open those.
If you reached us through a link from one of our partners (for example an influencer), the partner's referral code.

We do not see your other conversations, your followers or your posts.

In the web chat

Your IP address and the approximate location we derive from it (country, region, city).
Your browser type, the language you chat in, the page where you opened the chat and the page that brought you there.
For visit statistics: screen and window size and your time zone.
A few items the chat keeps in your browser's local storage: random identifiers for your conversation and your device, your chosen language and theme, your boat shortlist, and whether you've already seen the welcome message. These let you continue a conversation after reloading the page. The chat assistant sets no advertising cookies.

4. Why we use it, and on what legal basis

To answer you: search boats, prices and availability and reply to your questions. This is a step you ask for before entering a charter contract (GDPR Art. 6(1)(b)).
To pass your booking request to the reservations team and let them contact you with a quote, only when you ask us to (Art. 6(1)(b)).
To follow up when you leave your contact details for that purpose. You can tell us to stop at any time (Art. 6(1)(a) and 6(1)(b)).
To run and improve the service: keep a record of conversations, check the quality and accuracy of answers, prevent abuse, and measure which channels and partners bring customers. This is our legitimate interest in operating a reliable service (Art. 6(1)(f)).
To pay our partners: work out which bookings came through a partner's referral link (Art. 6(1)(f)).
To meet legal obligations, for example accounting records for bookings (Art. 6(1)(c)).

We do not sell your personal data, we do not use it for advertising or advertising profiles, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

5. Who receives your data

The reservations team that handles your booking: our booking partner, which receives your contact details and request when you ask us to send them, and the charter company that owns the boat you book.
Partners who referred you receive only what is needed to pay their commission (for example, that a booking was made and its value). They never receive your messages or your contact details.
Service providers who process data for us under contract:
- AI model providers OpenAI and/or Anthropic (USA), which generate the assistant's replies from the conversation. Under their business API terms, this data is not used to train their models.
- Meta Platforms, which delivers Instagram messages. Your use of Instagram itself is governed by Meta's privacy policy.
- Contabo GmbH (Germany), which hosts our servers and database.
- Upstash, which runs our knowledge-base search. It receives the search phrases the assistant writes, not your contact details.
- ipwho.is, which turns a web visitor's IP address into an approximate location.
- Our email provider, which delivers booking requests to the reservations team.
Authorities, where the law requires it.

When the assistant checks boats, prices and availability, it queries charter booking systems with your search criteria only (dates, area, boat size). No personal data is sent to them.

6. International transfers

Some of these providers are based in, or process data in, the United States. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

7. How long we keep it

Conversations, and contact details collected through them: up to 24 months after your last message, then deleted or anonymised.
Booking requests that lead to a booking: as long as needed to complete the booking and as long as accounting and tax law requires.
Instagram access tokens for accounts connected to WeekAtSea: until the account is disconnected.

If you ask us to delete your data sooner, we will (see section 8). Messages in your own Instagram inbox are stored by Meta and are not affected by our deletion.

8. Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To use any of these rights, email support@lomboos.com. The quickest way to have everything deleted is described on our data deletion page. We reply within one month.

You may also complain to the Croatian data protection authority, Agencija za zaštitu osobnih podataka (AZOP), or to the authority in the EU country where you live.

9. Security

Data travels over encrypted connections (HTTPS). Instagram access tokens are stored encrypted. Access to conversation records is limited to the team members who need it to handle your request.

10. Children

WeekAtSea is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has used it, contact us and we will delete the conversation.

11. Changes

We may update this policy as the service changes. The date at the top shows the latest version. We'll point out significant changes in the assistant's greeting or on this page.