Privacy Policy

Overview

This policy explains what information Crewfarer (“we,” “us”) collects, how we use and share it, and your rights. It applies to crewfarer.com and related services. For privacy purposes, Crewfarer is the data controller for the personal data described here.

Information we collect

• Account & profile: name, email, password (hashed), account type, and the profile details you add (position, experience, certifications, location, languages, links, photos). Businesses provide company details.
• Content & activity: posts, applications, reviews, messages, follows, and similar actions you take on the Service.
• Payment data: processed by Stripe. We receive limited billing metadata (e.g. that a payment succeeded, plan, last-four is handled by Stripe); we do not store full card numbers.
• Identity-verification data: if you choose to get verified, our provider Stripe Identity collects and checks your government ID and a selfie. Stripe processes those documents; Crewfarer does not receive or store your ID image or selfie — we receive only the verification result (e.g. verified) and basic status.
• Technical data: IP address, device/browser info, and usage data, collected via essential cookies and logs to run and secure the Service.

How we use it

To create and operate your account; show your profile, posts, and listings; match crew with opportunities; deliver messages and notifications; process payments; verify identity where requested; keep the platform safe and prevent abuse; provide support; and comply with legal obligations.

Where GDPR applies, our legal bases are: performance of our contract with you (to provide the Service), your consent (e.g. optional identity verification, certain communications), our legitimate interests (to secure and improve the Service), and compliance with legal obligations.

How we share it

We do not sell your personal data. We share it with:

• Other users, per the visibility rules below.
• Service providers (subprocessors) who process data only to provide their service to us: Stripe (payments and identity verification), Cloudinary (image storage), Resend (transactional email), Google (optional sign-in), and Fly.io (hosting).
• Legal & safety: when required by law, to enforce our terms, or to protect the rights and safety of users and the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

What other users see

Your profile, posts, and public activity are visible per the product's rules. Some details (e.g. references and direct contact info) are limited to paying members or to parties you engage with. Do not post information you don't want shared. Messages are visible to the recipient.

Cookies

We use essential cookies to keep you signed in and to secure the Service. Where required, we will ask for consent before using any non-essential cookies. You can control cookies through your browser settings.

Data retention

We keep your personal data while your account is active and as needed to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal data, except where retention is legally required.

Security

We use reasonable technical and organizational measures to protect your data, including hashed passwords, encrypted transport (HTTPS), and handling of payment and identity documents by specialized providers rather than on our own systems. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

International transfers

We operate globally and may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. You can edit or delete much of your data in-app, including deleting your account from Settings.

EU/UK (GDPR): you may also lodge a complaint with your local data protection authority. California (CCPA/CPRA): you have rights to know, delete, and correct your personal information, and to opt out of “sale” or “sharing” — we do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising your rights.

To exercise these rights, email privacy@crewfarer.com.

Children

The Service is for adults of legal working age and is not directed to children under 18. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

Changes and contact

We may update this policy and will post the new version with an updated date. For material changes we will provide reasonable notice. Questions or requests: privacy@crewfarer.com.