Effective date: 2026-10-03
This Privacy Policy explains how personal data is handled when you use the Crew app, website, event pages, dashboard, support channels, and related services (the “Service”).
The controller for the core Service is ALETHEIA SYSTEMS HOLDINGS LIMITED, registered in England and Wales.
Where Article 27 GDPR requires an EEA representative, our representative is Zhongli Liu in Italy. EEA users may contact the representative at andrea@crew-app.com about GDPR matters, or contact us directly at the privacy address above.
The Service may be used by people of different ages where permitted by applicable law. If a user is a child or minor under the law that applies to them, we may require a parent or legal guardian to review the applicable terms, provide consent or authorization, or complete other age-related steps where legally required. Specific events or features, including payments and payouts, may have separate age or eligibility requirements.
Translations are provided for accessibility. If versions differ, they will be interpreted consistently with applicable law, and mandatory local rights are not limited by a translation rule.
The data we handle depends on the features you use.
| Category | Examples |
|---|---|
| Account and profile | Name, email, user ID, sign-in identifiers, username, avatar, bio, language, country, preferences, verification and account status |
| Events and registrations | Event details, organizer information, registrations, attendance or check-in status, cancellations, routes, requirements and event rules |
| Location and maps | Precise location when you allow it, approximate location, selected places, coordinates, addresses, routes, map views, geocoding and timezone data |
| Content and communications | Photos, videos, posts, comments, messages, reports, feedback, support content and attachments |
| Payments and payouts | Purchase and registration records, payment status, Stripe identifiers, Stripe Connect status, balances, payouts, refunds, disputes, chargebacks, subscriptions and platform fees |
| Device and usage | Device or app identifiers, push tokens, IP address, browser or operating-system information, app version, feature usage, diagnostics, crash and performance data, security signals |
| Marketing and preferences | Marketing choices, notification preferences, campaign or promoted-content interactions, consent and opt-out records |
| Safety and compliance | Reports, moderation actions, fraud or abuse signals, policy acceptances, account-deletion records, audit and legal-compliance records |
We receive data directly from you and from your use of the Service. We may also receive relevant data from other users or organizers, sign-in providers, payment providers, app stores, map providers, device or SDK services, support and communications providers, and public authorities or public sources where reasonably needed for safety, fraud prevention or legal compliance.
When Stripe, an app store or another payment provider handles payment-card details, we do not store the full card number.
For UK, EEA and EU users, our main purposes and legal bases are:
| Purpose | Main legal basis |
|---|---|
| Create and manage accounts and provide core features | Performance of a contract |
| Publish and discover user content, manage profiles and follows, and communicate with other users | Performance of a contract; legitimate interests where appropriate |
| Show, create, manage and join events | Performance of a contract; legitimate interests where appropriate |
| Payments, refunds, payouts, subscriptions and financial records | Performance of a contract; legal obligations; legitimate interests |
| Maps, routes, places and device location | Performance of a contract; consent where required; legitimate interests |
| Service, account, event and safety communications | Performance of a contract; legitimate interests; legal obligations |
| Support, reports, moderation, fraud prevention and platform security | Legitimate interests; legal obligations; vital interests in limited urgent situations |
| Analytics, diagnostics and reliability | Legitimate interests; consent where required |
| Marketing and promoted content | Consent where required; legitimate interests where permitted |
| Tax, accounting, disputes, audits and regulatory compliance | Legal obligations; legitimate interests |
Our legitimate interests include keeping the Service secure and reliable, preventing fraud and abuse, supporting users, enforcing platform rules, resolving disputes and understanding how features perform. We consider those interests against your rights and reasonable expectations.
Some information is required to create or perform your account contract or to provide a feature you request. Payment, payout, identity, tax or compliance information may also be required by law or by a payment provider. If required information is not provided, the relevant account, event, payment or payout feature may be unavailable. Optional profile, marketing and similar information can be left blank or disabled where the product allows it.
Some information is public or shareable by design, such as public event pages, organizer profiles, selected profile information, public posts, event media, usernames and avatars. Content already copied, cached, indexed, screenshotted or shared by others may remain outside our control after you delete or hide it.
For the core platform, we normally act as controller. An event organizer may act as a separate controller when it independently uses participant information for event delivery, attendee management, safety, local compliance, tax records or customer communication. Organizers must use participant data lawfully and only for appropriate event-related purposes.
We use precise device location only when you grant the relevant permission. Approximate or selected location may also be used for nearby events, maps, routes, meeting points, distance, addresses and timezone support.
If you choose to share your live location on the map with mutual followers or people you select, we process your precise location while sharing is on and show it only to those people. You can stop sharing at any time; when sharing stops, your shared location is removed. Crew does not use your location in the background.
Map and location data needed for a requested feature may be sent to map or location providers such as Google Maps Platform. You can manage device location permission in your device settings; some map or nearby features may not work without it.
We use your public IP address with the MaxMind GeoLite2 City database to derive a coarse country. We do not display your IP address. The derived IP location may be shown publicly on your profile and alongside your public posts and comments.
This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.
Payments and payouts may involve Stripe, Stripe Connect, app stores, banks, card networks or other payment providers. Those providers may receive information needed for payments, refunds, disputes, identity or business verification, tax checks, transfers, payouts, subscriptions, fraud prevention and compliance.
We may receive and keep provider identifiers and transaction status needed to operate paid features, support users, reconcile balances, handle refunds or disputes and meet financial obligations. Sensitive onboarding or card details should be entered through the provider's secure flow, not through chat.
We share personal data only where needed for the Service, a transaction, safety, compliance or a request you make. Recipient categories may include:
Service providers may process data under our instructions, their contracts, their own legal duties, or as independent controllers for services they provide directly to you. Service providers that process personal data on our behalf are bound by contracts that require them to protect it to at least the same standard as described in this Privacy Policy and to use it only to provide their services to us.
Where allowed, we may send product updates, event recommendations or promotional messages and measure promoted content. Where consent is required for marketing, non-essential analytics, advertising or similar technologies, we ask for it before using those technologies for that purpose.
You can opt out of marketing without stopping necessary service, account, payment, event or safety messages. We do not sell personal information or share it for cross-context behavioural advertising as those terms are commonly used in California privacy law.
Our Cookie Policy explains cookies, local storage, SDK storage and similar technologies in more detail.
Automated systems may help detect fraud, spam, suspicious sign-ins, payment risk, abuse, security incidents and policy signals. Authorized personnel may review relevant reports, content, account context or payment context when needed to investigate or enforce rules.
We do not currently use solely automated processing to make Crew account or moderation decisions that produce legal or similarly significant effects on you. If that changes, we will provide the information, safeguards and review rights required by applicable law. Payment providers, app stores or other independent services may use their own automated risk or eligibility systems under their own notices.
We and our providers may process data in the United Kingdom, the EEA, the United States and other countries. Where required, we use lawful transfer mechanisms such as adequacy decisions, standard contractual clauses, provider contracts and supplementary safeguards.
To ask about the safeguards or obtain a copy of an applicable transfer mechanism, contact privacy@crew-app.com.
We keep identifiable data only for as long as needed for the purpose described here, unless law or a legitimate need requires longer retention.
| Data | Typical retention |
|---|---|
| Account and profile | While the account is active; after deletion, removed, anonymized or put beyond normal use within a reasonable period except where retention is required |
| Events and registrations | Usually up to 3 years after the event or account closure; up to 6 years where tied to payment, tax, accounting, complaints or legal claims |
| Payment, payout, refund, subscription, invoice and tax records | Usually up to 6 years from the relevant financial year, or longer where law, audit, fraud, dispute or legal claims require it |
| Support, reports, moderation and safety records | Usually up to 3 years after closure; serious safety, fraud, legal or payment records may be kept up to 6 years or longer where legally required |
| Messages and user content | While the account or relevant feature remains active unless deleted earlier; content linked to reports, safety, payment or disputes may be kept longer |
| Precise location and technical logs | Used for the requested feature; recent technical logs are usually kept up to 90 days unless linked to safety, fraud, support or legal records |
| Analytics, diagnostics and performance | Usually up to 14 months in identifiable or pseudonymous form where available; aggregated or anonymized statistics may be kept longer |
| Records of your acceptance of the Terms and this Privacy Policy | While your account exists and for 6 years after account deletion is completed, or longer where a specific legal obligation or dispute requires it. These records contain only your internal user ID, the document and version, language, acceptance time and source; they do not include your IP address or browser or device details |
| Consent, marketing suppression and cookie preferences | Consent or suppression records may be kept up to 3 years or as needed to respect your choice; cookie preferences are usually up to 12 months |
| Backups | Usually overwritten or deleted within 90 days unless security, disaster recovery, legal hold or system integrity requires longer |
When identifiable data is no longer needed, we may delete it, anonymize it, aggregate it or place it beyond active use.
You can request account deletion in the app under Settings / Account & Security / Delete account. The current process includes a 7-day cooling-off period before execution. If you cannot access the app, the public Account Deletion page explains the alternative request route.
Deletion may be delayed while unresolved payments, payouts, refunds, disputes, active events, safety matters, subscriptions or legal obligations remain. Records may still be retained where needed for payment integrity, fraud prevention, tax, accounting, safety, disputes, audit, backup or legal compliance.
Depending on where you live and the legal basis used, you may have rights to access, correct, delete, restrict or object to processing, receive or transfer certain data, withdraw consent and opt out of direct marketing. Withdrawing consent does not affect processing that was lawful before withdrawal.
Right to object: where we rely on legitimate interests, you may object to that processing in circumstances provided by law. You may object to direct marketing at any time.
To exercise a privacy right or make a data-protection complaint to us, contact privacy@crew-app.com or use an in-product privacy tool where available. We may need to verify your identity and may limit a request only where applicable law permits it.
UK users also have the right to complain to the Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint. EEA users may complain to the data-protection supervisory authority in the country where they live, work or believe an infringement occurred.
California and other US state residents may also have applicable rights to know, access, delete, correct or port personal information; opt out of sale, sharing, targeted advertising or certain profiling; limit certain uses of sensitive personal information; and exercise rights without unlawful discrimination. Where a legally recognized opt-out preference signal applies and is technically supported, we treat it as required by law.
We use reasonable technical and organizational measures designed to protect personal data, including access controls, logging, encryption in transit, provider security features, least-privilege access and monitoring where appropriate.
No online service or transmission method is completely secure. Keep your credentials, devices, verification codes and payment access secure, and contact us if you believe your account has been compromised.
We review this policy as features, data practices, providers and legal requirements change. For material updates, we may provide notice in the app, on the website, by email or through another appropriate channel where required.
If we plan to use personal data for a materially new purpose, we will update the relevant privacy information and provide any notice or choice required by law before starting that use.