Privacy Policy.

1. Who we are

CREW is a directory for visual and fashion creatives, operating in the United States. Contact: privacy@yourcrew.net. Compliance owner: Leandro Varela Gomez.

2. What we collect

• Account information — email, name, password hash (never the password itself).
• Profile content — photos, bio, city, day rate, and any other field you fill in.
• Communications — messages exchanged with other users on the platform.
• Technical data — IP address, user-agent, approximate location (city level), device identifiers.
• Website usage data — pages and castings viewed, waitlist signups and purchases, measured with Google Analytics. Analytics cookies follow your consent choices; see the Cookie Policy.
• Payment data (when active) — processed by Stripe; we never store full card numbers.
• Identity verification data — when you verify your identity, you do it in one of two ways:
  • CREW review — you upload photos of your government-issued ID, a selfie, and a short liveness video. These files are kept in our private storage, are accessible only to authorized CREW staff for the purpose of reviewing your verification, and are never shown to other users.
  • Stripe Identity (beta, when offered) — Stripe captures and checks your government-issued ID and a live selfie. The images and the data extracted from your document stay with Stripe; CREW stores only the verification session identifier, its status, and an error code if the check fails. We do not receive or store the images or your document data. CREW staff still review and approve the result before your profile is marked as verified.

3. How we use it

• To provide the service (matching, messaging, payments).
• To verify your identity and prevent abuse.
• To send service communications (account, security, transactions). Marketing emails are opt-in.
• To comply with legal obligations.
• To measure and improve our website (aggregated analytics).

4. How we share

• With other users — your profile is visible to people you match with. You control what appears via the in-app privacy settings.
• With service providers — see the subprocessors list. If you choose to verify your identity through Stripe Identity, Stripe processes your ID and selfie to perform the check.
• Legal compliance — when required by law, subpoena, or court order.

We do not sell or share personal information for cross-context behavioural advertising under CCPA.

5. How long we keep it

• Profile and content data — until you delete your account.
• Messages — until you delete your account, except that the people you exchanged them with keep their copy of the conversation afterwards, shown as from a “Deleted user” and no longer linked to your profile.
• Identity verification files (CREW review) — until you delete your account, when they are removed from our storage.
• Identity verification data (Stripe Identity) — when you delete your account, CREW asks Stripe to delete (redact) the verification data it holds for you. Stripe completes the redaction within up to 4 days, and it cannot be undone.
• Compliance audit logs — 7 years post-deletion (CCPA, GDPR, NY SHIELD retention requirements).
• Backups — 30 days post-deletion, then overwritten.

6. Your rights

• Access & portability — request a copy of your data at the contact email above.
• Deletion — email support@yourcrew.net with the subject "Delete account"; we process within 30 days.
• Correction — edit your profile in-app, or contact us for non-editable fields.
• Opt out of marketing — every marketing email includes an unsubscribe link.
• California residents — you may exercise CCPA rights via the contact email; we will verify your identity before responding.

7. Security

We use encryption in transit (HTTPS), encryption at rest for the database, audit logging for sensitive actions, rate limiting on authentication endpoints, and access control aligned with the ISO 27001 Annex A framework. Specific technical controls are listed in our public security roadmap (available on request).

8. Age requirements

CREW is for users 18 years and older. We do not knowingly collect personal information from minors. If you believe a minor has registered, contact us and we will delete the account.

9. International users

At this time CREW operates in the United States. Users outside the United States are not currently eligible to register. When we expand internationally, this policy will be updated to reflect GDPR / UK GDPR / LGPD obligations.

10. Changes to this policy

Material changes will be communicated via email and an in-app notice at least 30 days before they take effect. Older versions are kept on file and available on request.

11. Contact

For any privacy question, data request, or to exercise your rights, write to privacy@yourcrew.net.