Subprocessors.

Active

• HostingerHostinger data center where the CREW server runs

  Purpose: Server hosting: the CREW API, website, admin tools and the production database

  Data accessed: All persisted user data (accounts, profiles, messages, payment references)

• CloudflareUnited States

  Purpose: DNS, CDN, DDoS protection, secure tunnel to the server, and file storage (R2) for photos, videos and identity documents

  Data accessed: All request/response data routed to CREW; uploaded media; identity documents in a private bucket

  DPA: https://www.cloudflare.com/cloudflare-customer-dpa/

• Google LLC (Google Analytics)United States

  Purpose: Website analytics: visits, page and casting views, waitlist signups and purchases (Google Analytics 4)

  Data accessed: Pseudonymous identifiers (GA cookie id, internal user id for purchases), pages visited, device and approximate location from the IP address. No names, emails, invite codes or payment details.

  DPA: https://business.safety.google/adsprocessorterms/

• ResendUnited States

  Purpose: Transactional email (sign-in codes, invites, receipts and notifications)

  Data accessed: Email address, content of transactional messages

  DPA: https://resend.com/legal/dpa

• Expo (650 Industries, Inc.)United States

  Purpose: Push notification delivery to the iOS and Android apps

  Data accessed: Device push token and the text of each notification

• SightengineEuropean Union (France)

  Purpose: Automated screening of uploaded photos and videos for prohibited content

  Data accessed: Uploaded profile, portfolio and casting media

• SentryUnited States

  Purpose: Error and crash monitoring

  Data accessed: Stack traces and request context. PII is scrubbed before sending.

  DPA: https://sentry.io/legal/dpa/

• GitHubUnited States

  Purpose: Source code hosting

  Data accessed: Application source code only — no user data

  DPA: https://docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement

Planned (not yet active)

These vendors are listed for transparency. They will be activated as the relevant features ship. We will update this page and (for material changes) notify users in advance.

• StripeUnited States / Global

  Purpose: Payment processing for token packs and PRO subscriptions (Checkout)

  Data accessed: Email, name, payment method

  DPA: https://stripe.com/legal/dpa

• Stripe Identity (Stripe, Inc.)United States and other locations where Stripe operates

  Purpose: Identity verification (beta, when offered): captures and checks a government-issued ID and a live selfie so CREW staff can approve the verification

  Data accessed: Government ID images, selfie, and data extracted from the ID document. CREW keeps only the verification session ID, its status, and an error code; the data is redacted at Stripe when the account is deleted.

  DPA: https://stripe.com/legal/dpa

Notification of changes

We notify users by email and in-app at least 30 days before adding a new active subprocessor, except where the change is required to comply with applicable law. To receive these notices directly, write to privacy@yourcrew.net with subject Subprocessor notifications.