Crewfinder Privacy Policy

1. Responsible party and contact

2. Information Crewfinder processes

Account, authentication and session information

• name, email address, account type, membership role and account status;
• authentication user and provider identifiers;
• Google identity information where Google Sign-In is chosen;
• session cookies, authentication events and security or operational logs;
• browser, device, network and error information available to the service infrastructure.

Profile and professional information

• display name, profile images, location and professional description;
• roles, skills, self-ratings, brands, services, supplies and opportunities;
• profile status, public-directory and visibility preferences;
• availability status and any availability note supplied by the user.

Personal Information Centre information

• legal and preferred names, South African identity number and date of birth;
• email addresses, telephone numbers and alternative contact details;
• residential and postal addresses;
• emergency-contact name, relationship and telephone number;
• bank, account-holder, account-number, branch and account-type information;
• tax number and VAT status;
• identity, bank-confirmation, proof-of-address and tax documents.

These fields are treated as private. Current sensitivity labels and masked display controls do not mean every field is separately encrypted at field level.

Work, booking, service and calendar information

• availability dates, private shows, calendar events and notes;
• company shows, locations, roles, crew slots, invitations and responses;
• direct-booking dates, status, location, free-text rate and notes;
• service or supply requests, quantities, dates, contact details and status history;
• guest names, companies, email addresses, mobile numbers and verification state.

Documents and evidence

• uploaded files and document metadata;
• issue and expiry dates, versions, visibility and sharing state;
• requests, assignments, access grants and pack submissions;
• acknowledgements, typed-name signatures and audit or evidence records.

Billing and PayFast information

• billing contact name and email address;
• selected product, plan, price and billing interval;
• checkout, merchant-payment, provider-payment and subscription references;
• transaction amount, currency, fees, payment status and billing period;
• verified notification, reconciliation, cancellation, dispute and support-review records.

Crewfinder does not receive or store raw card numbers or card verification values.

Support, communications and notifications

• support messages and attachments supplied through Chatwoot;
• authenticated support identity and account/profile context;
• in-product support requests, consent scope, support-session and action records;
• notification, email outbox and delivery-attempt metadata.

3. Sources of information

Crewfinder receives information:

• directly from users and guests;
• from another user who creates a booking, invitation, request or document workflow;
• from Google when Google Sign-In is chosen;
• from PayFast for subscription-payment and status verification;
• from browsers, cookies, servers and service infrastructure during operation and security monitoring.

A person supplying emergency-contact, guest or other third-party information must have a lawful reason and appropriate authority to provide it.

4. Why Crewfinder uses information

• create, authenticate and secure accounts;
• provide profiles, availability, calendars, bookings and work coordination;
• provide document, service-request, notification and support functions;
• display information according to user-controlled visibility and sharing actions;
• process Crewfinder subscription billing and reconcile provider events;
• prevent fraud, abuse and security harm and investigate disputes;
• maintain operational, financial, audit and legal records;
• understand consented use of limited public pages through optional analytics.

5. Public and private information

Deliberately public profile and availability information may be visible without authentication under the current visibility rules. Depending on the profile and publication choices, this may include display name, images, location, description, professional capabilities, availability and documents expressly published to a profile.

Login email addresses, private calendars, Personal Information Centre data and private documents remain non-public. Information shared through a booking, invitation, request or document workflow is available only to the participants and authorised support or operational roles defined by the service.

6. Service providers and sharing

Crewfinder may disclose or make information available:

• to another Crewfinder user when a user publishes, sends or shares it;
• to participants in a booking, invitation, service request or document workflow;
• to operators supporting hosting, authentication, database, storage, documents, email, security and support;
• where required by law, legal process or a competent authority;
• where reasonably necessary to protect users, Crewfinder or the public.

Current integrations include Supabase-based authentication and data services, Google Identity, optional Google Analytics 4, PayFast, Chatwoot, configured SMTP email delivery, Mayan document services and MinIO/S3-compatible object storage. Some components may be self-hosted; naming software does not necessarily mean its vendor receives Crewfinder information.

7. Google Sign-In

When a user chooses Continue with Google, Crewfinder may receive the Google account name, verified email address, Google profile image and a Google identity identifier. Crewfinder uses those details to authenticate the user, create or locate the user's Crewfinder login, protect account access and display basic account identity information.

Crewfinder does not request access to Gmail messages, Google Drive files, Google Calendar events, Google Contacts or other private Google content. Crewfinder does not sell Google user data or use it for advertising.

Revoking Google access stops future Google authentication access but does not by itself delete information already stored in a Crewfinder account.

8. Optional Google Analytics and cookies

Google Analytics 4 remains off until a visitor affirmatively accepts analytics cookies. When accepted, it measures a limited set of public production pages. It does not measure authenticated workspaces, admin, billing, callback, calendar, document or API routes.

Crewfinder does not send a Crewfinder account ID, authentication user ID, profile ID, name, email address, search text or private-route identifier to Google Analytics. Current source does not enable Google Signals, advertising personalisation, remarketing, custom events or ecommerce measurement.

Visitors may decline or later withdraw analytics consent through Cookie Preferences. See the Cookie Policy.

9. Subscription payments

PayFast processes Company subscription payments. Crewfinder receives the minimum payment, subscription and reconciliation information needed to provide subscription access and handle support or disputes.

Crewfinder charges subscription fees only for platform access. It does not collect, hold, distribute, transfer or process funds for commercial arrangements between Crewfinder users.

10. Security

Crewfinder uses technical and organisational measures such as access controls, authenticated sessions, restricted service credentials and governed document access. The appropriate measures depend on the information and service involved.

No internet service can guarantee absolute security. Crewfinder does not claim formal security or privacy certification. Users should protect their login methods and report suspected unauthorised access.

11. Retention

Crewfinder does not publish fixed retention periods that are not yet implemented. Information is kept for as long as reasonably required to provide the service and meet legal, accounting, billing, audit, fraud, security or dispute obligations.

Billing, transaction, audit and security records may be retained after account closure where reasonably required. Backups and provider-held records may not be removed at the same moment as active-service information.

12. Access, correction, objection and deletion requests

Subject to applicable law, a person may request:

• access to personal information Crewfinder holds about them;
• correction of inaccurate or incomplete information;
• deletion of information Crewfinder is no longer entitled or required to retain;
• objection to or restriction of certain processing;
• information about how their personal information has been used or shared.

Send requests to admin@crewfinder.co.za. Crewfinder may verify the requester's identity before acting. A person may also complain to the South African Information Regulator.

13. Archive and deletion

Archiving a Crewfinder profile is not deletion. Archive preserves the account, profile and history and may be reversible. Crewfinder does not promise instant or total deletion through the archive control.

Access, correction or deletion requests are handled through the privacy channel. Crewfinder may retain information reasonably required for legal, accounting, billing, audit, fraud, security or dispute obligations.

14. Processing locations

Google and other service operators may process information outside South Africa under their service arrangements. Where cross-border processing occurs, Crewfinder will handle it in accordance with applicable South African requirements.

15. Age requirement

Crewfinder account holders must be at least 18 years old. A business or Company user must also be authorised to act for the relevant organisation.

16. Changes to this policy

Crewfinder may update this policy when the service, law or data practices change. Material revisions will be published with an updated effective date.

17. Privacy contact

Privacy and Information Officer enquiries: admin@crewfinder.co.za. The responsible party, Information Officer status and service address are identified in section 1.