Privacy at a glance
- Crewzy supports personal expenses, business expenses and connected people workflows.
- Organisations control their workspace records. Crewzy has separate responsibilities for account information and personal-use workspaces.
- Our primary database and document storage are hosted on AWS in London, United Kingdom.
- For privacy questions or requests, contact privacy@crewzy.io.
1. Who we are
Crewzy is a product of CODER VIEW LTD, registered in England and Wales under company number 14561510. Our registered office is 31 Little Dodden, Basildon, England, SS16 5TZ. In this policy, “Crewzy”, “we” and “us” mean that company.
We act as controller for our account administration, enquiries, customer relationships, billing and service security. For organisational workspace records, the customer generally decides the purposes and acts as controller; Crewzy processes the agreed information on its instructions. See our data processing information.
For a workspace used solely for personal or household purposes, Crewzy is responsible as controller for processing information to provide that service. An employer or recruiter using Crewzy has its own responsibilities and privacy notice. Customers use Crewzy as SaaS and do not need access to our AWS accounts. Crewzy personnel administer the AWS services; providing the service still involves processing information.
2. Information we handle
We handle account and contact details, workspace records, enquiries and support correspondence. Website and security information can include IP addresses, browser details, requested pages and event times. The information within a workspace depends on its features, settings and what users supply.
View workspace data categories
| Area | Information | Purpose |
|---|---|---|
| Accounts and access | User email and identifiers, company membership, roles, account status, password hashes, optional MFA and recovery information, verification and session metadata. | Authenticate users and administer access to the customer workspace. |
| People and employee lifecycle | Names, contact and address details, employee identifiers, optional birth date and gender, job and team details, managers, employment dates, onboarding, compensation, contracts, professional certifications/licences and their identifiers/dates, performance notes and offboarding records. | Maintain people records and support employee lifecycle workflows. |
| Additional onboarding details | Where supplied: emergency contacts, bank details, national or tax identifiers (including PAN, Aadhaar, passport and UAN), nationality, marital status and blood group. | Support customer-configured onboarding and recordkeeping. |
| Documents and compliance evidence | Uploaded files and versions, document numbers, issue and expiry dates, extracted fields, review records, acknowledgements and approval history. | Store documents, track dates and renewals, and retain evidence of customer activity. |
| Time, leave and projects | Assignments, dated hours, task descriptions, leave types, dates, balances, reasons, supporting attachments and approval comments. | Coordinate everyday work, leave, time approval and reporting. |
| Expenses, invoices and client contacts | Expense descriptions, amounts, receipts, invoice and contact details, and payment or bank references where supplied. | Support expense and invoicing workflows. This does not mean Crewzy runs payroll. |
| Recruitment | Candidate contact and career details, CVs, skills, application stages, interview feedback, assessments, scores, uploaded recordings and transcripts, and customer client contacts. | Manage applications, matching, shortlists, interviews and customer-authorised client sharing. |
| AI inputs and derived outputs | Prompts, relevant workspace results, document images or extracted text, CV and transcript content, summaries, extracted skills and candidate-fit assessments where those features are used. | Generate workspace answers, extract document information and assist recruitment review. |
| Workspace activity | User and company identifiers, actors, roles, actions, outcomes, timestamps and related security metadata, which can include IP addresses and browser information. | Operate access controls, maintain activity evidence and investigate issues. |
Information comes from you, workspace administrators and users, candidates, recruitment clients, imports and enabled integrations. Crewzy also generates workflow status, extracted fields, summaries and activity records.
For relevant business outreach, limited prospect information may come from public business websites, professional directories or direct introductions, such as a name, work contact details, role and company. When we obtain personal details from another source, we provide privacy information, including the source, by our first contact or any earlier applicable legal deadline.
Health information may appear in leave evidence, blood-group fields or documents. Supply sensitive information only where necessary, permitted for the service and supported by the required legal grounds. Do not add unrelated sensitive records or put passwords and authentication codes in documents or chat.
3. Why we use information
For information Crewzy controls, our purposes and applicable UK or EU legal grounds include:
- Providing a service to an individual: performing our contract, or taking steps requested before a contract, where the information is necessary.
- Enquiries, organisational contacts and support: legitimate interests in responding and managing customer relationships.
- Security and abuse prevention: legitimate interests in protecting people, accounts and the service, balanced against individual rights.
- Billing, records and legal matters: contract performance for individual customers, legitimate interests for organisational administration, and applicable legal obligations.
- Consent-based activities: consent where required and obtained, with the ability to withdraw it.
For ordinary information about others supplied for lawful personal use, our basis is our legitimate interests in providing the requested workspace, balanced against their rights. Sensitive information requires any additional applicable legal condition. Organisational customers determine the purposes and legal grounds for records they control; their contract does not itself establish a legal ground for every employee record.
Some account and security details are necessary to provide access. Workspace administrators should explain which other information they require and the consequences of not supplying it.
How we contact you
We use account and enquiry contact details to respond to you, arrange demos or calls you request, provide support and send essential account, security and service messages.
We may also use business contact details for relevant Crewzy product information and sales follow-up where lawful. We rely on consent where required, or on assessed legitimate interests in relevant business outreach where applicable rules allow. Creating an account, providing a phone number or accepting our Terms does not itself give marketing consent.
You can stop marketing by replying to a marketing email, telling the caller or emailing privacy@crewzy.io. You can specify email or phone contact, or ask us to stop all marketing; no account or sign-in is required. This does not stop essential account, security and service messages.
We do not use employee, candidate, expense-contact or other records uploaded to customer workspaces as a prospect list for Crewzy sales.
4. AI and document expiry tracking
Enabled AI features use Amazon Bedrock to process prompts and relevant workspace information. Features can include workspace answers, document extraction, CV summaries and recruitment assessments. Document extraction can involve a complete image or extracted text, including personal information in it—not only dates.
Generated information, matches and scores can be inaccurate or incomplete. They need meaningful human review before decisions affecting people. Crewzy tracks document dates and expiry; it does not verify document authenticity or guarantee regulatory compliance.
Read our AI guidance and service provider information before supplying information through these features.
6. Data locations
Our primary PostgreSQL database and document storage are hosted on AWS in London, United Kingdom. Other services, including AI, email, website and security services, may process information elsewhere. The primary storage location is not a UK-only processing commitment.
Any required international-transfer safeguards must be established for the processing concerned. Contact privacy@crewzy.io about locations and transfer arrangements for your service.
7. Retention and account closure
Workspace information is kept for the active service and according to lawful customer instructions. Our intended inactive-workspace retention period is 90 days from workspace deactivation, including deactivation after non-payment. The period does not start at the first missed payment, and cancelling renewal alone does not deactivate a workspace.
The 90-day period is a retention policy, not a guarantee of automatic erasure of every copy. Complete deletion coverage across systems and backups still needs verification. Earlier valid return or deletion requests and legally required retention are handled separately.
Account and financial records, support correspondence and security records may need different periods to meet their purpose, applicable duties, investigations or legal holds. Provider and backup copies are subject to the applicable deletion or overwrite arrangements. A document’s expiry date does not itself trigger deletion.
After a marketing objection, we may keep the minimum contact details and restriction record needed to honour it for as long as necessary to prevent further unwanted marketing. This record is used to respect your choice, not to send promotions.
8. Your rights and privacy contact
Depending on the law and circumstances, you may request access, correction, erasure, restriction or a portable copy of your information, withdraw consent, or challenge qualifying automated decisions. Rights have legal conditions and exceptions.
Your right to object
Where UK or EU data protection law applies, you may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time.
For employer or recruiter-controlled records, contact that organisation first; Crewzy assists under its processing agreement. For Crewzy-controlled information, email privacy@crewzy.io or write to Privacy, CODER VIEW LTD, 31 Little Dodden, Basildon, England, SS16 5TZ. We may need proportionate identity information; do not send credentials or complete identity documents with an initial enquiry.
You may complain to the UK Information Commissioner’s Office or another competent authority. Applicable mandatory local rights remain available.
9. Information for people in India
Indian privacy requirements and legal grounds are assessed separately. The DPDP Act and Rules commence in phases; not every provision is operational at once. Where applicable, the customer deciding purposes acts as Data Fiduciary and Crewzy as its Data Processor, with separate responsibility for Crewzy’s own purposes.
Use the privacy contact above for India-related enquiries or grievances. Rights, consent or other permitted-use requirements and protections for children depend on the applicable provisions. See the official commencement notification.
10. Cookies, security and updates
The application uses authentication cookies and browser storage for sessions and interface preferences. Remembered-account details may remain after sign-out; the different-account action clears them, and hints older than 90 days are not used.
Cloudflare Turnstile helps protect signup against automated abuse. It processes technical signals such as IP addresses and browser and connection information. See Cloudflare’s Turnstile Privacy Addendum for details.
Enabled Google sign-in, external email resources and the application’s ipapi.co country-lookup fallback can involve provider scripts or connection information. Netlify’s approximate country signal supports public regional pricing where available; it does not request GPS access or establish a paid billing country.
We use Google Ads to promote Crewzy. Google’s privacy policy explains how Google processes information in its advertising services.
Our security page explains hosting and application safeguards. Account eligibility is covered by our Terms; organisations handling young workers’ or apprentices’ information must consider relevant protections.
The date above identifies this policy version. We will update it when data uses change and provide appropriate notice of material changes where required.