Privacy Policy

Version 1.1 · Effective 20 July 2026 · Compliant with the Australian Privacy Act 1988

Crewreers connects superyacht crew with the vessels, captains and operators who hire them. Trust is the whole product, so we treat the personal information you share with the same care we ask our members to show each other. This policy explains what we collect, why, who we share it with, and the choices and rights you have.

1. Who We Are

The Crewreers mobile app and website (crewreers.com.au), together the "Service", are operated by EJM Ventures Pty Ltd (ABN 80 696 343 889; ACN 696 343 889), a company registered in New South Wales, Australia, trading as "Crewreers" ("we", "us", "our").

For the purposes of the Australian Privacy Act 1988 (Cth) and, where it applies, the EU/UK General Data Protection Regulation (GDPR), EJM Ventures Pty Ltd is the entity responsible for your personal information.

Privacy contact: support@crewreers.com.au

2. Scope of This Policy

This policy applies to personal information we collect when you:

Create or use a Crewreers account, whether as crew (an individual seeking work) or as an operator (a captain, agency, management company or vessel posting roles)
Build a profile, post or apply for listings, or message other members
Visit our website or otherwise interact with us

It does not cover the independent privacy practices of other members, or of third-party websites and services we link to. When we act only as a conduit between two members (for example, a crew member and an operator who choose to deal with each other), each of them handles the information they receive under their own responsibilities.

3. Information We Collect

We collect the following categories of information: most of it provided by you, some generated automatically as you use the app.

Category	Examples	Source
Account & identity	Name, email address, password (stored only as a secure hash by our authentication provider), date of birth, and the account type you choose (crew or operator)	You
Profile	Profile photo, location (city and country), roles and departments, skills, certifications and licences, visas and right-to-work details, work history and experience, an optional video introduction you record for your profile, and any bio you add	You
Operator / listing	Vessel or company details, vessel images, and the content of job listings you post	You
Applications & connections	Listings you apply to or save, applications you receive, hiring status, and mutual match connections	You & other members
Messages	The content of in-app chat messages you send to other members, and related metadata (timestamps, read status)	You
Reviews & testimonials	Testimonials or references you give or receive, and any ratings associated with them	You & other members
Identity verification	See Section 4. When you choose to get verified, an identity document and a facial image are processed by our verification partner; we receive the result plus your verified legal name and date of birth	You, via Stripe Identity
Payment	Subscription and purchase records (plan, credits, dates, amounts). Card and bank details are entered directly into our payment providers. We never see or store your full card number	You, via Stripe / Apple
Device & usage	Device type and operating system, app version, push notification tokens, log and diagnostic data, and general interactions with the app	Automatic
Support	Anything you send us when you contact support or report another member	You

Sensitive information: some of what you share (for example, certain visa or right-to-work details, or the identity documents used for verification) may be "sensitive information" under Australian law or a "special category" under GDPR. We only collect it with your consent and only to run the parts of the Service you ask us to (verification, matching and eligibility). You choose what to add to your profile.

4. Identity and Biometric Verification

Trust is central to Crewreers, so we offer an optional "Get Verified" flow that confirms you are a real, adult person and that your name matches a government-issued ID. This earns a Verified badge on your profile.

Verification is carried out by Stripe Identity, operated by Stripe, Inc. When you start verification:

You are taken to Stripe's secure flow, where you photograph a government identity document and take a selfie
Stripe processes the document image and a facial image (biometric identifiers) to confirm the document is genuine and that the selfie matches it. This biometric processing is performed by Stripe, not by Crewreers
Crewreers receives only the outcome: a verified or not-verified result, your confirmed legal name, and your date of birth (used to enforce our 18+ requirement). We do not receive or store the raw selfie, facial map, or a copy of your ID document

Stripe handles this data as described in Stripe's own privacy documentation, including any specific notices for biometric data. By starting verification you consent to Stripe processing your identity and biometric information for that purpose. You can decline verification and still use the core Service.

Stripe retains identity-verification data for up to 3 years by default. When you delete your Crewreers account, we automatically ask Stripe to redact your verification session; Stripe completes redaction within about 4 days. You can also ask us to remove your verification result and associated identity data at any time by contacting support@crewreers.com.au. Stripe may retain data for longer where the law requires it (for example, anti-money-laundering rules).

If you unlock the app using Face ID or Touch ID, that authentication is handled entirely by your device's operating system. Crewreers never receives or stores that biometric data.

5. How We Use Your Information

Run the Service: create and maintain your account and profile, and let you post, search, apply for and manage listings
Make matches: surface relevant crew, operators and listings, including through our matching features that compare roles, skills, certifications, location and preferences
Enable communication: deliver in-app messages and connection requests between members
Verify identity and build trust: operate the Get Verified flow, display Verified badges, and enforce our 18+ requirement
Process payments: manage subscriptions, credits and purchases, and keep billing records
Send notifications: push and in-app notifications about applications, messages, matches and account activity. You can control push notifications in your device and in-app settings
Keep the platform safe: detect, investigate and prevent fraud, abuse, spam and breaches of our Terms, including acting on reports from members
Support you: respond to enquiries and provide customer support
Improve the Service: understand how features are used and fix problems, using aggregated or de-identified data wherever we can
Meet legal obligations: comply with law, tax and accounting requirements, and respond to lawful requests

We do not sell your personal information, and we do not use it for third-party advertising.

6. Legal Bases (EU / UK Users)

If you are in the EU, EEA or UK, we rely on the following legal bases under the GDPR:

Performance of a contract: to provide the Service you sign up for (accounts, profiles, listings, messaging, payments)
Consent: for identity and biometric verification, for any sensitive information you choose to add, and for optional push notifications. You can withdraw consent at any time
Legitimate interests: to keep the platform safe and secure, prevent fraud and abuse, and improve the Service, balanced against your rights
Legal obligation: to comply with laws that apply to us (for example, tax and record-keeping)

7. How We Share Information

With other members: the heart of Crewreers is connecting people. Your profile (and, for operators, your listings) is visible to other members so they can find and contact you. When you apply to a listing, message a member, or match, the relevant information is shared with that member. Think of anything you put in your public profile as visible to the Crewreers community
With service providers who help us run the Service, under contract and only for that purpose (see Section 8)
For legal reasons: where we reasonably believe disclosure is required by law, or is necessary to protect the rights, safety or property of Crewreers, our members or the public
In a business transfer: if we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy

We do not sell your personal information.

8. Service Providers

We use trusted third parties to operate the Service. They process personal information on our behalf, under agreements that limit them to that purpose:

Provider	What they do	Data involved
Google Firebase (Google LLC)	App hosting, database, file storage, authentication, cloud functions, analytics and push messaging. Our data is hosted in Google's Australian region (australia-southeast1)	Most account, profile, listing, message and usage data
Stripe (Stripe, Inc.)	Payment processing for subscriptions and credit purchases made through our website	Payment and billing data (card details go directly to Stripe)
Stripe Identity (Stripe, Inc.)	Identity and biometric verification for the Get Verified flow	ID document and facial image (processed by Stripe); result returned to us
Apple (Apple Inc.)	In-app purchases and subscriptions made on iOS via the App Store	Purchase records (Apple processes payment)
RevenueCat (RevenueCat, Inc.)	Manages and reconciles in-app subscription entitlements	Subscription and entitlement identifiers linked to your account

9. International Data Transfers

We host member data in Australia (australia-southeast1). However, some of our providers, including Stripe and Apple, are based in or process data in the United States and other countries. This means your information may be transferred to and processed outside Australia and outside your own country.

Where we transfer personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles and, for EU/UK users, protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. How Long We Keep Data

While your account is active: we keep your profile and account data so the Service works
After you delete your account: we delete or de-identify your personal information within 30 days, except where we must keep certain records (for example, transaction and tax records, which Australian law generally requires us to keep for 5 years, or information needed to resolve disputes or enforce our Terms)
Messages and shared content: content you have shared with other members may remain visible to those members even after you delete your account (for example, a message already delivered)

11. Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls, hosting on Google's secure infrastructure, and restricting who can access member data. Payment card data is handled by PCI-compliant providers and never stored on our systems.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach that is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

12. Your Privacy Rights

Subject to your location and applicable law, you have the right to:

Access the personal information we hold about you
Correct information that is inaccurate or out of date (you can edit most of this directly in the app)
Delete your account and associated personal information (see Section 13)
Withdraw consent where we rely on it (for example, verification or push notifications)
Object to or restrict certain processing, and, for EU/UK users, request data portability
Complain to a regulator (see Section 17)

To exercise any of these rights, email support@crewreers.com.au. We may need to verify your identity before acting. We will not charge you for a reasonable request and will respond within the timeframes required by law.

California residents: we do not sell or "share" personal information as those terms are defined under the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

13. Deleting Your Account

You can request deletion of your Crewreers account at any time from within the app's account settings, or by emailing support@crewreers.com.au. When you delete your account, we remove or de-identify your profile and personal information as described in Section 10, and we request deletion of any identity verification data held by Stripe. Some records may be retained where the law requires or to resolve disputes.

14. Children

Crewreers is strictly for adults. You must be at least 18 years old to create an account, and our identity verification enforces this. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has provided us information, contact us immediately.

15. Cookies and Analytics

Our website may use essential cookies and similar technologies to keep you signed in and to remember your preferences. Where we use any non-essential cookies or analytics, we will seek your consent as required and give you a way to manage them. The mobile app does not use advertising cookies; aggregate usage analytics may be collected via Firebase to help us improve the Service.

16. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

17. Contact and Complaints

Questions, requests or privacy concerns? Contact us at:

Email: support@crewreers.com.au
Company: EJM Ventures Pty Ltd, trading as Crewreers
ABN: 80 696 343 889

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au
Phone: 1300 363 992

EU/UK users may also complain to their local data protection authority.