Privacy Policy

1. Who We Are

Crewkind Ltd ("Crewkind", "we", "us") operates the HR management platform available at crewkind.app and is the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC169609. This Privacy Policy explains how we collect and use personal data about platform administrators and account holders (i.e. the people who set up and manage Crewkind accounts on behalf of their businesses).

This policy does not cover the employee data that our customers enter into the platform. That data is governed by our Data Processing Agreement — customers are the data controllers of their employees' data, and Crewkind processes it on their behalf.

For questions about this policy, contact us at privacy@crewkind.app.

2. Data We Collect About You

When you sign up or are invited:

• Name and email address
• Company name and approximate team size
• IP address and user agent at time of sign-up (for legal acceptance audit trail)

When you use the platform:

• Login timestamps and session data
• IP address (for security logging)
• Actions taken within the platform (audit log)

We do not collect:

• Passwords (we use magic link authentication — no passwords are stored)
• Payment card details (handled directly by Stripe)
• Tracking or behavioural data beyond what is necessary to operate the Service

3. How We Use Your Data

We use your data to:

• Provide and operate the Crewkind platform
• Send you essential service communications (login links, billing notifications, service updates)
• Maintain an audit trail of legal document acceptance (required for UK GDPR compliance)
• Investigate and resolve security incidents
• Improve the Service (using aggregated, anonymised usage data only)

Our lawful basis for processing is performance of a contract (to provide you with the Service) and legitimate interests (security and service improvement).

4. Cookies

We use session cookies only — these are strictly necessary to keep you logged in. We do not use tracking cookies, advertising cookies, or analytics cookies that identify individuals.

You cannot opt out of session cookies as they are required for the Service to function. You can clear them at any time by logging out or clearing your browser cookies.

5. Third Parties

We share data only with the following sub-processors, as necessary to operate the Service:

We do not sell your personal data to any third party.

6. Data Retention

• Account data: Retained while your account is active, plus 30 days after account deletion or subscription cancellation.
• Legal acceptance records: Retained for 7 years (required audit trail).
• Security logs: Retained for 12 months.
• Accounting records (invoices and expenses): Retained for 7 years in line with UK statutory accounting requirements (Companies Act s.386 / HMRC).
• Employee data entered by customers: Governed by the Data Processing Agreement — typically retained for 6 years after employment ends in line with UK statutory requirements, then deleted.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erasure (“right to be forgotten”) — subject to our legal retention obligations
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@crewkind.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Changes to This Policy

We will notify you of any material changes to this policy with at least 30 days' notice. Continued use of the Service after changes take effect constitutes acceptance.