Privacy Policy

Overview

[[LLC_LEGAL_NAME]] ("CrewDeck," "we," "us," or "our") operates the CrewDeck production management platform, accessible at crewdeck.io and its subdomains (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use our Service.

By creating an account or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

Information We Collect

Account & Identity Information

When you register or are invited to CrewDeck, we collect:

• Full name and email address
• Password (stored as a salted, one-way hash — we never store it in plaintext)
• Profile photo or headshot (optional)
• Phone number (optional)
• Organization name and role within the organization

Crew Onboarding Information

When crew members complete the onboarding form for a production, we may collect:

• Mailing address
• Emergency contact details
• Department, role, and hire rate
• Union status and applicable union codes
• Start and end dates for the engagement

Tax & Payment Information

To facilitate payroll and contractor payments, we collect sensitive financial information, including:

• Social Security Number (SSN) or Employer Identification Number (EIN), for 1099/W-9 tax reporting purposes
• Bank account number and routing number, for ACH direct deposit payments
• Payment rate, payment type (check, ACH, wire), and related compensation details

This information is collected only when explicitly provided by crew members during the payment setup process and only after explicit consent is obtained. See Sensitive Financial Data for details on how this information is protected.

Usage & Technical Information

We automatically collect certain information when you use the Service:

• IP address, browser type, and device information
• Pages visited, features used, and time spent on the platform
• Referring URL and session identifiers
• Error logs and crash reports

Content You Create

The Service allows you to create and store production content, including call sheets, schedules, shot lists, budgets, contracts, invoices, and email communications. This content is stored on our servers and associated with your account.

Sensitive Financial Data

CrewDeck collects Social Security Numbers, Employer Identification Numbers, and bank account details for the sole purpose of facilitating legally required tax reporting and direct payment disbursement to crew members.

How SSN/EIN Data Is Handled

• SSN and EIN values are encrypted at rest using AES-256 encryption before being stored in our database.
• Access to decrypted values is restricted to authorized personnel and automated payment processing functions only.
• SSN/EIN data is never displayed in full in the user interface after initial entry; only the last four digits are shown.
• This data is used exclusively for generating IRS Form 1099-NEC and related tax documents, and for identity verification with payment processors.

How Bank Account Data Is Handled

• Bank account and routing numbers are encrypted at rest and transmitted over TLS/HTTPS.
• Bank data is used exclusively to initiate ACH payments to crew members who have consented to direct deposit.
• Account numbers are masked after entry and are not exposed to production company administrators beyond confirmation of account on file.

Consent Requirement

We require explicit informed consent before collecting SSN/EIN or bank account information. You will be presented with a clear consent prompt explaining the purpose of collection before any sensitive fields are enabled.

How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and maintain the CrewDeck platform, including processing payments, generating documents, and enabling collaboration between production companies and crew members.
• Payment Processing: To initiate ACH disbursements, generate 1099 tax documents, and (coming soon) issue virtual cards through Stripe Issuing.
• Account Management: To authenticate users, manage permissions, and enable organization-level access controls.
• Communications: To send transactional emails (invoices, call sheets, onboarding links, password resets). We do not send marketing emails without your explicit opt-in.
• Legal Compliance: To comply with applicable tax reporting requirements (IRS Form 1099), financial regulations, and court orders.
• Security & Fraud Prevention: To detect and prevent unauthorized access, abuse, and fraudulent transactions.
• Service Improvement: To understand how the Service is used and improve its features. Usage data is analyzed in aggregate and does not identify individual users.

Third-Party Service Processors

We use trusted third-party services to deliver the Service. These providers process data on our behalf under contractual obligations to keep it secure and use it only for the specified purpose.

Stripe

We use Stripe, Inc. for payment processing, including Stripe Connect for ACH payouts (and Stripe Issuing for virtual cards, coming soon). When you or your crew members enter banking or card information, that data is transmitted directly to and stored by Stripe under their own Privacy Policy. CrewDeck does not store raw card numbers. Stripe is PCI-DSS Level 1 compliant.

Supabase

Our database, authentication, and file storage infrastructure are provided by Supabase, Inc., which operates on AWS infrastructure. All data stored in Supabase is subject to Supabase's security controls and is processed within the United States.

Email Delivery

Transactional emails (onboarding invitations, call sheets, invoices, password resets) are sent via third-party email delivery services. These providers process recipient email addresses and message content to deliver emails on our behalf.

Google APIs

Certain features (such as address autocomplete) may use Google APIs. Use of these features is subject to Google's Privacy Policy.

Data Sharing

We do not sell, rent, or trade your personal information to third parties. We share information only in the following circumstances:

• Within Your Organization: Information you enter is visible to other authorized members of your CrewDeck organization, consistent with the permissions you configure.
• With Production Companies: Crew members' onboarding data (name, role, contact details, payment info) is shared with the production company that invited them, for the purpose of that production.
• Service Providers: As described in the Third-Party Processors section above.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or government authority, or if we believe disclosure is necessary to protect our rights or the safety of users.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service.

Data Retention

We retain different categories of data for different periods based on business need, legal obligation, and the nature of the information:

• Account Information: Retained for the duration of your active account, plus 90 days after account closure to allow for recovery.
• Tax Records (SSN/EIN, 1099 data): Retained for a minimum of 7 years from the end of the tax year in which the payment was made, as required by IRS regulations.
• Payment Transaction Records: Retained for 7 years for financial audit and compliance purposes.
• Bank Account Details: Retained while an active payment relationship exists. Upon request, bank account data is deleted within 30 days, subject to any outstanding payment obligations.
• Production Content (call sheets, schedules, budgets, etc.): Retained while your account is active. Upon account deletion, this content is deleted within 90 days unless it is part of a financial record subject to longer retention.
• Usage Logs: Retained for up to 12 months for security and debugging purposes.

When retention periods expire, data is securely deleted or anonymized.

Your Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request a copy of the personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal retention obligations).
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, see Data Deletion & Access Requests below.

All Users

Regardless of your location, you have the right to:

• Access and review your personal information through your account settings
• Correct inaccurate information by updating your profile
• Request deletion of your account and associated data
• Withdraw consent for the collection of sensitive financial data (note: this will disable payment features)
• Request a copy of your data in a portable format

Data Deletion & Access Requests

You may request deletion of your account and personal data at any time through either of the following methods:

• In-App: Navigate to Settings → Account → Delete Account. This initiates the deletion workflow directly.
• By Email: Send a deletion request to privacy@crewdeck.io from the email address associated with your account.

Upon receiving a verified deletion request, we will:

• Deactivate your account immediately upon verification
• Delete personal profile data within 30 days
• Delete production content within 90 days
• Retain tax and financial records for the legally required period (up to 7 years), after which they will be deleted
• Confirm completion of deletion via email

We will respond to all access or deletion requests within 45 days. If additional time is needed, we will notify you within the initial 45-day period.

Security

We implement industry-standard security measures to protect your information:

• All data is transmitted over HTTPS/TLS 1.2 or higher
• Sensitive data (SSN, bank accounts) is encrypted at rest using AES-256
• Database access is restricted via Row-Level Security (RLS) policies — users can only access data they are authorized to see
• Authentication is handled via Supabase Auth with bcrypt password hashing
• API keys and secrets are stored in server-side environment variables, never in client-side code
• Access to production infrastructure is restricted to authorized personnel only

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights or freedoms, we will notify affected users as required by applicable law.

Children's Privacy

The Service is intended for use by individuals 18 years of age or older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will take steps to delete it promptly. If you believe we have inadvertently collected such information, please contact us at privacy@crewdeck.io.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to registered users
• Display a notice within the Service for 30 days following the change

Your continued use of the Service after the effective date of an updated policy constitutes your acceptance of the changes.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@crewdeck.io
• General: hello@crewdeck.io

We will respond to all privacy inquiries within 10 business days.