Privacy Policy

crewrate.io (“crewrate”, “we”, “us”) is an independent index of maritime employers: crew-submitted company reviews, wage reports and related community discussion. We act as the data controller for the personal data described in this policy.

Contact for all privacy matters: privacy@crewrate.io.

Account data. When you register we collect your email address and, if you sign up with a password, a cryptographic hash of that password (we never store the password itself). If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. Your email address is never shown publicly.

Profile data (optional). You may add a display name, rank, nationality, country, years of experience, current company, vessel types, certificates, a short bio and an avatar. All of these fields are voluntary; you control what appears on your public profile.

Content you submit. Reviews, ratings, wage reports, community posts, comments, votes, follows, company edit suggestions, moderation reports, and any documents or images you attach (for example, proof of employment). Reviews are published without your email address and can be posted under a pseudonym.

Technical data. Session cookies required to keep you signed in, and standard server logs (IP address, browser type, pages requested) kept for security and troubleshooting. Our analytics (Vercel Web Analytics) is cookie-free and aggregates visits without building individual profiles.

Publicly available data. We also index publicly posted vacancy and wage information from maritime job boards. This data concerns companies and pay levels, not identified individuals.

• To provide the service — creating your account, publishing your reviews and posts, showing your profile (performance of a contract, Art. 6(1)(b) GDPR).
• To keep wage data trustworthy — tying submissions to accounts, detecting spam, duplicates and manipulation, moderating content (legitimate interest, Art. 6(1)(f) GDPR).
• To secure the service — authentication, abuse prevention, server logs (legitimate interest, Art. 6(1)(f) GDPR).
• To produce aggregate statistics — average wages by rank and vessel type; these statistics do not identify you (legitimate interest, Art. 6(1)(f) GDPR).
• To send you notifications — replies, moderation outcomes and, only if you opt in, email updates (consent, Art. 6(1)(a) GDPR; you can withdraw at any time in your settings).
• To comply with legal obligations — responding to lawful requests (Art. 6(1)(c) GDPR).

Public: your reviews, wage reports (shown without your identity unless you choose a public display name), community posts and comments, and any profile fields you fill in. Private: your email address, sign-in method, password hash, attached proof documents (visible to moderators only), notification settings and moderation history.

Please do not include in review text personal data about identifiable individuals (for example, names of specific crew members or office staff). We may edit or remove such content.

We do not sell personal data and do not share it with advertisers. We use a small number of processors under data processing agreements:

• Supabase — database and authentication. Your data is stored in the EU (Frankfurt, Germany).
• Vercel — website hosting and cookie-free analytics. Vercel may process technical request data outside the EU under Standard Contractual Clauses.

If you sign in with Google or Facebook, those providers process your sign-in under their own privacy policies as independent controllers. We only receive the profile data listed in Section 2 and never post anything to your accounts.

We may disclose data if required by law, or to establish or defend legal claims.

Primary storage is in the European Union. Where a processor handles data outside the EU/EEA (for example, edge hosting by Vercel), the transfer is protected by the European Commission’s Standard Contractual Clauses or an adequacy decision such as the EU-U.S. Data Privacy Framework.

• Account and profile — until you delete your account.
• Reviews and wage reports — while published. If you delete your account, your reviews are either deleted at your request or retained in fully anonymized form (no link to you) to preserve the integrity of aggregate wage statistics.
• Proof documents — deleted after verification is complete, and in any case when the related review is deleted.
• Server logs — up to 30 days.
• Moderation records — up to 12 months after the related decision, to handle appeals and repeated abuse.

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data (most profile fields you can edit yourself in settings);
• delete your account and data (“right to be forgotten”);
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at privacy@crewrate.io. We respond within one month.

We use only strictly necessary cookies: Supabase authentication cookies that keep you signed in (prefixed sb-). We do not use advertising or cross-site tracking cookies, which is why we do not show a cookie consent banner. Our analytics runs without cookies and without individual identifiers.

All traffic is encrypted in transit (TLS). Data at rest is stored with an EU cloud provider with encryption and access controls; administrative access is limited and authenticated. No online service can guarantee absolute security — if we become aware of a breach affecting your data, we will notify you and the competent authority as required by law.

crewrate.io is intended for maritime professionals and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the service evolves. Material changes will be announced on the site before they take effect, and the effective date above will be updated. Continued use of the service after a change means the updated policy applies.