Privacy policy

This policy explains how CrewDesk (“we”, “us”), at crewdesk.work, handles personal data when companies and their staff use CrewDesk. Questions: hello@crewdesk.work.

Who is responsible for what

A company that uses CrewDesk (the “owner”) decides which staff to add and what to record about them. For that staff data, the company is the controller and we process it on the company's behalf. For account data we need to run the service (such as sign-in details), we are responsible.

What we collect

• Account details: email address, name, and a password if you set one. Passwords are stored only as one-way hashes; we can't read them.
• Staff records the company adds: name, email, job title, start date, team, role, employee ID, usual shift and week-off pattern.
• Work records: rota and shifts, punch-in and punch-out times, breaks, time corrections, leave requests (type, dates and any note), compliance checks, and hiring candidates' names, contact details and notes.
• Weekly pulse: answers are stored without a name or person ID. We only record that someone answered that week, to stop repeat answers.
• Technical data: a sign-in cookie to keep you signed in, and anonymous usage events (for example “app opened”) with a random ID. We don't store IP addresses with these events.

How we use it

Only to provide CrewDesk: sign you in, show the right information to the right people in your company, send sign-in and invitation emails, keep the service secure (for example blocking repeated wrong passwords), and improve the product. We don't sell personal data and we don't use it for advertising.

Who can see it

• Inside your company: the owner sees everything; crew support see the teams they look after; employees see their own records and shifts.
• Service providers that run CrewDesk for us: Cloudflare (hosting and database) and Resend (sending emails). They only process data to provide their service to us.
• We may disclose data if the law requires it.

Where it's stored

On Cloudflare's network. Data may be processed in countries other than your own; our providers use appropriate safeguards for international transfers.

How long we keep it

For as long as the company uses CrewDesk. When an owner removes a person, they lose access straight away. When a company asks us to delete it, we delete its data from the live service; backup copies are removed within 30 days.

Your rights

You can ask for a copy of your data, or ask us to correct or delete it. If your data was added by your employer, you can also ask them, as they control it. Email hello@crewdesk.work and we'll respond within 30 days. Depending on where you live, you may also be able to complain to your data protection authority.

Security

Connections are encrypted (HTTPS). Passwords are hashed, sign-in links work once and expire, and repeated wrong passwords are locked out for a while.

Children

CrewDesk is a workplace tool and isn't meant for children.

Changes

If we change this policy, we'll update this page and the date at the top. For important changes, we'll tell company owners by email.