This notice explains how personal data is handled when you use the Crewboard website at crewboard.uk and the Crewboard application at app.crewboard.uk. It is a draft and is being reviewed before Crewboard leaves early access.
Who is responsible for your data
The data controller is Paul Whittle, who operates Crewboard as an individual. You can contact the controller about anything in this notice at privacy@crewboard.uk.
Stations decide who to invite and what training to record. Where a station uses Crewboard to keep its own records about its members, the station may also have responsibilities for that data, and this notice will be updated to describe those arrangements before general availability.
What data we collect
If you contact us
- Your name, email address, station name (if given), the topic you choose and your message.
- A security check result from Cloudflare Turnstile, used to block automated spam.
If you use the Crewboard application
- Account details: name, email address and a securely hashed password.
- Station membership: your station, application role, operational role (for example Helm or Tier 2), rotation category and eligibility.
- Training data: sessions, attendance responses, absences, training records you appear in, and your position on the Training Board.
- Training plans and other documents uploaded by your station.
- Notification preferences and, if you turn them on, push notification subscriptions for your devices.
- Audit entries recording who made changes to training records, roles and settings, and when.
- Billing details for station owners who subscribe. Card details are handled by Stripe and are never stored by Crewboard.
- Technical data needed to run the service securely, such as sign-in events and error logs.
If you only visit this website
This website uses no analytics or advertising cookies and does not track you. Our hosting provider processes standard request data, such as IP address and browser type, to deliver pages and protect against abuse.
Why we use it and our lawful bases
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Providing the Crewboard service to stations and their members | Contract, and legitimate interests in running volunteer station training fairly and transparently |
| Replying to contact form messages and early access requests | Legitimate interests in responding to enquiries |
| Sending service emails such as invitations, password resets and training reminders | Contract, and legitimate interests |
| Keeping an audit history of training records and permission changes | Legitimate interests in accurate, accountable records |
| Billing station subscriptions | Contract, and legal obligation for financial records |
| Protecting the service from spam, fraud and abuse | Legitimate interests |
Crewboard is not designed to hold special category data such as health information. Please do not include it in messages, notes or uploaded plans.
Who processes data for us
We use the following processors. Each acts on our instructions under a data processing agreement.
| Processor | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage and server functions | London region (UK) |
| Postmark | Sending service and account emails | United States, under UK data transfer safeguards |
| Stripe | Subscription payments for station owners | United States and other locations, under UK data transfer safeguards |
| Cloudflare | Website and app hosting, and Turnstile spam protection on forms | Global network, under UK data transfer safeguards |
We do not sell personal data or share it for advertising.
How long we keep it
- Contact form messages: up to 24 months after the conversation ends, then deleted.
- Account and membership data: while you have an account. When a station removes you, your access ends immediately.
- Training records and audit history: kept for as long as the station uses Crewboard, because the rotation is calculated from history. When a station closes its workspace, its data is deleted within 90 days unless the law requires us to keep it.
- Billing records: as long as UK tax law requires, usually six years.
- Server logs: short periods set by our processors, typically days to weeks.
How we protect it
Data is encrypted in transit. Each station’s data is separated by row-level security in the database. Uploaded plans are stored privately and opened through short-lived links. Access is limited by role, and changes to training records and permissions are audited.
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in some circumstances;
- restrict or object to how we use it in some circumstances;
- receive your data in a portable format;
- withdraw consent where we rely on it.
Some training records support the fairness of a station’s rotation for everyone. If you ask for records to be erased, we will explain what can be removed and what the station needs to keep.
To use any of these rights, email privacy@crewboard.uk. We will reply within one month.
Complaints
If you are unhappy with how your data is handled, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
Changes to this notice
We will update this notice as Crewboard develops, and show the date of the latest change at the top of the page. Significant changes will be emailed to account holders.