Privacy Policy

1. Introduction and Scope

Croo ("we", "our", "us", or "Company") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store, and safeguard your information when you use our platform, website, and services (collectively, the "Service").

Please read this privacy policy carefully. By accessing or using Croo, you acknowledge that you have read, understood, and agree to be bound by all the terms of this privacy policy. If you do not agree with our privacy practices, please do not use our platform.

2. Information We Collect

2.1 Account Registration Information

When you create a Croo account, we collect:

• Email address
• Password (encrypted and hashed)
• Account type (crew member or user)
• Age verification (confirmation you are 18+)
• Full name and phone number (optional)
• Terms and privacy policy acceptance timestamp

2.2 Crew Profile Information

If you register as a crew member, we collect:

• Professional experience and work history
• Certifications, licenses, and qualifications
• Professional documents (CV, PDFs)
• Profile photographs and gallery images
• Languages spoken and proficiency levels
• Crew roles and specializations
• Availability calendar and scheduling information
• Location preferences and sailing regions
• Professional biography and about section
• Salary expectations and compensation preferences
• Connections with other crew members

2.3 Usage and Technical Data

• IP address and device identifiers
• Browser type, version, and operating system
• Pages visited and actions taken on the platform
• Search queries and filter preferences
• Time spent on pages and user engagement metrics
• Referring URL and exit pages
• Crash reports and error logs

2.4 Ratings and Review Data

• Rating scores (1-5 stars) across four categories
• Written review text and comments
• Photos attached to ratings
• Responses and replies to ratings
• Flag/report information on ratings
• Timestamp of rating submission

2.5 Communication and Contact Data

• Contact form submissions and inquiries
• Message content between crew and employers
• Email correspondence with our support team
• Communication preferences and notification settings

2.6 Additional Information

• Blocked users list
• Report submissions and complaint details
• Payment or subscription information (if applicable)
• Feedback, surveys, and user research responses

3. How We Use Your Data

We use your personal information for the following purposes:

• Service Delivery: Creating and maintaining your account, providing platform access, and enabling core features
• Profile Management: Displaying crew profiles to potential employers and users searching the platform
• Communication: Sending service notifications, updates, password resets, and responding to inquiries
• Matching and Search: Enabling users to search and filter crew profiles based on criteria
• Ratings and Feedback: Facilitating ratings, reviews, and responses between users
• Platform Improvement: Analyzing usage patterns to improve features, performance, and user experience
• Safety and Compliance: Preventing fraud, detecting abuse, enforcing our terms, and complying with legal obligations
• Marketing (with consent): Sending promotional content and newsletters only with your explicit opt-in
• Analytics: Understanding how users interact with our platform to optimize functionality
• Legal and Regulatory: Responding to government requests and fulfilling legal requirements

4. Data Sharing and Disclosure

4.1 Public Information

Crew profiles (including name, roles, experience, certifications, photos, ratings, and reviews) are publicly visible to all platform users. You control what information appears in your public profile through your account settings.

4.2 Employer-to-Crew Communication

When an employer contacts a crew member, we facilitate communication. Email addresses are not automatically shared—users can choose to exchange contact details through our messaging system.

4.3 Third-Party Service Providers

We may share your data with trusted service providers who help us operate the platform, including:

• Cloud storage and hosting providers
• Email and communication service providers
• Payment processors (if applicable)
• Analytics and monitoring services
• Security and fraud detection services

These providers are contractually obligated to use your data only for the purposes we specify and to maintain the confidentiality and security of your information.

4.4 Legal and Law Enforcement

We may disclose your personal data if required by law, court order, or government request. We will notify you of such requests unless legally prohibited.

4.5 Business Transfers

If Croo is involved in a merger, acquisition, bankruptcy, or sale of assets, your personal data may be transferred as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

4.6 No Sale of Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share aggregated, anonymized data for research and analytics without identifying individuals.

5. Data Storage, Security, and Retention

5.1 Data Security

We implement appropriate technical and organizational measures to protect your data from unauthorized access, alteration, disclosure, or destruction:

• End-to-end encryption for sensitive data
• Secure HTTPS connections for all platform traffic
• Encrypted password hashing and salting
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Secure data center infrastructure
• Employee confidentiality agreements and security training

5.2 Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Active Accounts: While your account is active, we retain all profile and usage data
• Deleted Accounts: Upon account deletion, we delete personal data within 30 days, except where required by law
• Ratings and Reviews: Ratings remain on the platform (may be anonymized) for historical purposes, but can be removed upon request
• Legal/Compliance: We may retain data longer if required by law or to establish, exercise, or defend legal claims
• Backup Data: We may retain backup copies for business continuity purposes for up to 90 days

5.3 Data Location

Your data is processed and stored on secure servers. Data may be transferred to and processed in countries other than your country of residence. Such transfers are conducted in accordance with applicable data protection laws with appropriate safeguards in place.

6. Your Rights Under GDPR and Privacy Laws

If you are a resident of the EU, UK, or other jurisdictions with data protection laws, you have the following rights:

6.1 Right to Access

You have the right to request and obtain a copy of all personal data we hold about you. We will provide this in a structured, commonly-used, machine-readable format within 30 days of your request.

6.2 Right to Rectification

You have the right to correct inaccurate, incomplete, or outdated personal data. You can update most information directly in your account settings.

6.3 Right to Erasure ("Right to Be Forgotten")

You have the right to request deletion of your personal data under certain circumstances. When you delete your account, we will remove your data within 30 days, except where legal obligations require retention.

6.4 Right to Restrict Processing

You have the right to request that we limit how we process your data in certain situations, such as while we verify the accuracy of disputed data.

6.5 Right to Data Portability

You have the right to export your personal data in a structured, commonly-used, machine-readable format (e.g., CSV) and to transmit it to another service without hindrance.

6.6 Right to Object

You have the right to object to certain processing of your data, including marketing communications. You can manage your preferences in account settings.

6.7 Right to File a Complaint

You have the right to lodge a complaint with your local data protection authority (supervisory authority) if you believe we have violated your rights.

To exercise any of these rights, contact us at [privacy@croo.app]. We will respond to requests within 30 days and may ask for additional information to verify your identity.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication, security, and core platform functionality
• Preference Cookies: Remember your language, theme (dark/light mode), and display preferences
• Analytics Cookies: Help us understand how users interact with our platform (anonymized)

You can control cookies through your browser settings. Disabling essential cookies may limit platform functionality. We respect "Do Not Track" signals from your browser.

8. Third-Party Links and Services

Our platform may contain links to third-party websites and services (e.g., social media, booking sites, external resources). We have no control over and assume no responsibility for the privacy practices of these external sites. Please review their privacy policies before providing your information.

9. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete such information and terminate the child's account. Contact us immediately if you believe a minor has created an account.

10. International Data Transfers

Your data may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that differ from your home country. By using Croo, you consent to the transfer of your data to countries outside your country of residence. We take appropriate safeguards when transferring data internationally, including Standard Contractual Clauses.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal data we collect, use, and share
• Right to delete your personal data (with exceptions)
• Right to opt-out of the sale of your personal data (we do not sell data)
• Right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at [privacy@croo.app].

12. Email Communications and Preferences

We will send you service-related announcements and administrative messages. You can manage your communication preferences in your account settings:

• Transactional Emails: Account confirmations, password resets, security alerts (cannot be disabled)
• Service Updates: Important changes to our platform or policies
• Marketing Communications: Newsletters and promotional content (opt-in only)

You can unsubscribe from non-essential communications by clicking the unsubscribe link in any email or updating your preferences in account settings.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by email or through a prominent notice on our platform. Your continued use of Croo after changes become effective constitutes your acceptance of the updated privacy policy.

14. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or our privacy practices, please contact us:

Email: privacy@croo.app
Mailing Address: [Company Address - PLACEHOLDER]
Data Protection Officer (DPO): [DPO Contact - PLACEHOLDER]

We will respond to all inquiries within 30 days of receipt.

15. Your Choices and Control

You have choices regarding how your personal data is collected, used, and shared:

• You can choose not to provide optional information, though this may limit functionality
• You can update or correct your profile information anytime
• You can download your data or request deletion of your account
• You can block other users from contacting you
• You can adjust browser cookie settings and opt-out of analytics
• You can manage email notification preferences