Crewed Privacy Policy

Effective date: September 7, 2026 Last updated: September 7, 2026

Crewed is operated by Freelance Studio Ltd Co., a Georgia limited liability company (“Freelance Studio”, “we”, “us”). This policy explains what we collect when you use Crewed at crewed.studio, why we collect it, who we share it with, and what you can do about it.

Crewed is a business tool for freelance crew. Most of what’s in your account is information you typed in about your own work. We hold it so you can get it back. We don’t sell it, and we don’t use it to train AI models.

1. Who this policy covers

This policy applies to:

• Account holders — people with a Crewed account, on a trial or a paid plan.
• Visitors to the public parts of crewed.studio (marketing pages, pricing, blog, demo).
• People who submit an availability request through an account holder’s public request link.

It does not cover third-party sites we link to, or what an account holder does with data after they export it from Crewed.

2. Information we collect

2.1 Account and billing information

When you sign up we collect your name, email address, and password (stored hashed by WordPress — we never see it in plain text).

Payments are processed by Stripe through Paid Memberships Pro. We do not collect, see, or store your card number, CVC, or bank account details. We retain the subscription records Stripe and Paid Memberships Pro give us: plan level, subscription status, order history, amounts, dates, and the billing name and address you provided at checkout.

2.2 Your business profile

Optional settings you enter about your own business: business name, business email, phone, mailing address, website, logo, invoice color, payment instructions, tax state, and federal tax bracket.

The “payment instructions” field is free text that appears on your invoices. Whatever you type there — a Venmo handle, a Zelle address, bank details — is stored as you typed it. Don’t put anything there you wouldn’t want printed on an invoice.

2.3 Content you enter

The substance of your account. Depending on what you use, this includes:

2.4 Information about other people

Crewed lets you store details about clients, payroll contacts, and fellow crew members. That information is about people who are not our users and who have not agreed to this policy.

You are responsible for having a lawful reason to hold it and for keeping it accurate. We process it on your behalf, as your service provider, and only to run the features you’re using. If someone contacts us about information you’ve stored, we will generally refer them to you.

2.5 Location data

If you use the mileage tracker’s live “Start drive” / “End drive” feature and grant your browser’s location permission, we record the latitude and longitude at those two moments. We do not track your location in the background, continuously, or when the feature is not in use.

Addresses you type into the mileage tracker are sent to Mapbox to convert them into coordinates and to calculate driving distance (see §4).

You can turn off coordinate storage in your mileage settings; distances are then kept without the underlying coordinates.

2.6 Availability requests

Account holders can publish a link that lets anyone request their availability for a job. When someone submits that form we collect what they enter — name, email, phone, organization, event name, type, location, dates, times, estimated hours, position, budget range, and any additional details — plus the submitter’s IP address and browser user agent, which we keep to prevent abuse of an open public form.

That submission is delivered to the account holder it was addressed to, and the submitter receives a confirmation email.

2.7 Security and activity logs

Crewed keeps an internal audit log of changes made in an account: what action was taken, on what record, by which account, when, from what IP address and browser user agent, and a before/after snapshot of the changed values. Credentials, access tokens, and EINs are excluded from these snapshots.

We use it for security investigation, fraud prevention, and support. Audit log entries are deleted after 365 days.

Our web host also keeps standard server logs (IP address, request path, timestamp, user agent) as part of normal operation.

2.8 Support requests

If you use “Report a Bug” or “Request Support” inside Crewed, we receive: your subject and message, the category, your account display name and email, your site address, a short label for the section you were on (for example “Gigs → Kanban”), what you expected and what happened, any screenshots you chose to attach, and basic environment information — Crewed version, WordPress version, PHP version, MySQL version, theme, and memory/upload limits.

The environment information is shown to you in the form before you submit. We do not capture screenshots automatically, and Crewed does not attach your full URL or your error logs to a support ticket.

Tickets are handled by our own support system on crewed.studio, which stores the ticket contents, your name and email, any attachments, our internal notes, and the IP address the ticket was submitted from. You receive a confirmation email with a private link that lets you track and reply to your ticket without logging in. Attachments are stored on our server outside the publicly browsable web root.

2.9 Product statistics

We keep a small number of aggregate, non-identifying counters — for example the total number of PDFs generated and app installs across all accounts. These are not tied to individual users.

3. Cookies, storage, and analytics

Crewed’s application does not set any cookies of its own.

We use a consent banner on crewed.studio. Non-essential cookies — analytics — are set only after you accept them, and you can change or withdraw your choice at any time through the banner’s preferences link. Strictly necessary cookies, the ones that keep you logged in and let checkout work, are not covered by consent because the service cannot function without them.

What is in play:

• WordPress authentication cookies — strictly necessary. They keep you logged in. Without them the app can’t work.
• Paid Memberships Pro cookies — strictly necessary for checkout and membership session handling.
• Google Analytics 4 (measurement ID G-E2FSE23K2H) — runs on public marketing pages only. It is explicitly disabled on every logged-in app page, the membership account area, and the login page. We do not measure what you do inside your account.
• Browser local storage — a single flag recording that you dismissed the “install the app” prompt.
• Browser session storage — a single flag recording that you have a mileage drive in progress. It clears when you close the tab.
• Service worker — Crewed is installable as an app. Its service worker caches static assets (CSS, JS, icons) and one offline fallback page. Pages containing your data are always fetched from the network and are never cached.

We also load a small number of assets from third-party CDNs (see §4), which necessarily reveals your IP address and user agent to those providers.

Do Not Track and Global Privacy Control: we honor Global Privacy Control signals as an opt-out of any sale or sharing of personal information. Since we do not sell or share personal information at all, there is nothing further to opt out of.

4. Who we share information with

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use it, or provide it to anyone else to use, for training AI or machine-learning models. Our member-only pages carry noai directives and we block known AI training crawlers from them.

We share information only in these situations:

Service providers who help us run Crewed

Google — only if you connect it, and only what you choose

Connecting Google Calendar or Google Drive is optional and entirely under your control.

• Calendar (calendar scope): when you sync a gig we send the event name, the company name, the employment type (1099/W2), a link back to the gig in Crewed, and the date and time. We do not send pay rates or any dollar amounts to Google. No attendees are added. If you import from Google, we read event titles, descriptions, locations, and times from the calendars you select.
• Drive (drive.file scope): if you choose Drive storage for receipts, they are uploaded to a “Crewed Receipts” folder in your own Google Drive. The drive.file scope means Crewed can only see and touch files it created — it has no access to the rest of your Drive. Receipt images are served back to you through Crewed, not by exposing Drive links.

We store your Google access and refresh tokens, encrypted, so the connection persists. You can disconnect at any time in Settings, which revokes our access.

Others

• Recipients you send to. Invoices and other documents you generate are yours to send. Availability request confirmations go to the person who submitted the request.
• Legal. If we’re required to by law, subpoena, or valid legal process, or where we believe disclosure is necessary to protect our rights, investigate fraud, or protect someone’s safety.
• Business transfer. If Freelance Studio is acquired, merged, or sells substantially all of its assets, account data may transfer as part of that transaction. We’ll notify you before your information becomes subject to a different privacy policy.

5. Where your data is held, and international transfers

Crewed’s database and file storage are hosted in the United States by Namecheap, Inc. Freelance Studio operates from Georgia, USA.

If you use Crewed from outside the US — including from the EEA, the UK, or Switzerland — your information is transferred to and processed in the United States. Where required, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) as the transfer mechanism, together with the safeguards described in §7.

6. How long we keep things

The 180-day clock. If your membership ends — you cancel, or it lapses — we start a 180-day countdown. We email you a warning at day 150 (30 days out) and a final notice at day 173 (7 days out), both linking to the export tool. At day 180 your account content is permanently deleted. Reactivating your membership at any point stops and clears the clock.

Export your data before that deadline if you want to keep it. After deletion we cannot recover it.

7. How we protect it

• All traffic to crewed.studio is encrypted in transit with TLS.
• Client EINs and your Google OAuth tokens are encrypted at rest using authenticated encryption, with a versioned key registry and key rotation support. Other fields are stored unencrypted in our database, protected by host-level and database access controls.
• Every query in the application is scoped to your user account. One account cannot read another’s records.
• Mutating actions are recorded in the audit log described in §2.7.
• Passwords are hashed; we cannot read them.
• Credentials, tokens, and EINs are excluded from log snapshots.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulator within the timeframes the law requires.

8. Your rights and choices

8.1 Everyone

• Export. Settings → Data gives you a complete JSON export of everything you’ve entered — clients, crew, gigs, gig days, invoices, expenses, mileage, saved routes, rate cards, availability requests, quarterly tax payments, historical data, and your settings. No request needed, no waiting.
• Correct. Edit any record directly in the app.
• Delete. Email support@crewed.studio and we’ll erase your account data. Deletion is permanent and is not reversible.
• Disconnect Google. Settings → Integrations, at any time.
• Turn off mileage coordinates. Mileage settings.
• Unsubscribe from non-essential email using the link in those messages. We’ll still send transactional messages about your account and billing.

8.2 California residents (CCPA/CPRA)

In the 12 months before this policy’s effective date, we collected the following categories of personal information, from you directly, for the business purposes described in §2:

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months, and we do not sell or share the personal information of minors under 16.

You have the right to know, to access, to correct, to delete, and to limit use of sensitive information (we collect none), and the right not to be discriminated against for exercising any of these rights. Exercise them at support@crewed.studio, or use the self-serve export and deletion tools above. We’ll verify your request against the email on your account. An authorized agent may act for you with written permission.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have substantially similar rights, including the right to appeal a refusal — reply to our decision and we’ll review it.

8.3 EEA, UK, and Swiss residents (GDPR)

Controller: Freelance Studio Ltd Co., Marietta, Georgia, USA. Contact: support@crewed.studio.

For the personal information of your clients and crew contacts, you are the controller and we act as your processor.

Our legal bases:

You have the right to access, rectify, erase, restrict, and object to processing, the right to data portability (the JSON export in §8.1 is machine-readable and provided on demand), and the right to withdraw consent without affecting processing already carried out. We do not make automated decisions producing legal or similarly significant effects.

You can lodge a complaint with your national supervisory authority — or, in the UK, the Information Commissioner’s Office. We’d appreciate the chance to sort it out first.

9. Children

Crewed is a business tool for working adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email support@crewed.studio and we’ll delete it.

10. Changes to this policy

We’ll post any changes here with a new “Last updated” date. If a change materially affects how we handle your information, we’ll email account holders at least 14 days before it takes effect. Continuing to use Crewed after that means you accept the updated policy.

11. Contact

Freelance Studio Ltd Co. Marietta, Georgia, USA support@crewed.studio

For privacy requests, put “Privacy request” in the subject line. We respond within 30 days, or 45 days where the law allows an extension and we tell you why.