Privacy Policy
Last updated: 10 August 2026
CrewHall respects your right to privacy. This policy explains what data we collect, why we collect it, how we protect it and what your rights are.
1. What Data We Collect and Why
Account Data (all users)
- • Email address, password (encrypted), full name — required for authentication
- • Role (candidate/company) — for personalising the experience
- • GDPR and AI consent timestamps — legal compliance
Candidate Profile Data
- • Desired position, experience, skills, industry, country — for job matching
- • Salary expectations, availability — shown to interested employers
- • Profile photo (optional) — stored securely in Supabase Storage
- • CV (optional, PDF) — sent only to employers you apply to
Voice Session Data (with explicit consent)
- • Audio recording of the career session — processed by ElevenLabs (USA)
- • Conversation transcript — saved temporarily for profile data extraction
- • Extracted data (skills, experience etc.) — saved to your profile
Company Data
- • Company information (name, industry, size, website) — displayed publicly to candidates
- • Job postings — indexed in the matching platform
Usage Data (anonymised)
- • AI audit logs (event type, timestamp, no personal content) — compliance with Art. 12 EU AI Act
1b. Reviews Published on the Open Web
Members who completed a CrewHall assessment can review vessels and employers. A published review appears on a page anyone can read, without an account, and search engines may index it.
Your identity is never published. The public page shows the review text, a coarse role group (for example “Deck officer”) and the date. It does not show your name, your exact rank, your photo, your voyage dates or your account. We keep the link between you and your review internally, so that we can answer a legal complaint and stop abuse — that link is never shown to anyone outside CrewHall. An average rating appears only once a subject has at least three reviews, so a single voice cannot be traced back to one person.
Every review is read by a person before it is published, and nothing is published while it waits. You can ask us to remove yours at any time; deleting your account also removes the link between you and anything you wrote.
If a review names your vessel or company
Each public page carries a form for replying publicly or asking for content to be removed. To handle it we keep the name, role and email address you give us, together with what you sent and how we handled it — we need that record to show a regulator how a complaint was dealt with. We keep it for as long as the review is published and for three years afterwards. Your reply is published only if you tick the box asking us to; a removal request never publishes anything about you.
2. Who We Share Data With
Supabase (EU — Stockholm)
Database, authentication, file storage
✓ Data stored in the EU (eu-north-1)
ElevenLabs Inc. (USA)
Audio processing for voice career sessions
✓ EU-US SCC, only with consent
Google LLC (USA)
Competency scoring from your interview transcript, and professional domain classification
✓ EU-US SCC. Scoring processes the transcript of what you said — this is personal data
Google LLC (USA)
Sign-in with Google, if you choose it
✓ Email address and name, only if you use this sign-in method
Vercel (USA)
Frontend application hosting
✓ EU-US SCC, session data
We do not sell or share data with other third parties for marketing purposes.
3. How Long We Retain Data
4. Your Rights (GDPR)
Right to information (Art. 13)
This page.
Right of access (Art. 15)
Request a copy of all your data.
Right to rectification (Art. 16)
Correct inaccurate data in your profile.
Right to erasure (Art. 17)
Settings → Delete Account. Data removed within 30 days.
Right to portability (Art. 20)
Settings → Download My Data (JSON format).
Right to object (Art. 21)
Contact us to stop processing for certain purposes.
Right to explanation (GDPR Art. 22)
Each competency is shown with the written reasoning behind its score.
AI score contestation (GDPR Art. 22(3) + AI Act Art. 86)
Settings → Contest an AI score.
5. How to Exercise Your Rights
Download or delete your data directly from the app
Go to Settings (user icon in the header) → "Download My Data" or "Delete Account".
For manual requests or questions: privacy@crewhall.co
We respond to requests within a maximum of 30 calendar days (Art. 12 GDPR).
You have the right to lodge a complaint with a supervisory authority. Our lead authority is the Information Commissioner's Office (ICO) in the United Kingdom, at ico.org.uk. If you live in the European Economic Area, you may also complain to the authority in your country of residence.