Privacy Policy

01Who we are and what this policy covers

The controller (the owner of personal data under Ukrainian law) of the personal data described here is the individual entrepreneur (sole proprietor, FOP) Oleinyk M.V., Odesa, Ukraine, registered under the law of Ukraine ("Crewings", "we"). Contact for data-protection matters: [email protected].

This policy covers the website crewings.me, the CREWINGS mobile app (including its web version at crewings.me/app), our Telegram bot and channels, our e-mails and support correspondence. It applies to seafarers, to representatives of companies and to visitors.

Companies that receive your CV through Crewings process it as independent controllers under their own policies. The related service Marine Helper (marinehelper.com) is run by the same operator under its own privacy policy.

We process personal data under the law of Ukraine, including the Law of Ukraine "On Personal Data Protection". If you are in the European Economic Area or the UK, the GDPR and the UK GDPR apply in addition, and this policy is written with their requirements in mind.

02What data we collect

2.1 Account

E-mail address, password (stored as a hash), name, phone number, the language and appearance settings you choose, the date of registration, your consents, and your sign-in history (date, IP address, device type).

2.2 Seafarer profile (CV)

Everything you enter or upload into your CV in order to be found by companies:

• Identity and contacts: first name and surname, gender, date of birth, citizenship, country and address, photo, phone numbers, e-mail, Viber, WhatsApp, Telegram and LinkedIn handles.
• Professional data: positions sought, readiness date, salary expectation, English level, sea service (vessels, IMO numbers, flags, companies, dates, engine data) and an additional description.
• Documents and certificates: type, number, issuing authority and dates of your seaman's book, passports, visas, certificates of competency, endorsements and other maritime documents, and the files you upload.
• Physical measurements used for uniforms and safety gear: height, weight, clothing and shoe sizes, hair and eye colour.
• Next of kin: the name, relationship, contact and address of the person you name as your emergency contact. By entering them you confirm that you may share their data with us for this purpose.
• Imported CV files (PDF, DOCX, images) that you upload so that we extract the data above from them.

You decide how complete your CV is. Documents and the next of kin are optional; the more complete the profile, the more often companies open it.

2.3 Company accounts

For a company we process its name, country, addresses, website, licences, contact e-mails and phone numbers, the names, positions and contact details of its representatives, the vacancies it posts, its plan and credits, and its actions on the platform (profiles opened, applications received).

2.4 Applications, messages and reviews

Applications to vacancies (which CV was sent to which company and when), the messages you send to our support and to the AI assistant, and companies’ e-mail replies to your applications, the reviews, ratings and scam reports you leave about companies, and the reports companies make about candidates.

2.5 Payments

For paid services (company plans and credits, vacancy campaigns, advertising, featured placement of training centres and seafarer Premium): the amount, currency, date, status, the payment-method type, for cards the last four digits and the card country, for USDT payments the network and the transaction hash, and the transaction identifier of the payment provider — Stripe, Monobank, Heleket, Apple App Store or Google Play. Full card numbers are handled by the payment providers and never reach us (see Payments and refunds).

2.6 Technical data

• Server logs: IP address, user agent, requested pages and timestamps, kept for up to 30 days for security and troubleshooting.
• Product analytics: anonymous usage events described in section 11.
• Crash and performance data from the CREWINGS app, sent to New Relic: device model, operating-system version, app version, crashes and errors with their technical details, and the duration and outcome of the app's requests to our servers. The web version of the app sends New Relic its page-load times and errors. No account identifier or cookie is used for this.
• Server error and performance reports, sent to Sentry: errors of our servers and the timing of a sample of requests, together with the data of the request concerned — with passwords removed and without IP addresses or cookies.
• Cookies and similar technologies described in section 10.

2.7 Communications and other sources

Support requests by e-mail, Telegram or in the app; the e-mail you leave to join the Android beta programme; the identifier of the person whose referral link brought you to Crewings.

2.8 Advertising

We show ads from maritime businesses on the site and in the CREWINGS app. An ad is chosen only by the page and the language it is shown on: we do not use your profile, your activity, your location or device identifiers to choose it, we use no advertising identifiers (IDFA, Android advertising ID) and we do not track you across other apps or websites. Advertisers receive no personal data — only the total number of times their ad was shown and tapped. A display is counted without any identifier of you. For a tap on an ad that links through our servers we record a hash of the IP address that changes every day, the country, the browser family and the referring page, to bill the campaign and to detect fraudulent clicks. If you are signed in, our product analytics (section 11) also records that you tapped an ad. The legal basis is our legitimate interest in funding the Platform with advertising and in protecting advertisers from click fraud.

03Where the data comes from

• From you: when you register, fill in the CV, apply, post a vacancy, pay, write to support or leave a review.
• From companies: when a company posts a vacancy, opens your profile or reports on an application.
• From public sources: company profiles, vacancies and training-centre data collected from the companies' websites, public registers and maritime administrations. We do not collect seafarer CVs from public sources.
• Automatically: technical data and analytics when you use the site or the app.

04Why we process data and on what legal basis

1. Providing the service — creating and running your account, storing your CV, showing vacancies, sending your application to a company, showing candidate profiles to companies, notifying you about applications and vacancies. Basis: performance of the contract with you (the Terms of Service).
2. Showing your profile to companies — the masked card in the public directory and the full profile for companies that have access. Basis: performance of the contract; you control it by pausing your job search (section 6.1).
3. Extracting data from uploaded CV files, matching CVs to vacancies and drafting reminders (section 5). Basis: performance of the contract and our legitimate interest in an accurate, useful service.
4. Billing companies — plans, credits, receipts, invoices and accounting. Basis: performance of the contract and legal obligations under accounting and tax law.
5. Safety and fraud prevention — verifying companies, processing scam reports, blocking fake accounts and fake vacancies, protecting against abuse and securing accounts. Basis: our legitimate interest in a safe platform and the protection of seafarers' interests.
6. Communications — service e-mails (confirmation of registration, application status, reminders about an incomplete profile or expiring documents) and answers to support requests. Basis: performance of the contract and legitimate interest. News about the service: legitimate interest, with an unsubscribe link in every e-mail; you can also write to [email protected].
7. Improving the product — anonymous analytics, crash reports and testing. Basis: legitimate interest; the consent you give at registration also covers this processing.
8. Beta programme — adding your e-mail to the list of testers in Google Play. Basis: consent, given when you submit the form.
9. Referral programme — attributing your registration to the person who invited you. Basis: legitimate interest.
10. Compliance with the law — responding to lawful requests from authorities, keeping accounting records and defending legal claims. Basis: legal obligation and legitimate interest.

We do not sell personal data and do not use it for third-party advertising.

05Automated processing and AI

Which provider does what:

• OpenAI (GPT models): reading uploaded CV files and document scans, the CV check, matching vacancies to CVs, cover letters, the detection of suspicious companies and vacancies, and support answers.
• Google (Gemini models): the AI search of vacancies, the summary of a CV that a company receives with an application, the selection of vacancies for a CV mailing, filling a CV from uploaded documents, completing the vessel details of sea service, variants of cover letters, and a reserve for reading CVs and for the CV check when OpenAI does not answer.
• Anthropic (Claude models): variants of cover letters; and when our staff process a CV or a CV-mailing order, Claude may read the CV and write the cover letter in place of the automatic models.
• xAI (Grok models): variants of cover letters, and a reserve when another model does not answer.

Every AI feature asks for your consent first, in a box that names the provider and is not ticked in advance. In the CREWINGS app, auto-apply checks how well vacancies fit your CV with Google Gemini only. You can withdraw a consent at any time: stop using the feature (stop auto-apply in its screen), delete your account in the app, or write to [email protected].

06Who receives your data

6.1 Companies

• Public directory. The seafarer directory on crewings.me shows a masked card: initials, position, age, citizenship, English level, readiness date and salary expectation. Names, contacts, documents and the next of kin are never public.
• Full profile. A company sees your full CV, including contact details and document numbers, when you apply to its vacancy, or when it opens your profile using a paid plan or credits while your job search is active. Companies undertake in the Terms of Service to use the data only for recruitment and never to charge you anything.
• Pausing. You can pause your job search at any time — in the app where the setting is available, or by writing to [email protected]: your profile then disappears from search and cannot be opened. Companies you have already applied to keep the CV you sent them.

6.2 Service providers (processors)

We use providers that process data on our instructions:

• hosting providers for our servers and databases, and Cloudflare (content delivery, edge caching, bot protection with Turnstile, e-mail routing);
• e-mail delivery services (SMTP relays, Amazon SES) for service e-mails;
• Stripe and Monobank for card payments, and Heleket for USDT payments;
• OpenAI, Google, Anthropic and xAI for the AI processing described in section 5;
• New Relic for crash and performance monitoring of the app, its web version and our servers;
• Sentry for error reports of our servers;
• Apple and Google for the distribution of the app, the beta programme and purchases inside the app (App Store, Google Play);
• Telegram, when you use our bot or contact us there.

6.3 Others

• Maps: company and training-centre pages embed a map from OpenStreetMap; when it loads, your IP address is sent to the OpenStreetMap Foundation.
• Authorities: we disclose data when the law requires it or to answer a lawful request from a court, the police or a regulator.
• Business transfer: if Crewings is sold or merged, the data passes to the successor under this policy, and we will inform you.

07International transfers

We are based in Ukraine. Data is stored on the servers of our hosting providers and in Cloudflare's network, and some providers — Stripe, OpenAI, Google, Anthropic, xAI, Sentry and Apple — process data in the United States. New Relic keeps the monitoring data of the app in its EU region. Transfers outside Ukraine and the European Economic Area rely on the providers' contractual safeguards (standard contractual clauses), together with their security certifications. You can ask for details at [email protected].

08How long we keep data

• Account and CV: as long as your account exists. When you delete the account or ask us to, the account is anonymised within 30 days: the name, contacts, documents and photo are erased; anonymous statistics remain.
• Inactive accounts: if you have not signed in for 24 months, we e-mail you; if there is no answer within 30 days, we pause the job search, and after a further 12 months of inactivity we anonymise the account.
• Applications and messages: while the account exists; companies keep the CVs they received under their own rules.
• Company statuses, scam reports and reviews: while relevant; a report against a company is kept for 3 years after it was resolved.
• Payments and invoices: 3 years after the payment (Ukrainian accounting requirements).
• Support correspondence: 3 years.
• Server logs: up to 30 days. Backups: up to 30 days after deletion from the live system.
• Product analytics: anonymous events are kept indefinitely because they identify no one; identified events of signed-in users are pseudonymised and are deleted with the account.

09Your rights

How to exercise them: use the account settings in the app where the function is available (pausing the job search, editing the CV, deleting the account), or write to [email protected] from the e-mail address of your account. We may ask you to confirm your identity. We answer within one month; for complex requests the period may be extended by two months, and we will tell you.

10Cookies and similar technologies

We use no advertising cookies and no third-party analytics cookies, and therefore show no cookie banner.

• Essential (no consent needed): `sessionId` — keeps you signed in and is deleted when the session ends; `_csrf` — protects forms against forgery; Cloudflare security cookies `__cf_bm` (up to 30 minutes) and `cf_clearance` (for the period of the passed security challenge) — bot protection.
• Preferences (set only when you change a setting): `nuxt-color-mode` (light or dark theme), `user_locale` (language), `user_theme_id` (colour palette) and `user_radius_scale` (interface shape) — stored for 12 months on the crewings.me domain.
• Attribution: `x_bro_ref_id` — the identifier of the person whose link brought you to Crewings, stored for 12 months so that the invitation can be credited when you register.
• Local storage in the browser and in the app keeps the same preferences and cached data for offline use.

You can delete cookies in your browser settings; essential cookies are set again when you sign in.

11Product analytics

Our analytics are first-party and cookieless:

• events are sent to our own domain, not to a third party;
• the visitor is identified by a hash of the site, the IP address and the browser, computed with a secret that changes every day and is deleted after two days — the IP address and the browser string themselves are not stored, and yesterday's visitors cannot be recognised;
• for signed-in users we add four coarse attributes from the CV — rank, fleet type, nationality and role — so that we can see which vacancies and courses interest which professions; the account identifier is pseudonymised with a secret key;
• search queries are kept only when they look like a topic (a position, a vessel type) and never when they could contain personal data;
• the Do Not Track and Global Privacy Control signals of your browser switch identified analytics off.

The consent you give at registration covers this processing; you can object at any time by writing to [email protected].

12Security

• Connections are encrypted (TLS); passwords are stored as salted hashes.
• Access to production data is limited to staff who need it and is logged; companies see document numbers and contacts only when access has been granted (section 6.1).
• We keep encrypted backups, monitor for intrusions and have an incident procedure. If a breach is likely to put your rights at risk, we will notify you and the supervisory authority as the law requires.
• Please report security problems to [email protected].

13Children

Crewings is for people aged 18 and over. We do not knowingly collect data from anyone younger; if we learn that we have, we delete it.

14Changes to this policy

We update this policy when the service or the law changes. The version number and the date are at the top. For material changes we notify you by e-mail or by a notice in the app at least 14 days before they take effect; the previous version is available on request.

15Contact

• Support and data protection: [email protected]
• Operator: FOP Oleinyk M.V., Odesa, Ukraine