Privacy Policy

When you sign up

• Email, name, phone (optional), password (stored as a bcrypt hash, never as plaintext).
• Crew: skills, default rates.
• Venues / Clients (venues, event planners, production companies, staffing agencies, corporate event teams, wedding planners, talent buyers, AV departments): company name, business type, business address, and GPS coordinates of that address. For each posted gig, the event address (which may differ from the business address) and its GPS coordinates.

When you use the Platform

• Job postings, applications, bookings, ratings, reviews, dispute filings.
• GPS location pings from Crew Members while a booking is ACTIVE, collected only between check-in and check-out, used to verify geofence presence and to detect prolonged absences. Frequency: every ~5 minutes during a shift.
• Check-in / check-out timestamps and GPS coordinates at each event.
• Break start/end times.

Payment data

• Payments are processed by Stripe, Inc. under its own Privacy Policy and PCI-DSS Level 1 certification.
• Card numbers are never transmitted to or stored on our servers. We store only Stripe tokens (stripeCustomerId, stripePaymentMethodId) and a Stripe-provided last-four/brand for display.
• Crew bank accounts are entered directly into Stripe's Express Connect onboarding and never touch our systems.

Technical & usage data

• IP address, user agent, device type, OS, browser. Used for security, fraud prevention, and analytics.
• Service logs, error reports, performance metrics.

• To operate the marketplace: matching, posting, GPS verification, billing, and payouts.
• To calculate commission tier and badges (e.g., ELITE).
• To detect and prevent fraud, abuse, and circumvention of platform rules.
• To send transactional notifications (gig confirmations, check-in reminders, payout receipts).
• To improve and secure the Platform.

We do not sell personal data. We do not run advertising trackers on the Platform. We do not share Crew or Venue contact information with third parties for marketing.

We share data only with:

• Stripe: for payment processing and Connect payouts.
• The other party of a booking: Crew see the booker's business name, event address, and GPS coordinates of the event location; the booker (Venue, planner, production company, staffing agency, corporate team, wedding planner, talent buyer, or AV department) sees Crew name, avatar, skills, average rating, tier, and contact phone after confirmation.
• Service providers (cloud hosting, email delivery, SMS, push notifications, error monitoring) under confidentiality agreements limited to what they need to perform their function.
• Law enforcement or regulators: when required by valid legal process or to protect rights, safety, or integrity of the Platform.

GPS coordinates from Crew devices are collected only while a booking is ACTIVE (between check-in and check-out). We do not track Crew location at other times. The geofence radius is 500 feet by default.

GPS pings are stored for up to 90 days after the booking completes, then deleted, except where retention is required for an open dispute or to comply with law.

• Account profile: kept while your account is active and for 7 years after closure for tax and audit purposes.
• Booking records, ratings, payment receipts: 7 years.
• GPS pings: up to 90 days after the booking concludes (longer if needed for a pending dispute).
• Service logs: 90 days.

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate information through your account settings or by emailing us.
• Deletion: request deletion of your account. We will delete personal data within 30 days, except records we are required to retain by law (e.g., financial records for 7 years).
• Export: request a machine-readable export of your data.

Email support@bookacrew.app to exercise any of these rights.

• All traffic to the Platform uses HTTPS (TLS 1.3).
• Passwords are stored using bcrypt with 12 rounds of salting.
• Payment data is processed exclusively by Stripe (PCI DSS Level 1) and never traverses our servers.
• JWTs used for authentication can be revoked by the Platform; user-initiated logout adds the token JTI to a revocation list immediately.

The Platform is not directed at, and may not be used by, anyone under 18 years old.

Material changes will be notified by email and through the Platform at least 30 days before they take effect. The “Effective Date” and “Version” at the top of this page indicate the most recent revision.

BookACrew LLC
New York, NY
Email: support@bookacrew.app
Phone: +1 (516) 966-1995