Privacy Policy

Last updated: October 2026

Operated by: Crewnbase Inc (trading as Crewbase) · Contact: hello@trycrewbase.com

1. Introduction

Crewbase is operated by Crewnbase Inc ("we", "our", "us"). We are committed to protecting your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all users of the Crewbase platform, including our mobile app and web portal, which connects promoters, vendors, and staff across Australia.

By creating an account or using Crewbase, you agree to the collection and use of your information as described in this policy.

2. Who We Are

Crewnbase Inc
Address: 1007 N Orange St. 4th Floor Suite #6023, Wilmington, Delaware 19801, United States
Trading as: Crewbase
Contact: hello@trycrewbase.com
Website: trycrewbase.com

3. What Information We Collect

3.1 Account Information

Full name, email address, phone number
Username and password (passwords are securely hashed and never stored in plain text)
Role on the platform (Promoter, Vendor, Staff, Gate Staff, Admin)

3.2 Profile Information

Profile photo
Date of birth and gender (collected from staff to support Fair Work compliance, including correct award and junior-rate determination)
Certifications and qualifications (e.g. RSA Licence, Working With Children Check, First Aid)
Tax File Number (TFN) — collected from staff for the purpose of PAYG tax withholding and Single Touch Payroll (STP) reporting. TFN information is handled in accordance with the Privacy (Tax File Number) Rule 2015 and is only disclosed to the engaging vendor or promoter for lawful tax purposes. TFN information is stored securely and access is restricted to the employing vendor only — it is never visible to other vendors, promoters, or third parties.
ABN — collected from vendors and contractor staff for invoicing and tax purposes.
Bank account details for settlement purposes (stored securely via third-party processors)

3.2a Staff Compliance and Onboarding Data

Where staff complete an onboarding compliance form through the platform, we collect the following information:

Tax declaration information (NAT 3092): TFN, residency for tax purposes, tax-free threshold claim, study and training support loan (HECS/HELP) status, and basis of employment.
Superannuation choice information (NAT 13080): super fund type (retail/industry or self-managed), fund name, Unique Superannuation Identifier (USI), member number, and for self-managed funds (SMSFs): fund ABN, Electronic Service Address (ESA), and fund bank account details.
Bank account details: BSB, account number, and account name, collected for the purpose of wage payments.
Right to work information: citizenship or residency status. For visa holders: passport number, passport country of issue, date of birth, visa grant number or Immi/TRN reference number, and visa expiry date. This information is collected to enable engaging employers to verify work entitlements via the Australian Government's VEVO system.
Emergency contact details: name, phone number, and relationship.

This information is collected on behalf of the engaging vendor or promoter and is only accessible to the vendor or promoter who requested the compliance form. TFN and bank account details are masked by default and are only revealed to the engaging employer through a deliberate, access-controlled action that is recorded in an audit log.

3.2b Payroll Reveal Audit Log

When a vendor or promoter accesses the full (unmasked) TFN or bank account details of a staff member through the payroll reveal feature, this access is recorded in an audit log that captures: the identity of the vendor or promoter who accessed the data, the staff member whose data was accessed, and the date and time of access. Staff members can view the audit log for their own data. This log is maintained for accountability and compliance purposes.

3.3 Identity Verification Data

Staff identity verification is performed by Didit (didit.me), a third-party KYC provider. Regarding face data:

Collection: A selfie/photo is captured solely for identity verification purposes
Processing: Face data is processed exclusively by Didit — Crewbase never receives, stores or has access to your biometric data or identity documents
Disclosure: Face data is shared only with Didit and with no other third parties
Retention: Face data retention and deletion is governed by Didit's Privacy Policy at https://didit.me/terms/privacy-policy/
Deletion: To request deletion of your face data, contact Didit directly at privacy@didit.me or via their privacy policy page
Revocation: You may withdraw consent for identity verification by contacting us at hello@trycrewbase.com. Note that withdrawing consent may affect your ability to use the platform
Third-party protection: Didit is contractually required to provide the same level of protection for your face data as described in this privacy policy

For more information see Didit's Privacy Policy at https://didit.me/terms/privacy-policy/

3.4 Payment and Transaction Data

Payment amounts, currency, and timestamps
Payment method (card or cash)
Card brand and last 4 digits of card number (provided by Square)
Cash payment records and refund history
Promoter and vendor revenue splits
Settlement reports
Member hire booking fees processed via Stripe

Payment processing is handled by Square and Stripe in accordance with their respective privacy policies. See Square's Privacy Policy at https://squareup.com/au/en/legal/general/privacy and Stripe's Privacy Policy at https://stripe.com/au/privacy.

3.5 Shift and Employment Data

Shift attendance and check-in records
Shift schedules, clock-in/clock-out times (which may include the approximate location where you clocked in or out)
Timesheet records and labour cost data
Pay rates and award-related information
Job postings applied to or created
Ratings and reliability information relating to your activity on the platform

3.6 Device and Technical Information

Push notification tokens
Device type and operating system
IP address and session data
App usage and error logs

3.7 Uploaded Content

Documents (e.g. insurance certificates, business registrations)
Images and media shared via the platform
Electronic signatures

3.8 Communications

Messages sent via the in-app chat
Broadcast messages from promoters to vendors and staff
Email communications with our team

3.9 Accounting and Payroll Connections (Xero)

A vendor can connect Crewbase to its own Xero account. If the vendor turns on the payroll option, Crewbase reads from Xero the names and employee IDs of that vendor's employees, their pay calendars and earnings rates, and existing timesheets for the pay period. We use this only so the vendor can match its Crewbase staff to its Xero employees and send hours. When the vendor chooses to send, Crewbase creates draft timesheets in Xero containing the approved hours. Crewbase never approves or processes a timesheet in Xero. We store the Xero employee ID and name against each match and a record of what was sent. We do not store employees' email addresses from Xero. Connection tokens are stored encrypted. A vendor can disconnect at any time in Crewbase or by revoking access inside Xero.

3.10 Experience Letters and Income Statements

Staff can create an experience letter or an income statement from their verified shift records and share it by link. Anyone who has the link can see that document, which shows the name you provided and the work details in it (an income statement also shows pay). You can revoke a document at any time and the link then stops working. Income statements expire 30 days after they are created.

4. How We Collect Information

We collect information:

Directly from you when you register, complete your profile, or use the platform
Automatically through your use of the app and website
From third-party services when you connect or use them (e.g. Square OAuth, identity verification via Didit, phone verification, ABN verification)
From other users (e.g. a promoter adding you to an operation)
From accounting software a vendor connects to Crewbase (for example Xero)

5. How We Use Your Information

We use your information to:

Create and manage your account
Verify your identity and eligibility to work on the platform
Verify your phone number and ABN
Operate the platform and provide our services
Process payments and record transactions
Generate settlement reports and invoices
Schedule shifts and manage workforce staffing
Calculate pay rates and support Fair Work award compliance
Display community leaderboards (see section 6.2)
Send push notifications for operations, broadcasts, shift updates, and job postings
Verify compliance documents and certifications
Communicate with you about your account, operations, and platform updates
Send you marketing communications where you have opted in (you can opt out at any time)
Detect and prevent fraud or misuse
Enforce our Terms of Service and protect the rights, property, and safety of Crewnbase Inc, our users, and the public
Comply with legal and regulatory obligations
Improve and develop the platform
Send approved hours to a vendor's Xero payroll as draft timesheets, when the vendor chooses to
Create experience letters and income statements that you ask for

6. Disclosure of Your Information

We do not sell your personal information. We may share your information with:

6.1 Other Platform Users

Promoters can see vendor and staff profile information relevant to their operations
Vendors can see staff profiles assigned to their team
Staff can see operation details and vendor information for operations they are assigned to

6.2 Community Leaderboards

Crewbase includes leaderboards that rank staff and employers based on activity and performance on the platform. Where you qualify to appear, limited information about you may be visible to other users, including your first name (for staff) or business name (for employers), your ranking, and your score. Leaderboard scores are calculated from platform activity such as completed shifts, ratings, and reliability.

6.3 Third-Party Service Providers

We use the following third-party services to operate the platform. Each processes your data in accordance with their own privacy policies:

Service	Purpose	Country
Square	Card and cash payment processing, Terminal API	United States
Stripe	Subscription billing and hire booking payments	United States
Supabase	Database, authentication, and file storage	United States
Didit	Identity (KYC) verification	European Union
Twilio	Phone number verification (SMS one-time codes)	United States
Expo	Mobile app infrastructure and push notifications	United States
Resend	Transactional email delivery	United States
Loops	Marketing and waitlist email (where you have opted in)	United States
Mapbox	Site location mapping	United States
VEVO (Australian Government)	Visa Entitlement Verification Online — employers use staff-provided identity details to verify work entitlements	Australia
Xero	Accounting and payroll connection chosen by the vendor	New Zealand, and other regions where Xero hosts data
Vercel	Website and web portal hosting, performance analytics	United States
Sentry	App and website error reports	United States
Anthropic	AI features (see section 15)	United States

We also use Australian Government services to verify information you provide, including the Australian Business Register (ABR) to verify ABNs and the Fair Work Commission's award rate data to support pay compliance.

6.4 Cross-Border Disclosure

Some of our third-party service providers are based outside Australia, including in the United States. By using Crewbase, you consent to your personal information being transferred to and processed overseas. We take reasonable steps to ensure these providers protect your information to a standard comparable to the Australian Privacy Principles.

6.5 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or where we believe disclosure is necessary to protect our rights or the safety of our users.

We may also disclose your information to our legal advisers, insurers, and professional consultants where necessary to protect our legal rights or comply with our obligations.

6.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will notify you of any such change.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services.

Transaction and payment records are retained for a minimum of 7 years for financial and taxation compliance under Australian law
Operation records and shift data are retained for 3 years
Uploaded documents are retained until you delete them or close your account
Push notification tokens are deleted when you log out or uninstall the app
Records of timesheets sent to Xero are kept with shift and timesheet records. Xero access is removed when the vendor disconnects.
Experience letters and income statements are kept until you revoke them or your account is deleted. Income statements expire after 30 days.

Staff compliance form data (TFN declarations, super choice, bank details, right-to-work information) is retained for a minimum of 5 years in accordance with Australian superannuation and taxation record-keeping obligations, and for 7 years where the data also forms part of employment records under the Fair Work Act 2009.

When your account is deleted, we will delete or anonymise your personal information within 30 days, except where retention is required by law.

8. Security

We take the security of your information seriously. Our measures include:

Encrypted connections (TLS/HTTPS) for all data in transit
Infrastructure-level encryption at rest via Supabase
Role-based access controls — users can only access data relevant to their role
Payment data is handled exclusively by Square and Stripe and is never stored on Crewbase servers
Identity documents and biometric data are handled exclusively by our verification provider and are never stored on Crewbase servers
Regular security reviews of our codebase and infrastructure

Despite these measures, no system is completely secure. We encourage you to use a strong password and notify us immediately at hello@trycrewbase.com if you suspect unauthorised access to your account.

8.1 Security Warranty Disclaimer

While we implement industry-standard security measures, Crewnbase Inc makes no warranty, express or implied, that the Platform or your data will be free from unauthorised access, disclosure, alteration, or destruction. No method of transmission over the internet or electronic storage is 100% secure.

In the event of a data breach affecting your personal information, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

You acknowledge that you provide your personal information at your own risk and that Crewnbase Inc's liability for any security breach is limited to the extent permitted by law and as set out in the Terms of Service.

9. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

Access your personal information held by us
Correct inaccurate or outdated information
Request deletion of your account and personal information
Opt out of push notifications via your device settings
Opt out of marketing communications at any time
Withdraw consent to certain uses of your information
Make a complaint about how we handle your information

To exercise any of these rights, contact us at hello@trycrewbase.com. We will respond within 30 days.

10. Children

Crewbase is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at hello@trycrewbase.com and we will delete the account promptly.

11. Cookies and Tracking

Our website (trycrewbase.com) may use cookies and similar tracking technologies to:

Maintain your session when logged in
Analyse website traffic and usage patterns
Improve the performance and experience of the site

You can disable cookies through your browser settings, though this may affect some functionality of the web portal. We use Vercel Analytics and Speed Insights to measure site performance and Sentry for error reports. We do not use these on experience letter and income statement pages.

12. Links to Third-Party Sites

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify users via the app or email and update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.

14. Complaints

If you have a complaint about how we handle your personal information, please contact us first at hello@trycrewbase.com. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001

15. AI-Powered Features

Crewbase uses AI features powered by Anthropic's Claude API. When you use AI features in the app or web portal, relevant data is sent to Anthropic's API to generate responses. This may include:

Inventory item names and quantities
Job post details and descriptions
Shift history and platform ratings
Job applicant information including their application message and platform activity
Event details including attendance and staffing information

This data is processed solely to generate AI suggestions and is not used to train Anthropic's AI models. Data is subject to Anthropic's privacy policy available at anthropic.com/privacy.

AI-generated content is advisory only and should not be used as the sole basis for hiring, purchasing, or business decisions. Crewbase is not responsible for decisions made based on AI suggestions.

16. Content Moderation

Crewbase provides tools to report inappropriate content and block other users. When you submit a report, the following information is stored: the reported content, your user ID, the reason for the report, and the date of the report. Reports are reviewed by the Crewbase team and appropriate action will be taken. Blocked user relationships are stored to filter content from blocked users across the platform.

17. Disclaimers and Limitation of Liability

Crewnbase Inc is not liable for any loss, damage, or inconvenience arising from:

Platform downtime, outages, or service interruptions, whether planned or unplanned
Unauthorised access to your personal data despite our security measures
Errors, inaccuracies, or omissions in data collected or stored through the Platform
Failure of third-party services including Supabase, Square, Stripe, Didit, or any other provider to protect your data
Any loss arising from your reliance on the Platform for compliance, payroll, or employment record-keeping purposes

Your use of the Platform and submission of personal information is at your own risk. Our total liability for any privacy-related claim is limited to the extent permitted by the Australian Privacy Act 1988 (Cth) and as set out in our Terms of Service.

18. Contact Us

For any privacy-related questions or requests:

Crewnbase Inc (trading as Crewbase)
Address: 1007 N Orange St. 4th Floor Suite #6023, Wilmington, Delaware 19801, United States
Email: hello@trycrewbase.com
Website: trycrewbase.com

Warranty Disclaimer

To the maximum extent permitted by the Australian Privacy Act 1988 (Cth) and applicable law, Crewnbase Inc makes no warranty that the Platform will be free from data loss, unauthorised access, or security breaches. While we implement reasonable security measures, you acknowledge that no system is completely secure and that you use the Platform and submit personal information at your own risk. Our liability for any privacy-related claim is limited as set out in our Terms of Service.

Accuracy of Information

You are responsible for ensuring that the personal information you provide to Crewbase is accurate, complete, and up to date. Crewnbase Inc is not responsible for any consequences arising from inaccurate or incomplete information provided by you or by other users of the Platform.