Privacy Policy

1.1 Personal Information You Provide

When you create an account, use our services, or communicate with us, we may collect the following categories of personal information:

• Identity Information: Full legal name, date of birth, profile photograph, and gender.
• Contact Information: Email address, phone number, and mailing address.
• Professional Information: Airline employer, crew type (pilot, first officer, flight attendant), employee identification number, base airport (domicile), and seniority status.
• Financial Information: Payment method details (processed and stored securely by Stripe, Inc. — CrewNest does not store full credit or debit card numbers), bank account information for host payouts via Stripe Connect, and tax identification numbers where required.
• Listing Information (Hosts): Property address, descriptions, photographs, pricing, availability, house rules, and amenity details.
• Booking Information: Check-in and check-out dates, guest count, special requests, and booking preferences.

1.2 Verification Documents

To verify your airline crew status, we collect photographs or scans of your airline-issued identification badge and/or employment verification documentation. These documents are encrypted using AES-256 encryption at rest and transmitted via TLS 1.3 in transit. Verification documents are stored in our secure Supabase Storage infrastructure with strict access controls. Only authorized CrewNest personnel involved in the verification process may access these documents.

1.3 Information Collected Automatically

When you access or use the Platform, we automatically collect certain information, including:

• Usage Data: Pages visited, features used, search queries, listing views, booking patterns, time spent on pages, click patterns, and referral sources.
• Device Information: Device type, operating system, browser type and version, screen resolution, language settings, and unique device identifiers.
• Network Information: IP address, internet service provider, connection type, and approximate geolocation derived from your IP address.
• Location Data: With your permission, we may collect precise geolocation data from your device to provide location-based search results and show listings near your current location. You may revoke location permissions at any time through your device settings.

1.4 Communications

We collect and store messages exchanged between Users through the Platform's in-app messaging system, communications with our customer support team (including AI-assisted support chat), and email correspondence. In-app messages are transmitted in real time via Supabase Realtime and are stored in our database. Personal contact information (phone numbers, email addresses) is masked in messages until a booking is confirmed.

1.5 Information from Third Parties

We may receive information about you from third-party service providers, including:

• Stripe: Payment verification, transaction status, and account information for payment processing and host payouts.
• Checkr: Background check results for host verification (report status only — we do not store full background check reports).
• Google OAuth: If you sign in using Google, we receive your name, email address, and profile picture from your Google account.

3.1 With Other Users

When you make a booking, we share necessary information with the host, including your name, profile photo, crew type, airline, and check-in/check-out dates. Similarly, guests receive the host's name, profile photo, property address, and check-in instructions. Personal contact information (phone numbers, email addresses) remains masked until a booking is confirmed. Full property addresses are disclosed only after booking confirmation.

3.2 With Service Providers

We share information with trusted third-party service providers who perform services on our behalf, subject to contractual obligations of confidentiality and data protection:

• Stripe, Inc. — Payment processing, host payout administration, and fraud detection.
• Supabase, Inc. — Database hosting, authentication, file storage, and real-time messaging infrastructure.
• Anthropic, PBC — AI-powered listing matching, pricing suggestions, and content moderation via the Claude API. Only anonymized or pseudonymized data is shared; no crew verification documents are transmitted.
• Resend, Inc. — Transactional email delivery (booking confirmations, payout notifications, account alerts).
• Checkr, Inc. — Host background verification services. Checkr processes background checks directly; CrewNest receives only pass/fail status results.
• Mapbox, Inc. — Map rendering and geocoding services for listing search and display.
• Vercel, Inc. — Web application hosting and content delivery.

3.3 With Law Enforcement and Legal Authorities

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, subpoena, court order, or other legal process; (b) protect and defend the rights, property, or safety of CrewNest, our Users, or the public; (c) detect, prevent, or address fraud, security, or technical issues; or (d) respond to an emergency involving danger of death or serious physical injury.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on the Platform of any change in ownership or uses of your personal information, as well as any choices you may have regarding your information.

5.1 Rights Available to All Users

Regardless of your location, you have the following rights regarding your personal information:

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Correction: You may request that we correct any inaccurate or incomplete personal information.
• Right to Deletion: You may request that we delete your personal information, subject to certain legal exceptions (such as data required for tax reporting or active dispute resolution).
• Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format (JSON or CSV).
• Right to Opt-Out of Marketing: You may opt out of receiving promotional communications at any time by clicking the "unsubscribe" link in any marketing email or by updating your notification preferences in your account settings.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

5.2 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
• Right to Opt-Out of Sale or Sharing: CrewNest does not sell personal information. We do not share personal information for cross-context behavioral advertising purposes.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use and disclosure of your sensitive personal information to that which is necessary to provide the services.

California residents may submit CCPA requests by emailing privacy@crewnest360.com with the subject line "CCPA Request." We will verify your identity before processing any request and will respond within forty-five (45) days.

5.3 Additional Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the GDPR, including:

• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to Object: You may object to the processing of your personal data based on our legitimate interests.
• Right to Withdraw Consent: Where we rely on your consent for processing, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

5.4 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at privacy@crewnest360.com. We will respond to verified requests within thirty (30) days (or forty-five (45) days for CCPA requests). We may require you to verify your identity before fulfilling your request to protect your privacy and security.