Privacy Policy — Crewter

1. Who we are

Crewter is a yacht crew networking platform operated by 2KO (“we”, “us”). We are the data controller for personal information you provide when using the site.

Contact: contact@2ko.co.za

2. What we collect

Account data: email address, name (optional), profile photo
Profile data: position, location, nationality, languages, bio, availability, contact details you choose to share
Work history: yacht experiences, certifications, visa records you add
Activity: messages, job applications, reviews, endorsements, follows, community posts
Technical: IP address, browser type, session cookies (strictly necessary for authentication)

3. Why we process it

To operate the platform (contract performance — GDPR Art. 6(1)(b))
To send transactional emails (sign-in links, application updates, notifications you opt into)
To moderate content and prevent abuse (legitimate interest — GDPR Art. 6(1)(f))
To comply with legal obligations when required

We do not sell your personal information to third parties.

4. Who we share it with

Other users: your public profile (name, position, experience, certifications) is visible to registered users unless you set it to private in Settings
Employers you apply to: when you apply to a job, we share your name, profile, and CV with the agency or employer
Service providers: Neon (database hosting, EU/US), Vercel (application hosting, US/EU), Brevo (transactional email, EU), OpenAI (AI moderation + chat assistant, US) — all under data processing agreements
Legal authorities: only when compelled by valid legal process

5. Anonymous yacht reviews

When you leave a yacht review marked Anonymous, we do not store your user ID or any identifying information on that review. We store a one-way cryptographic hash derived from your user ID and the yacht ID, which lets you edit your review later while signed in but cannot be reversed to identify you — even by us.

6. How long we keep it

Account data: while your account exists, and up to 30 days after deletion
Email logs: 90 days for deliverability diagnostics
Backups: rolling 30-day point-in-time recovery (Neon)

7. Your rights

Under GDPR, UK GDPR, and South Africa's POPIA you can:

Access your data — visit your profile
Correct it — edit on your profile page
Delete your account and personal data — Settings → Delete account
Export your data — email contact@2ko.co.za and we'll provide a machine-readable copy within 30 days
Unsubscribe from emails via the link in any email footer or in Settings
Complain to a supervisory authority (e.g. ICO in the UK, your national DPA in the EU, or the Information Regulator in South Africa)

8. Cookies

We use strictly necessary cookies only — a session cookie for authentication and a small preference cookie for your sidebar collapse state. We do not use advertising or tracking cookies.

9. International transfers

Our database and application servers are located in the EU and US. Transfers from the EU/UK to the US rely on Standard Contractual Clauses. Transfers from South Africa follow POPIA's Section 72 requirements.

10. Changes to this policy

We'll post updates here and email registered users for material changes. Continued use of the platform after a change constitutes acceptance.

11. Contact

Privacy questions or requests: contact@2ko.co.za