CrewVault Private Limited ("CrewVault", "we", "us", "our") operates a recruitment platform connecting Recruitment Agencies, Sub Agents, Employers, and Job Seekers for overseas blue-collar employment, primarily between India and the Gulf region. This policy explains what personal data we collect across these roles, why we collect it, who we share it with, and the choices and rights you have.

By using CrewVault, you agree to the collection and use of information as described here. If you do not agree, please do not use the platform.

1. Information We Collect

What we collect depends on your role on the platform.

Account & contact information (all roles): name, email address, phone number, and login credentials (we use email one-time passcodes rather than storing passwords for most accounts).

Recruitment Agency verification data: recruitment license number, GST certificate, embassy card number, owner and staff government ID, office video, and company brochure, submitted during onboarding for verification purposes.

Employer information: company name, industry, country/location, company license, contact person's name, email, phone number, and website.

Job Seeker (candidate) information: this is the most sensitive category we process, and includes full name, date of birth, gender, phone number(s), email, residential address, passport number and expiry, education, work experience, skills, preferred role and country, CV, photograph, video introduction, skill-test videos, and documents you or your agency upload to your profile — which can include medical/fitness reports required for overseas visas. Where a candidate self-registers directly, we also record their confirmation of being 18 or older and their agreement to these Terms and this Policy at the time of sign-up. Where a candidate's profile is created by a recruitment agency or sub agent, this data is entered by that agency or sub agent on the candidate's behalf.

Payment information: subscription payments (from agencies) and placement-related payments are processed through a third-party payment processor. CrewVault does not store full card numbers or complete bank credentials on its own servers beyond what is needed to operate the payment-hold feature.

Technical & usage data: IP address, browser and device information, and log data, plus a session cookie used to keep you signed in (strictly necessary — no consent banner is shown for this one, as PECR/the UK & EU ePrivacy rules exempt cookies needed to provide a service you've asked for). We also use PostHog, an analytics and session-replay tool hosted in the EU, to understand how this website and the web app are used (not the mobile app, as of this policy's last update) — for example, which pages visitors view and which sign-up or download links they click — but only after you actively accept analytics cookies in the cookie banner shown on first visit. Your choice applies to both this website and the web app, which share the getcrewvault.com domain, so you are only asked once. If you reject or ignore it, no analytics cookie is set and no usage data is sent to PostHog; the only thing stored is a small cookie remembering your choice, so we don't ask again. You can change your choice at any time via the "Cookie settings" link in the footer of this website or the app. Session recordings are used only in the web app, and mask every text field and input value, so no passport, CV, or other personal data is ever captured in a recording. We do not use third-party advertising cookies.

Marketing data: we run advertising campaigns on Facebook and Instagram to reach recruitment agencies. These campaigns link back to our own website and app; we do not use Facebook Login, Facebook Lead Ads, or any Meta tool that shares your Facebook/Instagram profile data with us, so CrewVault does not receive personal data from Meta about you. See our Data Deletion Instructions page for more detail.

2. How We Use Information

• Operating the platform — creating and managing accounts, candidate profiles, job requirements, and the recruitment pipeline end to end.
• Verifying recruitment agencies and employers before they can transact on the platform.
• Matching candidates to roles and coordinating interviews, offers, and the pre-departure process.
• Sending OTP codes, interview notifications, and process updates by email.
• Preventing duplicate candidate profiles (each job seeker is deduplicated using identity fields such as passport number, email, or phone, so a person has one profile — not one per agency that uploads them).
• Operating the payment-hold (escrow-style) feature used during placement.
• Meeting legal, regulatory, and record-keeping obligations tied to overseas recruitment.
• Improving and securing the platform.

We do not sell personal data to third parties.

3. How We Share Information

CrewVault enforces a tiered visibility model rather than exposing all data to all parties by default:

• A candidate's data is entered by, and visible to, the Sub Agent or Recruitment Agency that onboarded them.
• Recruitment Agencies do not see another agency's candidates unless that agency has explicitly enabled cross-agency sharing.
• Employers see candidate profiles submitted to them, but contact details (phone, email, exact address) stay hidden from the Employer until an offer letter is signed and the associated payment is held — this protects candidates from being contacted directly outside the platform's process.
• Once a placement proceeds, relevant contact and travel-document details are shared between the agency, employer, and candidate as needed to complete visa, medical, and travel steps.

We also share information with the following service providers ("processors"), each bound by a data processing agreement limiting them to processing data only to provide their service to us:

• Amazon Web Services (AWS) — cloud infrastructure, database, and encrypted file storage. Currently hosted in AWS's Mumbai (ap-south-1) region.
• PostHog — website and product analytics, and session replay in the web app, hosted in PostHog's EU region, and only for visitors who have accepted analytics cookies (see Section 1 above).
• OpenAI — used to automatically extract structured fields (e.g. name, passport number) from a candidate's uploaded CV or passport scan, to pre-fill their profile for review before it's saved. Data sent to OpenAI is not used by OpenAI to train its models.
• Resend — transactional email delivery (e.g. sign-in codes, interview and application notifications).
• MSG91 — transactional SMS delivery (e.g. one-time passcodes) for users in India.
• Payment processors, to process subscription and placement payments.
• Government and regulatory bodies (e.g. for visa, embassy, or labour-compliance processes), where required to complete an overseas placement or where legally required.

4. Data Storage & Security

Data is stored on AWS infrastructure (managed PostgreSQL, encrypted file storage, and a managed secrets store for credentials). Access to candidate and agency data is restricted by role — for example, Sub Agents can upload candidates but cannot browse the full candidate pool. We use encryption in transit for data sent to and from the platform.

5. Data Retention

We retain personal data for as long as needed to provide the service and to meet legal/record-keeping obligations (for example, licensing and financial records that agencies are required to retain under Indian law). When an account or record is no longer needed and no legal retention requirement applies, we anonymize the personal data associated with it (removing name, contact, and identity details) rather than deleting the underlying business record outright, so that aggregate records, invoices, and audit trails remain accurate.

6. Your Rights

Subject to applicable law — including India's Digital Personal Data Protection Act, 2023, and, for users in the UK and EU, the UK GDPR and EU GDPR — you have the right to access the personal data we hold about you, request correction of inaccurate data, and request erasure or anonymization of your data where we are not required to retain it. If you are a Job Seeker whose profile was created by an agency or sub agent on your behalf, you can exercise these rights by contacting us directly or through that agency.

If you are located in the UK or the European Economic Area, you additionally have the right to restrict or object to certain processing, and to receive a copy of your data in a portable format. We process your data on the legal bases of: performance of a contract with you (operating your account and the recruitment process), our legitimate interests (e.g. platform security and preventing duplicate profiles), your consent (e.g. optional marketing communications, and analytics cookies — see Section 1), and compliance with our legal obligations. Where we process data revealing health information (e.g. a medical fitness report required for your visa), we do so only with your explicit consent or as necessary to establish or exercise your legal rights in connection with the overseas employment process. You also have the right to lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national supervisory authority.

To exercise any of these rights, email contact@getcrewvault.com. We will acknowledge your request and respond within 30 days.

7. Children's Data

CrewVault is not directed at, and does not knowingly collect data from, individuals under 18 years of age, consistent with the minimum legal age for overseas employment.

8. International Data Transfers

Because CrewVault connects Indian job seekers with employers overseas (primarily in the Gulf region), candidate data is necessarily shared with employers and their agents in those countries as part of the recruitment and deployment process described above. Our core infrastructure (database and file storage) is also hosted in India (see Section 3).

Neither India nor the Gulf countries we operate in currently hold a UK or EU "adequacy" decision. Where we transfer personal data of a user in the UK or EEA to a recipient in one of these countries — whether an internal system or an employer/agency party to your placement — we put a recognised safeguard in place, such as the UK's International Data Transfer Addendum or the EU Standard Contractual Clauses, together with an assessment of the protections available in the recipient's location. You can request a copy of the relevant safeguard by contacting us as set out in Section 10.

9. Changes to This Policy

We may update this policy as the platform evolves. We will update the "Last updated" date above when we do; material changes will be communicated to registered users.

10. Contact Us

Questions, requests, or complaints about this policy or how your data is handled can be sent to:

CrewVault Private Limited
Email: contact@getcrewvault.com
Phone: +91 90194 80228
Address: Flat 343, Mahaveer Galaxy Apartment, Kengeri, Bangalore South, Karnataka, India, 560060.

UK and EU representatives: as CrewVault has no establishment in the UK or the European Economic Area, we are in the process of appointing a representative in each under Article 27 of the UK GDPR and EU GDPR respectively, who UK/EU users and regulators can also contact on data protection matters. Their contact details will be published here once appointed; until then, please use the contact details above.