CrewUp Privacy Policy

This Privacy Policy explains how Robb Building Materials, LLC, doing business as CrewUp ("CrewUp," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you access or use crewupapp.co; CrewUp web, mobile, and desktop applications; CrewUp communications; and any related marketplace, community, subscription, verification, support, event, API, or integration services that link to this Privacy Policy (collectively, the "Services").

This Policy applies to general contractors, subcontractors, suppliers, vendors, consultants, business owners, employees and authorized team members, project owners, prospective customers, website visitors, event participants, community members, and other people who interact with the Services. "Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. The term includes "personal data" and similar terms under applicable law.

This Policy does not apply to information that applicable law excludes from the definition of personal information, such as lawfully deidentified or aggregated information, or to third-party services that publish their own privacy notices. Separate notices may apply to employees, job applicants, background checks, enterprise deployments, promotional programs, or specialized features.

The Services are designed primarily for business and professional use. Business contact information and information relating to a person acting in a commercial or employment context may receive different treatment under some laws, but CrewUp will handle it as described in this Policy unless a separate notice applies.

Robb Building Materials, LLC d/b/a CrewUp is the operator of the Services. For most information collected directly through CrewUp accounts, website interactions, marketing, security, marketplace operations, and customer support, CrewUp determines why and how the information is processed and acts as a "business," "controller," or equivalent entity under applicable privacy law.

If an organization provides CrewUp to its personnel or uses enterprise features, that organization may control account access, role assignments, integrations, projects, documents, communications, and other workspace data. In that situation, CrewUp may process certain information on the organization's behalf as a service provider or processor. Questions about an organization's independent privacy practices should be directed to that organization.

General contractors, subcontractors, and other marketplace participants are independent businesses. When a participant receives another person's information through CrewUp and uses it for its own contracting, recruiting, estimating, compliance, or project-management purposes, that participant may become an independent controller or business responsible for its own privacy obligations. CrewUp does not control every downstream use by marketplace participants.

3.1 Information you provide directly

• Account and contact information. Name, username, email address, telephone number, mailing or business address, password or authentication credentials, profile photo, preferred language, time zone, and communication preferences.
• Business and professional profile information. Company name, trade name, entity type, role, title, years in business, service areas, office locations, website, social links, business description, trades, specialties, union status, certifications, licenses, permit information, insurance and bonding details, safety records, equipment, workforce size, availability, portfolio, past performance, references, diversity or self-certification information, and other qualifications.
• Identity and verification information. Date of birth, government-issued identification details, taxpayer or business identification numbers, proof of address, selfie or photograph, business-registration records, license records, insurance certificates, background or screening results, and verification status, but only when a verification or legally required process requests them.
• Project and opportunity information. Project name, description, location, scope, plans, specifications, trades, budget, estimated value, schedule, milestones, staffing needs, eligibility requirements, visibility settings, attachments, invitation lists, status, and project activity.
• Bids, proposals, and commercial information. Bid amounts, estimates, line items, qualifications, exclusions, schedules, responses, award status, contract-related documents, change information, purchase or subscription history, saved items, and marketplace interactions.
• Communications and user content. Direct messages, group messages, forum posts, comments, reviews, ratings, testimonials, support tickets, survey responses, feedback, dispute submissions, reports, audio or video submitted through enabled features, and files or images you upload.
• Team and organization information. Invited users, team membership, job function, permissions, approval authority, office assignment, activity, and organization-administration records.
• Payment and payout information. Billing name and address, transaction amount, subscription plan, invoices, tax information, payment status, payout instructions, and limited payment-card or bank-account information. Full payment credentials are generally collected and processed by a payment provider rather than stored directly by CrewUp.
• Marketing, event, and support information. Newsletter registration, event registration or ticket information, campaign responses, referral source, promotion entries, sales inquiries, support history, and records of communications with us.
• Information about other people. Contact details, references, team invitations, project participants, or other information you choose to submit about another person. You must have authority and a lawful basis to provide that information.

3.2 Information collected automatically

• Device and network information. IP address, browser type, device type, operating system, device identifiers, app version, language, carrier, network type, screen characteristics, and similar technical data.
• Usage and activity information. Pages and screens viewed, searches, filters, clicks, referring URLs, navigation paths, access times, session duration, feature use, projects viewed, profiles viewed, invitations, message metadata, saved items, downloads, uploads, and interaction with emails or notifications.
• Approximate location. General location inferred from an IP address and the location associated with a project, office, service area, or address you provide.
• Precise location. GPS or similarly precise location only if a location-enabled feature requests it and you grant device permission. You may revoke permission through device settings, although some location features may stop working.
• Cookie and similar-technology information. Cookie identifiers, local storage, pixels, tags, SDK events, attribution data, and analytics or advertising identifiers, as described in Section 12.
• Security and diagnostic information. Login attempts, authentication events, access logs, device reputation, suspected abuse, fraud signals, crash reports, error logs, performance data, and audit trails.

3.3 Information from other sources

• Other users and organizations. A company administrator, project owner, contractor, reference, or team member may provide your information, invite you to an account, mention you in content, or submit a review or report.
• Public and professional sources. Business registries, licensing agencies, certification directories, websites, professional networks, government databases, sanctions lists, and other lawfully available sources used for verification, safety, fraud prevention, or profile completion.
• Identity, credential, and screening providers. Verification result, document validity, match status, risk indicators, or background-check information where the feature is available and lawful. Separate notices and authorizations may apply.
• Payment and financial service providers. Transaction status, payment method token, billing details, chargeback information, and fraud indicators.
• Integrations and sign-in providers. Name, email, profile information, organization membership, authentication token, calendar or contact information, and other data you authorize an integration to provide.
• Marketing and analytics partners. Campaign source, referral information, audience or attribution data, and information about interactions with CrewUp advertisements or communications.

3.4 Sensitive personal information

Depending on the feature and the information you submit, CrewUp may process information considered sensitive under applicable law, such as government identifiers, account credentials, financial account information, precise geolocation, race or ethnicity included in an optional business certification, union membership, disability-related accommodation information, or identity-verification information. CrewUp seeks to collect sensitive information only when reasonably necessary, with consent or another lawful basis where required. Do not upload sensitive information that a feature does not request.

3.5 Information CrewUp does not intentionally request

Unless a specific feature and separate notice expressly requests it, do not submit medical records, consumer credit reports, criminal-history records, Social Security numbers, immigration documents, biometric templates, information about children, or trade secrets belonging to another party. If you include such information in messages, project documents, community posts, or free-text fields, CrewUp may process it as part of hosting and delivering the content, but that does not mean CrewUp requested or endorsed the submission.

• Provide and operate the Services. Create accounts; authenticate users; host profiles; publish projects; enable search, matching, bids, proposals, messaging, reviews, community participation, document storage, team administration, notifications, subscriptions, and integrations.
• Facilitate marketplace connections. Help users discover relevant contractors and opportunities; deliver invitations and alerts; organize search results; support shortlists, saved items, and professional networking.
• Verify users and qualifications. Confirm identity, business registration, licenses, insurance, certifications, and other credentials; display verification indicators; prevent impersonation and misrepresentation.
• Process transactions. Administer subscriptions, billing, invoices, credits, refunds, taxes, payouts, chargebacks, and payment-related support.
• Communicate. Send account, project, bid, message, billing, security, verification, policy, and service notices; respond to inquiries; provide support; and send marketing where permitted.
• Personalize and improve. Remember preferences; recommend features, profiles, projects, or content; measure performance; conduct research; debug errors; and develop new products.
• Maintain trust and safety. Detect, investigate, and prevent fraud, spam, harassment, account compromise, unsafe conduct, prohibited content, payment abuse, sanctions violations, and violations of our terms or policies.
• Protect legal rights and comply with law. Preserve records; respond to lawful requests; enforce agreements; establish, exercise, or defend legal claims; conduct audits; and satisfy tax, accounting, consumer-protection, and regulatory obligations.
• Corporate operations. Perform planning, reporting, due diligence, governance, insurance, risk management, and transactions involving a merger, financing, acquisition, reorganization, or sale of assets.
• Create deidentified or aggregated information. Analyze trends, platform performance, marketplace supply and demand, and industry activity using information that is not reasonably linkable to an individual, subject to applicable law.

Where the law requires CrewUp to identify a legal basis, CrewUp relies on one or more of the following, depending on the activity and context:

If CrewUp plans to use personal information for a materially different purpose that is incompatible with the purpose for which it was collected, CrewUp will provide additional notice and obtain consent when required.

CrewUp is designed to help businesses find one another. Information you choose to publish or make available through a profile, project, proposal, review, community post, portfolio, credential, company page, or similar feature may be visible to other users or, depending on the setting, to the public and search engines.

• Public information. May include business name, logo, profile photo, professional name, trade, service area, business description, portfolio, public reviews, public community content, selected credentials, website, and other fields labeled public.
• Members-only information. May include opportunity details, member profiles, availability, network activity, and content restricted to signed-in users or a membership tier.
• Transaction or connection information. Project owners, invited contractors, bidders, selected team members, and counterparties may receive information needed to evaluate, communicate, contract, manage work, or resolve a dispute.
• Organization-admin access. Authorized administrators may access, manage, export, retain, or delete account and workspace information according to organization settings and law.

CrewUp may disclose personal information to the following categories of recipients for the purposes described in this Policy:

• Marketplace users and the public. As directed by visibility settings, marketplace functions, invitations, proposals, messaging, reviews, community features, and other actions you take.
• Your organization and administrators. To manage accounts, permissions, workspaces, subscriptions, projects, integrations, compliance, and security.
• Service providers and processors. Hosting, cloud database, storage, content delivery, authentication, cybersecurity, analytics, communications, email, SMS, push notifications, customer support, document processing, payment, identity verification, license verification, background screening, marketing, advertising, and professional advisers.
• Payment and transaction parties. Payment processors, financial institutions, card networks, fraud-prevention providers, tax providers, and transaction counterparties as necessary to process or document a transaction.
• Integrations and third-party services. When you connect an account, enable an API, use SSO, import or export data, or otherwise direct CrewUp to exchange information with another service.
• Affiliates. Current and future entities under common control with CrewUp for shared operations, security, support, analytics, administration, or other purposes consistent with this Policy, subject to applicable law.
• Authorities and other parties for legal or safety reasons. Courts, regulators, law enforcement, government agencies, insurers, counsel, investigators, and affected parties where CrewUp believes disclosure is required or appropriate to comply with law, protect rights, prevent harm, investigate misconduct, or enforce agreements.
• Corporate transaction participants. Prospective or actual buyers, sellers, investors, lenders, advisers, and successors in connection with diligence, financing, merger, acquisition, reorganization, bankruptcy, or transfer of some or all assets.
• With your direction or consent. Any other recipient you authorize or direct CrewUp to contact.

CrewUp may disclose deidentified or aggregated information that does not reasonably identify an individual, and may require recipients not to attempt to reidentify it where required by law.

CrewUp does not sell personal information for monetary payment in the ordinary meaning of "sell." Some state privacy laws, however, define "sale," "sharing," or "targeted advertising" broadly enough to include disclosing identifiers, device information, internet activity, approximate location, or advertising data to certain analytics or advertising partners in exchange for services or other value.

If CrewUp engages in an activity that applicable law treats as a sale, sharing, or targeted advertising, eligible users may opt out through the "Your Privacy Choices" link on the Services, an enabled cookie-preference tool, or the methods in Section 18. CrewUp will also process legally recognized browser-based universal opt-out preference signals, such as Global Privacy Control, for the browser or device from which the signal is sent, where required.

CrewUp does not knowingly sell or share personal information of persons under 16. CrewUp does not use or disclose sensitive personal information for purposes that require a right to limit under California law unless it provides the required notice and choice.

CrewUp may use rules, algorithms, machine learning, or AI-assisted tools to rank search results, recommend projects or contractors, detect fraud or spam, moderate content, identify duplicate accounts, summarize or categorize content, assist support personnel, and improve the Services. These systems may consider information such as trade, location, service area, qualifications, availability, profile completeness, project requirements, activity, responsiveness, reputation signals, and security indicators.

Recommendations and rankings are informational and do not guarantee qualification, availability, performance, safety, licensing, insurance, legal compliance, or project success. CrewUp does not intend to make a decision based solely on automated processing that produces legal or similarly significant effects on an individual unless the feature provides legally required notice, safeguards, consent, opt-out, appeal, or human review.

Do not enter confidential, regulated, or sensitive personal information into an AI-assisted feature unless the feature specifically requests it and explains how it will be handled. CrewUp may review automated outputs for accuracy, safety, and quality.

CrewUp may offer identity, business, license, insurance, sanctions, or credential-verification features directly or through providers. A verification badge or status indicates only that a defined check was completed using information available at a particular time. It is not an endorsement, warranty, guarantee, professional license, safety certification, or substitute for a user's own due diligence.

If CrewUp offers a consumer report or background check governed by the Fair Credit Reporting Act or a similar law, CrewUp or the requesting business will provide separate disclosures, obtain any required authorization, and follow applicable adverse-action procedures. Unless separately stated, CrewUp is not representing that ordinary marketplace profiles, ratings, or verification results are consumer reports.

Credential records may change or expire. Users are responsible for keeping submitted information accurate and for independently confirming licenses, insurance, bonding, references, eligibility, and other qualifications before entering a transaction or allowing jobsite access.

CrewUp may use a third-party payment processor to handle subscription fees, project-related payments, payouts, refunds, or other transactions. The processor may collect payment-card, bank-account, tax, identity, device, and transaction information under its own privacy notice and contractual role. CrewUp typically receives a token, limited account details, transaction status, and records needed for billing, support, accounting, fraud prevention, and legal compliance.

CrewUp is not a bank, escrow service, money transmitter, or financial adviser unless a specific feature expressly states otherwise. Payment features may be subject to additional terms and identity-verification requirements. Do not send payment credentials through messages or community posts.

CrewUp and its providers may use cookies, pixels, tags, SDKs, local storage, and similar technologies. These technologies can recognize a browser or device, maintain a session, remember preferences, measure performance, prevent fraud, understand feature use, attribute campaigns, and, if enabled, support advertising.

You can manage non-essential technologies through an available cookie-preference tool, browser settings, device settings, or the "Your Privacy Choices" link. Blocking cookies may affect login, preferences, or other features. Browser settings operate by browser and device, so choices may need to be repeated. CrewUp responds to Global Privacy Control or another legally recognized universal opt-out signal where required; CrewUp does not otherwise respond to legacy "Do Not Track" signals that lack a uniform legal standard.

A CrewUp mobile application may request device permissions only when relevant to a feature. Permissions may include notifications; camera and photo library for profile, project, credential, and document uploads; files and storage for attachments; location for nearby work or project functions; microphone for audio or video features; contacts or calendar for an optional import, invitation, or scheduling feature; and device identifiers for security, analytics, or attribution. The permission prompt and app settings provide additional control.

You can revoke a permission in device settings. Revocation does not delete information already submitted and may prevent a feature from working. CrewUp will seek additional consent where law requires it, including for mobile-app tracking used for targeted advertising.

• Service communications. CrewUp may send non-promotional messages about accounts, projects, bids, messages, transactions, verification, security, policy changes, or support. These are part of the Services and may continue while an account remains active.
• Email marketing. You may unsubscribe through the link in a marketing email or contact CrewUp. CrewUp may retain a suppression record so it does not send the marketing you declined.
• Text messages. If you opt in to SMS or similar messages, consent is not a condition of purchase unless expressly stated. Message and data rates may apply. You may reply STOP or use the provided method to opt out; HELP may provide assistance.
• Push notifications. You may change push-notification preferences through the app or device settings.
• Marketplace alerts. Project, bid, profile, saved-search, and activity alerts can generally be adjusted in account notification settings, subject to essential notices.

CrewUp retains personal information for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining marketplace integrity, preserving transaction and dispute records, complying with law, enforcing agreements, and protecting users. Retention depends on the information, account status, feature, legal obligations, and risk of harm from unauthorized use or disclosure.

These periods are general targets, not guarantees for every system. CrewUp may delete information sooner when it is no longer needed or retain it longer when required or permitted by law. When deletion is not immediately feasible, CrewUp may isolate information from active use until secure deletion or anonymization is possible.

CrewUp uses administrative, technical, and physical safeguards designed to protect personal information, taking into account the nature of the information, processing risks, available technology, and cost. Safeguards may include access controls, role-based permissions, encryption in transit and where appropriate at rest, multi-factor authentication options, logging, monitoring, backups, vulnerability management, secure development practices, vendor review, personnel confidentiality obligations, and incident-response procedures.

No system, transmission, or storage method is completely secure. CrewUp cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur. Users should use a unique password, enable multi-factor authentication when available, protect devices and access tokens, limit team permissions, verify recipients before sending information, keep credentials confidential, and promptly report suspected compromise.

If CrewUp becomes aware of a security incident involving personal information, it will investigate and provide legally required notices to affected individuals, customers, regulators, or others. Any notice will be made in the manner and timeframe required by applicable law.

• Profile and project visibility. Review visibility labels and limit what you publish. Some core business fields must be visible for marketplace functions.
• Account information. Update inaccurate profile or company information through account settings or by contacting CrewUp. Certain verified fields may require re-verification.
• Documents and content. Delete eligible content through the feature or request assistance. Deletion may be restricted for shared records, disputes, legal obligations, backups, or content another user controls.
• Connections and messages. Manage invitations, blocked users, saved items, or notifications through available controls. A recipient may retain messages already delivered.
• Integrations. Disconnect an integration through CrewUp or the provider. Disconnection stops future exchange but may not delete previously exchanged information.
• Device permissions. Change location, camera, notification, contact, calendar, microphone, or tracking permissions in device settings.
• Cookies and targeted advertising. Use the cookie tool, "Your Privacy Choices," browser controls, device controls, or a recognized universal opt-out mechanism.
• Account closure. Use the account deletion feature if available or contact CrewUp. Some information will remain as described in Section 15.

Depending on your state of residence, the law and its applicability thresholds, you may have some or all of the following rights. Exceptions apply, including for business-to-business, employment, deidentified, publicly available, regulated, fraud-prevention, security, transaction, and legal-claims information.

• Confirm whether CrewUp processes your personal information and access or obtain a copy of it.
• Request correction of inaccurate personal information.
• Request deletion of personal information.
• Request data portability in a usable format, where technically feasible.
• Opt out of sale, sharing, targeted advertising, or certain profiling in furtherance of decisions producing legal or similarly significant effects.
• Limit certain uses and disclosures of sensitive personal information, or withdraw consent to sensitive-data processing, where applicable.
• Obtain a list of specific third parties or categories of third parties to which personal data was disclosed where required by law.
• Appeal CrewUp's denial of a privacy request where state law provides an appeal right.
• Receive equal service and not be unlawfully discriminated against for exercising a privacy right.

18.1 How to submit a request

Submit a request by emailing privacy@crewupapp.co, using the privacy request form or "Your Privacy Choices" link made available on crewupapp.co, or writing to the address in Section 26. If CrewUp publishes a designated telephone method, you may also use that method. Identify the right you wish to exercise, your state of residence, and the CrewUp account or contact information associated with you.

CrewUp will take reasonable steps to verify your identity and authority, which may include confirming control of an email address or account, requesting information matched to CrewUp records, or obtaining a signed declaration. CrewUp will request only information reasonably necessary for verification. If CrewUp cannot verify a request, it may deny or limit the request as permitted by law.

An authorized agent may submit a request where permitted. CrewUp may require proof of authorization and may ask the individual to verify identity or confirm the agent's authority directly, unless a valid power of attorney or another legal exception applies. Parents or guardians may act for a minor where legally permitted, although the Services are not intended for minors.

CrewUp will respond within the timeframe required by applicable law. If CrewUp denies a request, the response will explain the basis where required and provide appeal instructions if applicable. To appeal, reply to the decision or email privacy@crewupapp.co with "Privacy Appeal" in the subject line. CrewUp will not charge a fee unless the law permits a fee for excessive, repetitive, or manifestly unfounded requests.

18.2 California Notice at Collection and supplemental disclosure

For California residents, the following table summarizes categories of personal information CrewUp may have collected in the preceding 12 months, sources, business or commercial purposes, and categories of recipients. Whether a category applies to a particular person depends on the Services used.

CrewUp's business and commercial purposes are described in Sections 4 and 7. Retention criteria and illustrative periods are described in Section 15. CrewUp does not use or disclose sensitive personal information for purposes outside those permitted by California law without providing a right to limit. CrewUp does not knowingly sell or share personal information of consumers under age 16.

CrewUp does not offer a financial incentive or price or service difference in exchange for personal information unless it first provides a separate notice explaining the material terms and obtains any required opt-in consent. California residents may also request information regarding certain disclosures for third parties' own direct-marketing purposes under California's "Shine the Light" law by contacting CrewUp.

18.3 Nevada residents

Nevada residents may submit a verified request to opt out of a covered sale of certain personal information under Nevada law by contacting privacy@crewupapp.co. CrewUp does not currently sell covered information for monetary consideration as "sale" is defined by Nevada law, but it will process qualifying requests if its practices change.

If European data protection law applies, CrewUp is generally the controller for the processing described in this Policy, except where it acts as a processor for an enterprise customer or another controller. CrewUp's purposes and legal bases are described in Sections 4 and 5.

• Your rights. Subject to conditions and exceptions, you may request access, rectification, erasure, restriction, portability, and objection; withdraw consent prospectively; and object to direct marketing at any time. Where processing is based on legitimate interests, you may object based on your particular situation.
• Automated decisions. You may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects. CrewUp's intended use of automated tools is described in Section 9.
• Complaints. You may lodge a complaint with the data protection authority where you live or work or where an alleged infringement occurred. CrewUp encourages you to contact it first so it can address the concern.
• Retention. CrewUp applies the criteria and periods in Section 15 and reviews whether continued retention is necessary.
• Required information. Certain account, authentication, professional, project, transaction, and billing information is required to provide requested Services. If you do not provide it, CrewUp may be unable to create an account, verify a credential, complete a transaction, or provide a feature.

CrewUp may transfer personal information to the United States and other countries that may not provide the same level of protection as your home jurisdiction. When required, CrewUp uses an approved transfer mechanism, such as an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful safeguard, and may implement supplementary measures. You may contact CrewUp for information about applicable safeguards.

Residents of other countries may have rights under local law, including rights to access, correct, delete, withdraw consent, object, restrict processing, receive a portable copy, or complain to a regulator. CrewUp will honor applicable rights and cross-border transfer requirements where the law applies to its processing. Because the Services are operated from the United States, information may be processed in the United States and in locations where CrewUp's providers operate.

The Services are intended for business users age 18 or older and are not directed to children under 13. CrewUp does not knowingly collect personal information from a child under 13. If CrewUp learns that it collected such information without legally sufficient parental consent, it will take reasonable steps to delete it. A parent or guardian who believes a child submitted information should contact privacy@crewupapp.co.

CrewUp does not knowingly sell or share personal information of persons under 16. Users must not create accounts for minors, invite minors as team members, or upload information about minors unless expressly permitted by CrewUp and lawful. Age restrictions may be higher in some jurisdictions.

The Services may link to or integrate with third-party websites, apps, identity providers, payment processors, mapping tools, calendars, storage providers, social networks, business software, government registries, or other services. Their privacy practices are governed by their notices, not this Policy, when they determine their own purposes and means of processing. Review those notices before providing information or enabling an integration.

CrewUp is not responsible for a third party's privacy, security, content, or conduct. Disabling an integration may stop future transfers but will not necessarily delete information already received by either party. Contact the third party to exercise rights regarding information it controls.

If you submit personal information about an employee, contractor, applicant, client, property owner, reference, project participant, or other person, you represent that you are authorized to do so and have provided any notice and obtained any consent required by law. Do not use CrewUp to collect, infer, or discriminate based on protected characteristics unlawfully.

Business users must use information obtained through CrewUp only for legitimate professional purposes consistent with applicable law, CrewUp's terms, and the expectations created by the relevant feature. Scraping, unauthorized profiling, unsolicited bulk communications, credential misuse, harassment, identity theft, and resale of marketplace data are prohibited.

If CrewUp is involved in a financing, acquisition, merger, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be reviewed and transferred subject to appropriate confidentiality and applicable law. A successor may continue processing consistent with this Policy unless it provides a new notice.

CrewUp may preserve information subject to a legal hold or disclose information in response to a subpoena, court order, warrant, regulatory request, or other lawful process. Where legally permitted and appropriate, CrewUp may notify the affected user before disclosure. CrewUp may challenge requests it believes are invalid, overbroad, or inconsistent with user rights, but it is not obligated to do so in every case.

CrewUp may update this Policy to reflect changes in the Services, technology, vendors, law, or business practices. CrewUp will post the updated version with a revised "Last updated" date. If a change is material, CrewUp will provide additional notice as required, such as an in-product notice, email, banner, or renewed consent. Unless law requires otherwise, changes become effective when stated in the updated notice.

CrewUp may retain prior versions for reference. Continued use after an update does not substitute for consent where the law requires express consent.

Questions, privacy requests, complaints, or security concerns may be directed to:

For an urgent account-security issue, use CrewUp's support channel in addition to the privacy contact. Do not include passwords, complete payment-card numbers, Social Security numbers, or unredacted identity documents in an ordinary email.

• "Controller" or "business." An entity that determines the purposes and means of processing personal information.
• "Processor" or "service provider." An entity that processes personal information on behalf of a controller or business under contractual restrictions.
• "Process" or "processing." Any operation performed on personal information, including collection, use, storage, organization, disclosure, analysis, transfer, or deletion.
• "Sale," "sharing," and "targeted advertising." Have the meanings assigned by applicable state law and may extend beyond an exchange for money.
• "Sensitive personal information." Personal information treated as sensitive under applicable law, which may include government identifiers, precise geolocation, financial credentials, account credentials, biometric data used for identification, and certain demographic or health information.
• "User content." Information, messages, documents, images, reviews, projects, bids, proposals, comments, or other materials a user submits to the Services.