TrvlCrewBack to home

Privacy notice

TrvlCrew is operated by Viktor Nobiuz ("we", "us"). We act as the data controller for personal data collected through the service. This notice explains what we collect, why, who we share it with, and the rights you have.

What we collect

  • Account details — name, email, account type (operator or traveller), optional avatar and phone.
  • Tour content — itineraries, documents, announcements, boarding passes, field notes and photos that operators add to a tour.
  • Traveller activity — tour membership, chat messages, gallery photos and readiness submissions, including any notes added to them.
  • Usage and device data — IP address, browser and device identifiers, basic analytics about how the app is used.
  • Payment metadata — the amount, status, and identifiers of payment requests you make or receive. Tour payments are made to the operator directly; we never collect card details.

Why we use it

  • Creating and running your account and tours (contract performance).
  • Delivering the features you use — chat, documents, notifications (contract).
  • Security, fraud prevention, and abuse handling (legitimate interests).
  • Product improvement and customer support (legitimate interests).
  • Meeting legal, tax, and accounting obligations (legal obligation).

Who we share it with

  • Service providers — hosting, database, email delivery, and analytics providers who process data on our behalf under written agreements.
  • Paddle — our merchant of record if you buy a paid TrvlCrew plan (none are sold today). Paddle would process the card data, billing, tax and refunds for that purchase. See Paddle's privacy policy.
  • Professional advisers — legal, accounting, or tax advisers where needed.
  • Authorities — where required by law or to protect rights, safety, or property.

Who can see what inside the app

Tour content — the itinerary, documents, map, announcements, chat, gallery and published field notes — is visible to the people on that tour. Field notes are written and published by the operator; they are not private traveller notes. Everyone on the tour operator's team sees their business's tours, its travellers' names and what travellers share on joining, unless a tour is restricted to its own team. What a traveller shares by choice (passport number, date of birth, allergies and health) opens only for the business's owners and the operators running that tour (its lead and those assigned to it), and the traveller can see when it was opened. Payment requests are visible to the traveller who owes them, the business's owners and the operators running that tour.

Each tour operator's business keeps a library of the stays, activities, restaurants, transport companies, guides and drivers its tours use, with their contact details and the team's notes. Only that business's team sees its library; other businesses never do. Travellers see the phone number and website of the places and companies on their own tour, never supplier emails, notes or crew contacts.

Copies kept on your phone

So the app works without signal, it keeps a copy of your tours on the device you use it on, from a week before each tour starts: the itinerary, travel and stays, the tour's documents and your own, field notes, announcements, your checklist and recent chat messages. It holds only what you can already see in the app. Operators' devices also keep travellers' names, phone numbers, emergency contacts, diets and languages; passport, allergy and health details are never kept on a device. Changes you make without signal wait on the device until they can be sent.

A copy is removed a week after the tour ends, as soon as you leave or are removed from the tour, when you sign out, and when someone else signs in on the same device. You can remove it yourself at any time with "Remove from this phone" on the tour's overview. The copy is protected by your device's lock; keep it locked.

Retention

We keep account and tour data while your account is active. When you delete your account or a tour we remove associated content, except records we're required to keep for legal, tax, or fraud-prevention reasons (typically up to 7 years for payment-related records).

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. You can also complain to your local data protection authority. To exercise a right, contact us via the contact page and we'll respond within one month.

International transfers

Some of our service providers, including Paddle, operate outside the UK / EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and audited hosting — to protect personal data. No system is perfectly secure; if we ever detect a breach that affects you, we'll notify you as required by law.

Cookies

We use essential cookies for login and session management, and lightweight product analytics. We don't use advertising cookies.

Reference data

Country details come from GeoNames (CC BY 4.0), airports from OurAirports (public domain), and airline names from OpenFlights, made available under the Open Database License, with our corrections.

This is a plain-language notice maintained by Viktor Nobiuz. For questions, please get in touch.